A Primer on Gremlin's Security

We wanted to take a break from our usual espousing of the value, benefits, and methods of Chaos Engineering and talk about something else near and dear to our hearts, security. We've <span class="code-class-custom">been working</span> behind the scenes to bring you new features and improvements that we're just dying to share!

Auditing & Penetration Testing

Gremlin has always taken the security of our systems and infrastructure very seriously. Security is a pillar of our philosophy and an integral part of everything we do. But it's not enough to think we're accomplishing our goals and be satisfied with our own internal auditing and review efforts. Much like with Chaos Engineering, the efficacy of our systems must be rigorously tested in the real world, by real threat actors, before we can put faith in these systems and run them in production. To that end we partnered with a security firm, Bishop Fox, to perform an extensive security audit and penetration testing against all three components that make up the Gremlin service: agent, API, and website app. We're happy to say that after working with their team, we have passed with flying colors. Our auditors did their job well and identified several vulnerabilities which we quickly remediated. Those remediations underwent re-testing and were certified as fixed by our auditors (report available upon request).

Our experience working with an external security auditor has been invaluable. We will continue to have them regularly performed!

Agent Hardening

One of the results of our external audit experience was adding additional hardening to the Gremlin agent. The Gremlin agent has always had security at the heart of its design. From its Least Privileges principals, requiring only the permissions absolutely necessary to impart its impact, to its use of strong encryption and ephemeral keys. We've taken this a step further by locking down the binaries Gremlin depends on so we can be assured they have not been modified or redirected by a nefarious actor. We will continue to identify additional hardening that can be applied to Gremlin to ensure your experience is safe and secure!

Multi-factor Authentication

Passwords alone have always been an inherent weakness when authenticating users. Good passwords are difficult for people to remember, and those that are easy to remember are more often easy for a computer to guess. So we've added the ability to enable a second authentication factor using a Google-compatible authenticator (6 digit time-based tokens). This feature ensures that even if someone were to guess or remotely steal your password, your account will remain secure. Multi-factor authentication is available to all users and can be required for all users in your company by enabling the force MFA option available to super-users.

Gremlin recommends using an authenticator that cannot export their secret keys, such as the Google Authenticator. For more information visit our help documentation.

SAML SSO Authentication

For those customers that desire more control over authentication and/or tighter integration with their existing identity management system we now offer SAML authentication. SAML allows your organization to retain strict control over how your users authenticate with Gremlin. In order to utilize SAML, your organization must have an identity provider that supports SAML SP initiated logins such as Google, AWS, Active Directory Federated Services (ADFS), OneLogin, or others (for a list see: https://auth0.com/docs/protocols/saml/samlp-providers). We are excited about the possibilities that SAML brings for the future and plan to continue expanding our support to include authorization controls.For more information visit our help documentation.

As always, if you have questions or concerns please reach out to us at security@gremlin.com or visit us on Slack.