Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/1/2012
01:16 PM
50%
50%

Netflix Wants You To Adopt Chaos Monkey

Netflix has made its own automated disaster testing service, Chaos Monkey, available as a free public download. Should you turn it loose on your own systems?

Netflix is a high-profile consumer service. When things go wrong, people tend to notice. So it might seem strange that the company tries to make things go wrong with its service on a regular basis.

That's indeed the goal of "Chaos Monkey," the automated software Netflix developed to test its infrastructure's mettle. In layman's terms, Chaos Money tries to break stuff. The theory behind this is to build a stronger platform and avoid the types of major, unexpected problems that tend to make IT's phones ring at 2 a.m. (Netflix configures the tool to run only during normal business hours; that way IT staff handle any related issues during the day instead of on nights and weekends.)

Now everyone can embrace the chaos: Netflix just made the source code publicly available as a free download. You'll first need to ask yourself if you've got the guts for it. Or, as Netflix put it in a blog post: "Do you think your applications can handle a troop of mischievous monkeys loose in your infrastructure?"

[ Security researcher Dan Kaminsky wants to address security by changing the fundamental way code is written. Read more at Tired Of Security Problems? Change Rules Of Writing Code. ]

If you're picturing the band of winged monkeys from "The Wizard of Oz" running amok, you're not far off--they've just been reengineered for the cloud. Chaos Monkey deliberately shut downs virtual machines (VMs) within Amazon's Auto-Scaling Groups (ASGs). (Though the software was written with Amazon Web Services in mind, Netflix said Chaos Monkey is flexible enough to work with other cloud platforms.)

By causing intentional failures on individual instances--Netflix generated more than 65,000 failures in the last year, according to the company--you can learn from those errors and their resolutions. Basic example: Is your application hardy enough to weather a failed VM, or could that single instance bring the curtains down on the whole show?

That type of no-holds-barred testing can help unearth and resolve unknown issues before they become major outages. Better yet, it can lead to stronger applications as they're being built, rather than trying to retrofit them after the fact. "By having that constant idea that something's going to break, [Netflix has] within their dev ops and engineering departments the mindset that they have to make sure that no single point can take down the entire site," said Jim MacLeod, product manager at the networking firm WildPackets, in an interview.

In Netflix's case, it makes sense to try to rise to Chaos Monkey's challenge--their bottom line depends upon their site running smoothly. "If you look at Netflix's business model, what really differentiates them isn't just streaming media--it's the fact there's something immediate and easy for users to get to, but that means they have to be fairly reliable," MacLeod said. "Reliability and uptime are things that are difficult to put in afterwards if you don't design it in, just like security."

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Embedded SW Dev
50%
50%
Embedded SW Dev,
User Rank: Apprentice
8/2/2012 | 5:44:30 PM
re: Netflix Wants You To Adopt Chaos Monkey
Apparently someone let the Chaos Monkey loose. Today's Infoweek daily's link to this story lead to a story about the errant stock trading on Wednesday. Was that a hint that Knight Capital was testing the Chaos Monkey, or did the Chaos Monkey infect the mailing?
News
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2021
Edge-DRsplash-10-edge-articles
Cybersecurity: What Is Truly Essential?
Joshua Goldfarb, Director of Product Management at F5,  5/12/2021
Commentary
3 Cybersecurity Myths to Bust
Etay Maor, Sr. Director Security Strategy at Cato Networks,  5/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google Maps is taking "interactive" to a whole new level!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18194
PUBLISHED: 2021-05-17
Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post.
CVE-2020-18195
PUBLISHED: 2021-05-17
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."
CVE-2020-18198
PUBLISHED: 2021-05-17
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."
CVE-2020-21831
PUBLISHED: 2021-05-17
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.
CVE-2020-21842
PUBLISHED: 2021-05-17
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.