<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-chaos-engineering
description: >-
  Inject controlled failures into security infrastructure to test detection, response, and resilience capabilities.
domain: cybersecurity
subdomain: devsecops
tags:
  - chaos-engineering
  - resilience-testing
  - detection-validation
  - gameday
  - fault-injection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562", "T1489", "T1499"]
---

# Performing Security Chaos Engineering

## Overview

Security chaos engineering applies controlled fault injection to security controls — SIEM pipelines, EDR agents, network sensors, and alerting paths — to validate that defenses hold and detections fire under adversarial conditions. The goal is discovering silent failure modes before attackers do.

Mode: `[MODE: PURPLE]` — Adversary emulation meets detection validation.

## Experiment Types

| Experiment | Target | Expected Signal | Success Criterion |
|---|---|---|---|
| Log pipeline drop | SIEM forwarder | Gap alert fires within SLA | Alert within 5 min of drop |
| EDR agent kill | Endpoint protection | SOC ticket created | Ticket within 15 min |
| Alert suppression | SIEM correlation rule | Suppression detected | Rule re-enabled, finding logged |
| Credential stuffing flood | Auth service | Rate-limit + lockout | Block rate >99%, alert fires |
| Data exfil simulation | DLP / network sensor | DLP alert + block | Alert within 2 min |
| Certificate expiry | TLS endpoints | Certificate monitoring alert | Alert 30 days before expiry |

## Workflow

1. Define steady-state hypothesis — what does "working" look like?
2. Select target control and blast radius
3. Get change-window approval and notify SOC
4. Inject fault at minimal scope
5. Observe detection and response signals
6. Measure time-to-detect (TTD) and time-to-respond (TTR)
7. Roll back injection
8. Document gap if hypothesis was falsified
9. File remediation ticket with SLA

## Fault Injection Methods

| Method | Tooling | Scope |
|---|---|---|
| Process kill | `kill -9`, Chaos Monkey | Single agent or service |
| Network partition | `iptables`, `tc netem` | Forwarder-to-SIEM path |
| Disk fill | `fallocate` | Log buffer exhaustion |
| Clock skew | `timedatectl`, NTP block | Correlation time-window breaks |
| Config mutation | Direct file edit, Ansible | Rule or policy corruption |
| Credential rotation | IAM, Vault CLI | Auth path stress |

## Detection Validation Checklist

- [ ] Baseline metric captured before injection
- [ ] Fault scoped to non-production or isolated segment
- [ ] SOC on standby with rollback path confirmed
- [ ] Detection fired within defined SLA window
- [ ] Evidence preserved (screenshot, log snippet, ticket ID)
- [ ] Rollback completed and steady-state restored
- [ ] Gap filed if detection did not fire

## Key Metrics

| Metric | Target | Measurement |
|---|---|---|
| TTD (time to detect) | <5 min for critical | Alert timestamp minus injection timestamp |
| TTR (time to respond) | <15 min for critical | SOC acknowledgment timestamp |
| False negative rate | <2% per quarter | Experiments without detection / total |
| Rollback success rate | 100% | Injections cleanly reversed |

## Related Techniques

- [Implementing CI/CD Security Gates](../securing-ci-cd-pipeline-infrastructure/SKILL.md)
- [Performing Security Control Validation](../building-security-regression-tests/SKILL.md)
