Compliance testing through sandbox environments

摘要

A compliance user or auditor is enabled to inject failures into a sandbox environment, which may be similar to a production service. The sandbox environment may be monitored by the same automation that watches compliance controls in the production service. As the user injects compliance failures into the sandbox, they may detect the appropriate alerts fire in the monitoring system, thereby gaining trust that the monitoring works as it should. A rich report resulting from the test activities may allow the user or auditor to see how a failure of a compliance control leads to the expected monitoring alert.

主权项

1. A method executed on a computing device to provide compliance testing through sandbox environments, the method comprising:
monitoring a sandbox environment and a iroduction environment of a service simultaneously, wherein the sandbox environment includes one or more servers replicating roles and configurations of servers of the production environment; through an interactive or programmatic user experience managed by a monitoring host, enabling injection of a failure mode to a service; introducing the failure mode to one or more servers of a sandbox environment; monitoring effects of the introduced failure in the sandbox environment; and providing feedback associated with the monitored effects of the introduced failure through the interactive or programmatic user experience, wherein the feedback associated with the monitored effects of the introduced failure includes a rich content report and a risk analysis.