Chaos as a Software Product Line—A platform for improving open hybrid‐cloud systems resiliency

Abstract

Nowadays, cloud-native software architectures have a significant relevance due to the speed and agility they provide. These properties lead relevant organizations in different industries, like video streaming (Netflix), car-sharing (Uber, Cabify), banking (BBVA, HSBC), and governmental agencies (NASA, FBI, CERN, ESA) to heavily rely on cloud-native software to run their business-critical applications. Additionally, including fault injection actions in the production infrastructure allows companies to have consistent environments, to improve applications dependability against unexpected failures, to provide better user experience, and to improve the overall system quality. Thus, cloud computing technologies allow development teams to rapidly create complex systems and to continuously deploy them, at a global scale. This work describes Pystol, a novel fault injection platform-represented as aSoftware Product Line-to analyze the effects caused by a wide spectrum of adverse conditions. Pystol is designed to be executed on top of cloud-native environments, either in private or public clouds. The proposed architecture shows a way for representing feature models based on Unified Model Language (in short, UML) component diagrams. Furthermore, we present a thorough empirical study carried out in real-world environments, providing promising results.

On the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security through Security Chaos Engineering

“…Figure 5 shows the execution of ChaosXploit for branch 2, which includes (i) the setup of ChaosXploit (lines 1-5), (ii) the steady state validation which assumes a correct configuration of the policies assigned to the user account under analysis (lines 6-10), (iii) execution of the actions that allow validating the hypothesis through an attempt to restore a previous policy (lines [11][12][13][14][15][16][17][18][19][20]. This last set of lines includes listing the user policies (line 13-14), validating the current version (line 15), identifying the version that allows the privilege escalation (line 16), restoring the desired policy (line 17-18) and validation of the restore (line 20).…”

“…To this extent, the work in Ref. [16] described Pystol, a fault injection framework to argue on the resiliency of hybrid-cloud systems in adverse events. Specifically, Pystol is presented as a Software Product Line (SPL) that can be mounted on top of cloud infrastructures, being able to exploit CE's capacities.…”

“…Table 1 summarizes the findings of the state-of-the-art investigation. It has to be remarked that the works [16][17][18][19] refer to CE applications while [13,24,25] propose SCE employment. Consequently, one could argue that it is obvious that the attributes' value of the CE works tend to be "Resiliency", while "Security" is predominant for the SCE proposals.…”

A Resilience Engineering Approach for the Risk Assessment of IT Services

“…Thus, the current study certainly can contribute to augmenting knowledge on this issue, which is of paramount importance for avoiding the interruption or malfunctioning of the services that the company offers to its customers. Actually, as noted by Camacho et al [60], the inaccessibility of these services due to platform malfunctioning may lead both to severe penalty costs due to the infringement of availability clauses as well as to the loss of market reputation.…”