Hello everybody, I'm Dave if you want to tweet stuff neary D on Twitter D neary is Diane neary. She's a librarian in New York She's awesome. I don't know her except on Twitter because lots of people tweeted stuff to her and said to me but so How to overcome culture clash, so I'm not an expert in this This is just me sharing some of the things that I have read learned about that I found interesting that kind of plugged into the way that I've been talking to Partners developer communities in other countries about how they can be more effective in open source, but I think there are also lessons for Open source developers about how they can be more welcoming to people from other cultures, so It was culture clash a culture called the culture club and the clash Was that too subtle So communities are messy. This is a makeup community. There's stuff everywhere, but they're not just messy physically They're messy because there's human relationships and human relationships are messy humans are messy You know humans on their own or not, but once they start to get into periods that things break down quickly And cultural differences are very confusing. So this hand sign here on the on the right this Depending on whether you're from Japan from America, whether you're a diver whether you're from France Or Poland will mean completely different things right to some cultures It means zero nothing to other cultures. It means a okay In Japan that means money and in some Middle Eastern countries. I believe this is the equivalent to the middle finger so Same signal and and you know, how do you greet people? I have that I remember specific conference I met a friend that I've known for many years and So I've I'm Irish in Ireland. We don't touch each other very much It's true. It's true. We don't like physical contact is not a thing I lived in France for many years and in France. We we kiss quite a lot But there's no kind of there's there's a certain space that's respected. It's kind of you lean in And in the US people are hollers I found that lots of lots of Americans hug and I met this American friend that I had met in many different contexts And I was like, I don't know what the appropriate physical contact is I was like, oh, well, that's you know, that's nice. I appreciate that we can have a hug and it was like it was okay But physical contact. How do you greet people? How do you behave in different cultures? It's kind of confusing And it's not something we're comfortable talking about very much, which is strange because so This iceberg picture There's the things we do and then there are the reasons why we do them and And There's how you interpret and react to what other people do and your interpretations and reactions are deep-seated in Your upbringing your values your culture the things that you've learned the family that you were born in this gentleman down here Could probably give this talk because you were actually talking about exactly this. We all live in our own little bubble We have a common Heritage with other people who have similar bubbles because they grew up in the same area with the same religion Went to the same schools had the same friends And yet once we travel we we bump into other bubbles and you know Is the person who I am perceiving is rude being rude or just behaving as they would normally behave and not understanding Why I'm getting upset So it's all kind of strange There are many aspects to go into culture There are seven of them that are that are commonly cited social organization religious attitudes language heritage and arts and culture economic systems forms of government etc but a colleague of mine Flavio Prococo Found this definition somewhere, which I thought was kind of nice It's the way is the culture is the way humans in a community actually get stuff done actually do stuff It's it's the explanation for how we behave and how we react So how do we get past cultural differences because there are there are many we agree they're messy We agree it's a problem in open-source communities. I assume And they're you know some of them are a little bit Practically difficult to address things like geographical and language differences, but there's the actual cultural Reactions how we deal with each other so I'm gonna by the way, there are a few bitly links in here and any of the if their books any of the links if you Want to follow them will Go to a smile.amazon.com which will support the software freedom conservancy with a few dollars if you choose to buy them Don't feel obliged. I'm just letting you know that so how do we get past cultural differences so Well, so everybody here has probably heard the expression tragedy to the comments How many people are aware of the original source and have read the original paper from Garrett Hardin? Okay, there's three or four, but that's that's good. So the idea of the tragedy of the commons is if there is a common good and Hardin wrote about this and in fact in the context of any Restricted entity but if what one of it one of the examples he chose which which kind of got picked up prominently was Population control which was a big issue in the 60s late 60s when he wrote this So when you have a common good and you have many people who are sharing it and those who are from Ireland and I see a few people who are at least living in Ireland common it just still very common in in Agricultural communities in Ireland where you have like hills right where it's a big area of space and you might put a very sparse number of Animals on there so many many families will share a part of the common edge And they will farm turf there or put animals on the land and it's a shared good shared by a number of people and Hardin's theory is that any time you have a Fixed good which is shared by people It is in everybody's Self-interest to behave in a way which is detrimental to the common good in other words detrimental to the group interest Because if you have for example a piece of land that can support a hundred cattle And there are ten families. That's ten cattle each right, but if I put an 11th cattle I am getting 10% more productivity for a cost to the common good of 1% One extra cow on top of a hundred so I'm degrading the common good a little bit and that Degradation is spread across ten families. So I'm actually it's in my self-interest to to take more than my fair share And so this is the problem that that Hardin presents and there are a number of obvious solutions Hardin is famously Libertarian and so his solution was well what you should do is not have the common good you should have everything be private property and Therefore everyone has control total control over their own ten percent of the common good And therefore they will they