Aplicación de la ingeniería del caos en la seguridad y resiliencia de un sistema distribuido

Abstract

Some of the notable characteristics of distributed systems are their fault tolerance, scalability, and transparency; they provide availability and data integrity if encryption techniques are used to protect the shared network resources. The confidentiality of the information will depend in part on the security policies in the use of the system, in addition to the correct configuration of the components. This is where most security incidents happen, traditional methods cannot detect configuration errors at least until the failure occurs, in which case the system is already compromised. Security chaos engineering is a new way to detect component failures in order to protect assets under cyber risk scenarios. To demonstrate the application of chaos engineering to the security and resilience of distributed systems, this project first presents the conceptualization of chaos engineering, its background and previous research, as well as its methodology and principles. This, in order to understand its application in the area of computer security as well as the possibilities it generates. Secondly, this project shows a practical simulation of the use of chaos engineering for security in a controlled environment, divided into two phases. In the first phase, a scenario where a client of the distributed system performs multiple cyberattacks in order to hijack information through the use of ransomware is contemplated. In the second phase, the attacks are performed within the same system infrastructure in a scenario where the system administrator can contemplate how hardened the system is configured.