The most valuable asset of any cloud-based organization is data, which is increasingly exposed to sophisticated cyberattacks. Until recently, the implementation of security measures in DevOps environments was often considered optional by many government entities and critical national services operating in the cloud. This includes systems managing sensitive information, such as electoral processes or military operations, which have historically been valuable targets for cybercriminals. Resistance to security implementation is often driven by concerns over losing agility in software development, increasing the risk of accumulated vulnerabilities. Nowadays, patching software is no longer enough; adopting a proactive cyber defense strategy, supported by Artificial Intelligence (AI), is crucial to anticipating and mitigating threats. Thus, this work proposes integrating the Security Chaos Engineering (SCE) methodology with a new LLM-based flow to automate the creation of attack defense trees that represent adversary behavior and facilitate the construction of SCE experiments based on these graphical models, enabling teams to stay one step ahead of attackers and implement previously unconsidered defenses. Further detailed information about the experiment performed, along with the steps to replicate it, can be found in the following repository: https://github.com/mariomc14/devsecops-adversary-llm.git.

翻译：任何基于云的组织最宝贵的资产是数据，这些数据日益暴露于复杂的网络攻击之下。直到最近，许多在云端运营的政府实体和关键国家服务仍常将DevOps环境中安全措施的实施视为可选，这包括管理敏感信息的系统（如选举流程或军事行动），这些系统历来是网络犯罪分子的高价值目标。对安全实施的抵触通常源于担心软件开发敏捷性的丧失，从而增加了累积漏洞的风险。如今，仅靠修补软件已不足够；采用由人工智能（AI）支持的主动网络防御策略，对于预测和缓解威胁至关重要。因此，本研究提出将安全混沌工程（SCE）方法与一种新的基于LLM的流程相结合，以自动化创建表示对手行为的攻击防御树，并基于这些图模型促进SCE实验的构建，使团队能够领先攻击者一步，并实施先前未考虑到的防御措施。有关所执行实验的更多详细信息以及复现步骤，可在以下代码库中找到：https://github.com/mariomc14/devsecops-adversary-llm.git。