will curate and maintain it in a way which is which makes it long-term sustainable There are other solutions. In fact, this is one of the interesting papers that's appealed to both Libertarians and Communists for example or social Democrats in terms of a way that one should manage a common good One way is to elect a government or to elect a council of seniors who will Ensure that everybody respects the rules so you create an outside body with the respect of all which enforces a common set of rules one can use Religion or autocratic power to protect the common good So you have a religion which which reinforces the values and the lower And so maybe people behave in a certain way and they don't understand why they're behaving in that way But they know that this is the way things are done So what happens when these various solutions to this problem meet What happens so this is that a book Called moral tribes, which I'll reference later describes what's what he calls a tragedy of common-sense morality Where four people who have had this common space have have solved this problem in four different ways one is With that with an autocratic Government one is with the rule of religion and another is a council of elders that that curates the body and then you've got the Libertarian Private property overall Solution they meet when a fire destroys the land which had been a kind of a dense forest which had separated them for many years what happens well The people who value private property overall say well this is unclaimed property We're now going to go in and claim this land the people who are communists say well hold on a second This is the people's land We should share this is a common good and so they get into into trouble the religious Governed society takes offense when somebody from from the southern land is singing on Tuesday Something which is forbidden by the religion and and so on and so on and you have this series of conflicts because these cultures are Colliding and their values don't match So he calls this a tragedy of common-sense morality. This is the book I it's it's a lot of these sources are from behavioral psychology Which is a fascinating field it's about why people behave the way they do which is something that I've become increasingly interested in and Green talks a lot about the trolley problem I don't know if if you're aware of this It's if you are at a switch and you can see a train heading for one person on the tracks So you can and you can turn it or heading for five people on the tracks And you can turn it to hit one person should you should you hit the switch and the you know The logical answer is yes, you should do the thing which is the greater good But in fact whether you do it or not depends on how far and how empath empathetic you are to the one person that you Will kill it's very interesting. Anyway, he talks about the laws of common-sense morality in the natures of why we do things and So we come to culture So that at this another sociologist called Hertz Hofstede, I believe he's Dutch could be Belgian I believe he's Dutch described six dimensions of culture six kind of Core characteristics which can be used to define a six-dimensional vector which will describe how individuals organizations Approach culture. Can I get a time check off you? I haven't been keeping time. Oh I'm doing really well. I'm going. Am I going too fast? Good Which is that this was really the thing that I think kind of got me Thinking about this more deeply obviously not as deeply as mr. Hofstede, but He describes these characteristics which can apply and then you cannot you can extract characteristics of a society from its approach to religion social structure education parenting General values of a society along the seven axes that we saw earlier With these six dimensions of culture that he identifies so these are the six The first is the power distance index which was made Popularized by Malcolm Gladwell in the book outliers if any of you have read that I don't have a link for that. So so if you're gonna, you know Anyway, which is about how people react to hierarchy It and I'll go into each of these individually afterwards Masculine versus feminine which is not the same as male dominated versus female dominated It's about the val that the traits the character traits that are valued in the culture individualism versus collectivism uncertainty avoidance past versus future Or current focus and then indulgence versus self-constrained and so If you look at power distance Low power distance means a flat hierarchy a flat social hierarchy Lack of respect for elders. There's no kind of inherent respect for elders questioning of authority Student-centered education. This is something that was very surprising to me when I moved to the US Was that the teachers are very focused on each individual student? Growing as an individual rather than the class as a whole respecting a certain behavioral norms Doing homework forcing kids to do homework that kind of thing Which is I thought was quite interesting. It's there's very student-centered education in the US Teacher-centered a centered education would be what would I what I would have come from from France where where you expect the kids to conform to what the teacher tells them to do Even to the detriment of the individual being able to express themselves In the the subordinate relationship in work is one that's really interesting in In high in low power distance cultures subordinates expect to be consulted on decisions that affect them Whereas in higher power power distance Cultures subordinates expect to get very clear instruction so that they can execute on a clear plan You can imagine how this this Creates culture conflict when people from a higher high power Distance culture start to work in in Companies or or cultures that have a low power distance On one end it's like I don't understand I keep asking what what he would like us to do And he's not giving he's it's like okay, okay, okay, and then on the other end It's I don't understand this manager won't tell me what they want me to do I'm trying to do things in in kind of the in this framework, and I'm not getting clear direction So that's the kind of thing that that you see some examples of low power distance Israel actually quite famously There's an What's an anecdote by another social behavior is called Danny Kahneman? KAH N e m a n who also wrote a lot of stuff about how white people behave irrationally Where he says is the first time that he was teaching in Israel Students would shout out when he was when they disagreed with him and would get into back-and-forth discussions with the professor saying he's wrong you're wrong and and This is something that was completely