CONTROL RELIABILITY ENGINEERING (CRE): APPLYING SRE PRINCIPLES TO CYBERSECURITY CONTROLS

Summary from the TLDR InfoSec newsletter

Most breaches stem not from novel attacker capability but from security controls that were believed operational yet were actually broken, misconfigured, or never fully implemented, proposing Control Reliability Engineering (CRE) as a direct port of Google's Site Reliability Engineering discipline onto security controls. CRE treats a "Control Incident" (a failed defense, regardless of whether it led to a breach) with the same severity as an actual security incident, applying SLIs/SLOs, error budgets, controls-as-code, continuous control monitoring, and synthetic event injection to catch controls that silently "read zero" while broken. Security teams should build a control ontology/catalog, adopt Control Readiness Reviews before production onboarding, and formalize blameless postmortems for control failures to shift from reactive ticket-based response to engineered, metric-driven control health.