Risk
8/1/2012
01:16 PM
50%
50%

Netflix Wants You To Adopt Chaos Monkey

Netflix has made its own automated disaster testing service, Chaos Monkey, available as a free public download. Should you turn it loose on your own systems?

It's worth noting that Chaos Monkey is not a security tool, per se. It's not intended to unearth the types of flaws that might lead to a targeted hack or other security breach. MacLeod said it's better characterized as an automated QA tool, though it could help inspire a more serious approach to security in the process.

Chaos Monkey can conceivably help any organization that deploys applications via the cloud. So should you turn the monkey loose? Small and midsize businesses (SMBs) that beg off testing for budget reasons, for example, can't argue with Chaos Monkey's price tag. But MacLeod's not too sure many SMBs are prepared for what the software will do. If you lack the resources to quickly respond to downtime, Chaos Monkey is probably not for you. "There's not a 'reverse' of Chaos Monkey to bring things back up [automatically]," MacLeod said.

No matter your company's size, there are two prerequisites before running Chaos Monkey, according to MacLeod. First: "Know what you're getting into. This is something that is designed to cause problems," MacLeod warned. Chaos Monkey could very well knock you offline, something that's likely to inspire fear in some corners of the business. MacLeod also pointed out that it might be just as scary--and probably for good reason--if you turn on Chaos Monkey and nothing breaks.

The second prerequisite is to have the proper organizational philosophy. Given the tool's purpose--to break stuff--you'd better have buy-in from your bosses before turning it on. Imagine trying to explain yourself to non-technical management after the fact if Chaos Monkey runs rampant within your infrastructure. ("A chaos what?!") "It requires an adventurous spirit and confidence that you've got an architecture that's going to survive this, plus enough humility to know that you're willing to test your site to get better," MacLeod said. "One of the big problems out there is arrogance--'Oh, I know I don't have any problems.'

Even if you're unwilling or unable to invite Chaos Monkey inside your infrastructure, it can still offer a valuable lesson from safe distance. "The best thing about Chaos Monkey is that it's making people think about security and uptime and helping them realize that these aren't optional features in a service. They're something that needs to be designed in from the beginning," MacLeod said. Cutting corners on reliability will lead to unexpected failures--and a bunch of unhappy customers.

"It's like realizing, two-thirds of the way through building a car, that you kind of need an engine and a gas tank, and then trying to figure out where to shove those in," MacLeod added. "It's a lot easier if you start out with the reliability and the security in mind."

This Dr. Dobb's virtual event, Developer-Based Testing, will examine developer-based testing of code in its many forms: the tools, the techniques, the best practices. Sessions led by established experts explain the subtleties of different approaches and the best practices that have worked best in the field. If you want to know more about how to test your code with less effort and better results, one or all of the day's sessions are for you. It happens Aug. 2.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Embedded SW Dev
50%
50%
Embedded SW Dev,
User Rank: Apprentice
8/2/2012 | 5:44:30 PM
re: Netflix Wants You To Adopt Chaos Monkey
Apparently someone let the Chaos Monkey loose. Today's Infoweek daily's link to this story lead to a story about the errant stock trading on Wednesday. Was that a hint that Knight Capital was testing the Chaos Monkey, or did the Chaos Monkey infect the mailing?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0547
Published: 2015-07-04
The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0548
Published: 2015-07-04
The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0551
Published: 2015-07-04
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P2...

CVE-2015-1966
Published: 2015-07-04
Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafte...

CVE-2015-4196
Published: 2015-07-04
Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report