foreign to him from before so very Very flat social structure in Israel compared to something like a Malaysia or China where there is a very strong respect for her Individual versus collectivism. I think probably a lot of this can be traced back historically This is one of the bigger ones that would be a difference between some European cultures and Asian cultures and and and North America. I think America being founded on lowering taxation creating independence from a from a foreign power Has a very very strong emphasis on the individual individual autonomy freedom the ability to To be left alone from government government interference on the one end and on the collectivist side The idea that we have a responsibility to I that that as a collective We we are responsible for each other's well-being and provide a safety net to the to the weakest in the culture And you can again see how these these societies Or these societal tendencies will will conflict Some of these are aligned by the way uncertainty avoidance On the one end we have cultures with Low uncertainty avoidance ready to take risk more venture capital Faster growth acceptance of failure on the high Uncertainty avoidance. We have a reluctance to take on debt We have a change as seen as a threat two ways of life There are a lot of rules and regulations which even if people don't respect them And that's often the case in countries like like Germany or France for example We're we're happy that there are the rules and regulations are there As a need for rules and structure and then there's a rejection of all structure on the other side Masculinity versus femininity One of the biggest things here is how do you make decisions? How do we arrive at consensus? Is it by ideas conflicting each other and confronting each other in argument? Or is it by working together and collaborating against a common enemy and a common problem that's identified? this is So there are actually very few countries that are very Very high on the feminine side low masculinity index Most of them are northern European socialist states take from that which what you will But there are also kind of southern European States are have a very high masculine index where there's there's like in France for example There is still a very male dominated culture and there's a rewards based culture It's a focus on the task over the individual. It's a focus on facts over feelings And these are the differences between masculine and feminine societies Focus on the long term versus the short term Long-term focus persistence savings investment in the future are things that are valued short-term focus the next quarter traditions focus on reproducing what's happened in the past nationalism and love of country is something that's very common in short-term focus countries It's interesting to see UK Germany and USA are the the three countries that score the lowest on the short-term focus given Recent political developments at least in the USA in the UK. I'm not gonna get into that. I I I promised I wasn't gonna talk politics, but but it's kind of tough to avoid it A colleague told me an anecdote where he was on a trade delegation to China and Learned from one of the people that they were meeting that the Chinese were investing in kindergarten and primary schools in in African countries It's like quite now. Why would you invest in primary schools in African countries? Surely it makes more sense to invest in research projects and Universities and it's like well first we need to get More people literate through primary school then in five years We want to invest more in secondary schools and in ten years. We'll start to invest in university So that in 15 and 20 years when we need the graduates will we will have a collection of graduates. This is long-term thinking The USA it's I want to invest in postdocs because I want something that's going to give me an immediate return for my investment so There's that and then this is the one that's so long-term short-term and indulgent versus restrained We're added after the original the four first which were the original four that have to identify it So this is the one that has the least data indulgent societies People are focused on the immediacy happiness restrained People focus not so much on their feelings or expressing their feelings Freedom of speech is less for responsibility. You see lower birth rates And higher security forces stricter sexual norms you can read as well as I can Okay, so there are other aspects I mentioned touch a few times haptic communication body language and other anecdotes There are people who you can walk backwards across a room by stepping in a Quarter of a step every couple of minutes. They will step back without even realizing they're doing it And you can just keep walking them back. This is a Particularly Americans have to have an idea of personal space, which is a little bit larger than others There are regions of the United States where People are more uncomfortable with silence So we talked about the moderator who speaks too much earlier In some groups it is considered polite to leave a pause of a half a second when somebody is finished So that you're sure that the other person is finished if you get somebody from Houston, Texas and there's a half a second pause they will feel uncomfortable physically uncomfortable and will feel obliged To stop you from being uncomfortable to to fill that space with speech So that's how you end up with one person keeping completely one side of the conversation While the other person is continually waiting for an opportunity to get a word in Just one example of the ways in which communication style can change from one area to another. Did you have a question? Can you vote for this is this true Okay, so this is all very interesting stuff we have our six dimensions of culture and we have some more components around The nature of touch and body language and personal space and Perfect. Thank you But how is this useful? What can we learn from this in open source? So one more book reference in this I'm assuming more people are aware who here has read this book getting to yes This is a must read book you did you must get this book. So this is About negotiation, but not negotiation in the Confrontational sense of the word. This is a book. It was the first book written from the Harvard negotiation project, which is Which is fabulous, which is fabulous and there are a bunch of so there's there's difficult conversations is another one It's a collection of sociologists politicians diplomats Business people who have gotten together to try and understand the nature of getting to Win-win negotiated deals And one of the things that that comes out of The Harvard project, I