Security as a chaos experiment

[rajdeepbhattacharya]

Introducing security as a chaos experiments. This will help to measure what happens if the security and compliance tool itself fail. Some of the experiments from cloud provider to provider may vary like -

AWS

• If there is a latency introduced in Guard duty service
• In a multi region deployment if there is issue with one region's Gaurd duty service
• Slowness in cloudwatch , it's impact on security alerts

K8s

• failing API server and it's impact on RBAC of new objects created
• image compliance tool/engine fails (I am not sure if there is a generalised tool used for this)

Will be adding more points to this.

[umamukkara]

Thank you @rajdeepbhattacharya for creating this issue. Chaos to find gaps in security is a very welcome feature IMO. I looked up AWS guard duty and found some tests around this. https://github.com/awslabs/amazon-guardduty-tester .

[rajdeepbhattacharya]

Thanks @umamukkara. This would help but like to have a broader scope in this feature like if there is a policy engine implemented on kubernetes or cloud or dc and if that gets bypassed due to some controller failure or rate limit or any other edge case how would it respond and what could be a fallback.