Reliability & Security

Google's Building Secure & Reliable Systems framework, why security IS reliability, and the cross-discipline overlap.

Overview

Two failure modes, one system

Reliability and security are deeply linked. A system that is available but compromised has failed, and a system that is secure but unavailable has failed too.

Google's *Building Secure and Reliable Systems* (BSRS, 2020) is the canonical SRE-meets-security text. Its thesis: many security and reliability practices are the same practices applied to different threat models.

> [!IMPORTANT] The "A" in the CIA triad is exactly SRE's domain. A security incident that takes the service down is also a reliability incident.

Shared practices

Defense in depth — Layered security — Layered reliability
Least privilege — Access control — Smaller blast radius
Blast radius reduction — Confines security incidents — Confines outages
Audit logging — Security investigations — Incident postmortems
Automated remediation — Security events — Reliability events
Game days and chaos — Simulated attacks — Simulated failures

The CIA triad meets reliability

Confidentiality — Secrets, encryption, access control — Pure security
Integrity — Data not tampered with — Security and reliability
Availability — System up and serving — Security (DoS) and reliability (capacity, dependencies)

Examples of the overlap

DDoS mitigation — An attacker is the source — Traffic exceeds capacity — Rate limiting, load shedding, autoscaling, edge caching, CDN, WAF
Secret rotation — Stolen credentials stop working — Rotate without downtime — cert-manager, Vault, AWS Secrets Manager
Compromised credentials — Detect and revoke — Detect anomalous traffic and respond — The same observability stack
Supply chain attacks — Malicious upstream dependency — A dependency change broke the build — Dependency review, SBOM, signed artifacts

The shared vocabulary

Threat model — Attackers, capabilities, targets — What can fail
Trust boundary — Where you stop trusting input — Where you stop trusting upstream
Defense in depth — Layered defenses — Layered prevention
Blast radius — What one compromise affects — What one failure affects
Recovery — From compromise — From incident

BSRS chapters that matter most for SRE

Ch 6: Design for Understandability — Both disciplines need systems engineers can reason about
Ch 7: Design for a Changing Landscape — Threats and dependencies evolve
Ch 8: Design for Resilience — The reliability chapter, framed for security too
Ch 14: Deploying Code — Secure deployment is reliable deployment
Ch 17: Crisis Management — Security incident response is incident response

Where they differ

Adversaries — Reliability deals with noise and failure instead
Legal and regulatory consequences — Often attached to security failures
Chain-of-custody discipline — Forensic investigations
Public disclosure obligations — CVEs, breach notification

The org pattern

At larger companies, SRE collaborates on the overlap: DDoS, supply chain, secret management. Google's "production security" treats reliability and security as one engineering function.

> [!TIP] The 2026 trend: supply chain and AI-related threats are widening the overlap. SREs increasingly own IaC scanning, dependency hygiene, secret management and runtime hardening, and the line between SRE and security engineer blurs.

Key concepts

BSRS Book: Building Secure & Reliable Systems (Google, 2020). Canonical text on the overlap.
CIA + reliability: Confidentiality + Integrity + Availability. The "A" is SRE's domain. Integrity straddles both.
Same patterns, different threat models: Defense in depth, least privilege, blast radius, audit logging — work for security AND reliability.
Supply chain: Both a security concern (malicious deps) and reliability (broken deps). Same controls.
Threat model: Explicit list of attackers / capabilities / targets. SRE analog: "what can fail."
Adversaries vs noise: Security has intentional attackers; reliability has random failure. Different threat models, similar defenses.

When to use it

Designing reliability for high-security systems — the patterns overlap
Reviewing org structure — should SRE and security be more integrated?
Postmortem on a security incident — apply reliability postmortem rigor
Pre-launch reviews — reliability AND security checklist

Interview questions

How are reliability and security related?
How is a security incident different from a reliability incident?
What security skills should every SRE have?