BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsides-tallinn-2026//speaker//RM8KY7
BEGIN:VTIMEZONE
TZID:Europe/Helsinki
BEGIN:DAYLIGHT
DTSTART:20250925T000000
TZNAME:EEST
TZOFFSETFROM:+0300
TZOFFSETTO:+0300
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T040000
RDATE:20261025T040000
TZNAME:EET
TZOFFSETFROM:+0300
TZOFFSETTO:+0200
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T040000
RDATE:20270328T040000
TZNAME:EEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0300
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Nobody monitors the monitor: Chaos engineering for the security te
 am's own infrastructure - Iuliia Laaneots
DTSTART;TZID=Europe/Helsinki:20260925T173000
DTEND;TZID=Europe/Helsinki:20260925T181500
DTSTAMP:20260926T112159Z
UID:pretalx-bsides-tallinn-2026-88LUCH@pretalx.com
DESCRIPTION:We ask a lot of questions about other people's infrastructure 
 resilience. Turns out we'd never asked them about our own.\n\nThis is the 
 story of what happened when security team finally did. We sat down to writ
 e a Business Continuity Plan for our security monitoring platform — a SI
 EM ingesting 60+ log sources\, running detections across infrastructure se
 rving millions of users across 50 countries — and discovered that "untes
 ted" covers a lot more ground than we'd assumed. \n\nSome failure modes we
 re obvious. The interesting ones weren't: the silent degradation scenario 
 where the platform stays technically up but detection rules quietly stop r
 unning and no alert fires\; the compounding case where a routine outage ov
 erlaps with an active incident and your tolerable downtime drops from days
  to hours\; the log volume spike that leaves you triaging a live attack wi
 th an increasingly incomplete picture — and no indication that the pictu
 re is incomplete.\n\nAttendees will leave with:\n\n- Why your SIEM needs a
  BIA\, not just an SLA. The difference between "it should recover in 4 hou
 rs" and "here's what breaks if it doesn't."\n- The failure scenarios that 
 don't look like failures. Silent degradation and partial log loss are hard
 er to detect - and more dangerous - than a clean outage.\n- A chaos test l
 ist for security infrastructure. What to test and what we found when we ac
 tually ran pieces of it.
LOCATION:Stage B
URL:https://pretalx.com/bsides-tallinn-2026/talk/88LUCH/
END:VEVENT
END:VCALENDAR