Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.
Start a fresh conversation. Replace the highlighted placeholders.
Use implementing-security-chaos-engineering to design and run an authorized security-chaos experiment in [test environment] that temporarily tests [security control], verifies the detection-and-response SLA, and automatically rolls back the change; report the result and any monitoring gaps.
Required inputs
[test environment]
[security control]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: implementing-security-chaos-engineeringdescription: 'Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience. 'domain: cybersecuritysubdomain: security-operationstags: - security-chaos-engineering- detection-validation- resilience-testing- control-validation- security-operationsversion: '1.0'author: mahipallicense: Apache-2.0nist_ai_rmf: - MEASURE-2.7- MAP-5.1- MANAGE-2.4atlas_techniques: - AML.T0070- AML.T0066- AML.T0082nist_csf: - DE.CM-01- RS.MA-01- GV.OV-01- DE.AE-02mitre_attack: - T1078- T1190- T1059- T1027- T1070
Implementing Security Chaos Engineering
When to Use
When deploying or configuring implementing security chaos engineering capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Design and execute security chaos experiments that intentionally break security
controls to verify that detection, alerting, and response systems work correctly.
# Example: Verify detection when a security group is opened
import boto3
ec2 = boto3.client("ec2")
# Chaos experiment: temporarily add 0.0.0.0/0 rule
ec2.authorize_security_group_ingress(
GroupId="sg-12345",
IpProtocol="tcp", FromPort=22, ToPort=22,
CidrIp="0.0.0.0/0",
)
# Verify: does GuardDuty/Config alert fire within SLA?
# Rollback: remove the rule after verification
Key experiments:
Open a security group and verify Config Rule alerts
Disable CloudTrail and verify detection time
Create IAM admin user and verify alert triggers
Simulate log pipeline failure and check monitoring gaps
Deploy test malware hash and verify EDR response
Examples
# Rollback function for safe experiment execution
def run_experiment(setup_fn, verify_fn, rollback_fn, timeout=300):
try:
setup_fn()
result = verify_fn(timeout)
finally:
rollback_fn()
return result