Getting Started with Chaos Engineering - design of an implementation framework in practice

Abstract

Background. Chaos Engineering is proposed as a practice to verify a system's resilience under real, operational conditions. It employs fault injection, is originally developed at Netflix, and supported by several tools from there and other sources. Aims. We aim to introduce Chaos Engineering at ICA Gruppen AB, a group of companies whose core business is grocery retail, to improve their systems' resilience, and to capture our knowledge gained from literature and interviews in a process framework for the introduction of Chaos Engineering. Method. The research is conducted under the design science paradigm, where the problem is conceptualized through a literature study of Chaos Engineering and exploratory interviews in the company. The solution framework is designed based on the literature and a tool survey, and validated by letting software engineers at ICA apply parts of it to the software systems of ica.se website, including its e-shop. Results. The main contributions are a synthesis of Chaos Engineering literature and tools, in depth understanding of the needs of the case company, and guidelines for introducing Chaos Engineering. Conclusions. The applied parts were concluded to be feasible and they successfully discovered a set of initial improvement opportunities for the system's resilience, as well as a suitable Chaos Engineering practice for future resilience testing of the system. We recommend companies using the framework as a guide for the implementation of Chaos Engineering.

On the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security through Security Chaos Engineering

“…Figure 5 shows the execution of ChaosXploit for branch 2, which includes (i) the setup of ChaosXploit (lines 1-5), (ii) the steady state validation which assumes a correct configuration of the policies assigned to the user account under analysis (lines 6-10), (iii) execution of the actions that allow validating the hypothesis through an attempt to restore a previous policy (lines [11][12][13][14][15][16][17][18][19][20]. This last set of lines includes listing the user policies (line 13-14), validating the current version (line 15), identifying the version that allows the privilege escalation (line 16), restoring the desired policy (line 17-18) and validation of the restore (line 20).…”

“…An interesting case study on applying the CE methodology to a real use-case scenario has been conducted in Ref. [18]. The main idea of the authors is to introduce the CE paradigm at ICE Gruppen AB, a group of companies working in the grocery market.…”

“…Table 1 summarizes the findings of the state-of-the-art investigation. It has to be remarked that the works [16][17][18][19] refer to CE applications while [13,24,25] propose SCE employment. Consequently, one could argue that it is obvious that the attributes' value of the CE works tend to be "Resiliency", while "Security" is predominant for the SCE proposals.…”

“…Nevertheless, the proposed framework in Ref. [18] adds security features to the CE requirements. Such confusion is directly derived from the ambiguous definition of CE, as previously stated.…”

Chaos Engineering of Ethereum Blockchain Clients

“…Zhang et al [58] designed ChaosMachine, a tool that conducts chaos engineering experiments at the try-catch level for Java applications. Jernberg et al [33] designed a chaos engineering framework based on the literature and a tool survey, and validated the framework in a real commercial web system. Simonsson et al [43] proposed ChaosOrca, a chaos engineering system that injects system call errors for dockerized applications.…”