don't believe it's in this book, but this is definitely one that you should read is types of communication so When you speak to somebody else, there are four things that you can do to communicate with them one is you can ask a question inquiry Another is to repeat something that they said in your words to ensure that you have understood them correctly paraphrasal another is to acknowledge that you Understand where they are coming from Acknowledgement and then finally you can make a statement of your own affirmation. You're you're you're Just coming straight back with your opinion First up there is active listening. So the idea of active listening is that you You're empathically listening to the person that you have opposite you To to really try and understand what they're getting at I've listed that as part of communication Even though that is not one of the four ways that you would communicate with somebody else, but I think it's a vital Component most discussions in open-source communities are 90 per 90 percent or more affirmation We say what we believe the other person says what they believe and there is actually very little meeting in the middle There are a few reasons why that's problematic one Is what one that this gentleman mentioned as well actor observer bias or actor observers observer asymmetry This is a cognitive bias whereby everybody assumes that the other knows everything that they know and is also aware of everything that they don't know so Why would somebody suggest this when they know that? This other thing is true, and that makes their proposal completely unreasonable. This person is unreasonable if you Don't assume that the other person knows everything that you know and you say well have you considered this You can actually end up with better solutions combine that with another cognitive bias bias, which is The group communication bias perhaps or I can't remember the name of it Which is that when you get a group of people together They are more likely to talk about stuff that they already share in terms of knowledge Then sharing information that they have which is unique to the group You say the things that everybody already agrees on rather than rocking the boat by bringing new information to the table Combine that with actor observer bias, and you get very suboptimal Solutions, so you it's important that you question assumptions when you're coming to the table and using all of those ways of Communicating asking good questions listening actively to the answers Ensuring that you paraphrase those and say well hold on. I just want to make sure that we're sharing the same assumptions here Is and understanding creating a common frame of reference is vital to Good communication cross cultures. I'm sorry. There are no easy fixes here. I mean, I mean, which there were But this is vital to our three concrete tips One is a focus on the relationship the Chinese have a terrific word which I am going to pronounce wrong I I tried to learn the pronunciation for it for a Chinese audience, and I said it several times and They said I don't understand and and then I wrote it and they said I don't understand And I looked up on the interest internet the ideogram and they said ah guanxi and that's what I've been saying all along as far as I was concerned How often does this happen? So they have this wonderful word called guanxi which which Translates directly to relationship, but it means so much more than that It's one of the reasons why when Chinese companies are working with American companies The American companies are wondering why are these people dancing around the topics all the time? and why do they want to go to dinner all the time and The Chinese companies are frustrated because these Americans want to talk business without having a relationship on which they can construct a relationship of trust So focus on the relationship Everything you should do to integrate People from from minority cultures should be focused on how can we get a closer relationship with individuals in that community? and another Chinese saying from Deng Xiaoping I think I may be pronouncing no and Cross the river by feeling the stones He talked about this is how the Chinese economy would develop essentially we're going to do one thing We're going to see how it works out and then we're going to do another thing when we're sure we have a sure foothold Then we're going to go on to the next step cross the river by feeling the stones So small steps so how can we do that in terms of projects? So I didn't see Brian's talk earlier. I tried to get in Sorry But you grow relationships, so it's one conversation at a time I would say encouraging local user groups is a great move as long as they do not become isolated from the whole So that's why it's important if you're going to invest in Geographical diversity in your community encouraging those local groups allows a local Local support group it allows people who can talk to each other in their local language and share knowledge and share experience and come come at your community with the beginners I But it's also important that you build that bridge So there are two ways to do that one is to bring people from those local communities to your global events and treat them as VIPs Really introduce them bring them out to dinner or introduce them to the to the leaders of your community and start to create that those Relationships and also send your community leaders to those local user groups to speak Directly to the local communities and again build relationships within that within those groups mentorship is vital both inside the local groups Ensure that there are mentors if you have people in for example China who are already engaged in your community Ask them if they will help others to become more involved because they will help Navigate the roadblocks of your community in a culturally Coming from the frame of reference of the people that they're talking to So that's for projects for individuals across the river by Feeling the stones start small proposed small changes and listen to feedback try and learn the learn you know when in Rome try and learn what the norms and cultural Sensitivities of a community are I Think it's important to learn how to argue in a community to learn how to When you get feedback on a patch for example to learn The best way to manifest that you don't agree with this feedback or don't understand this feedback And again identifying potential mentors in your local community who can help you is a very important step and finally So I can leave a couple of minutes for questions. I guess Geography geography and language Unfortunately, we're not going to do anything anytime soon which is going to make India fewer than nine time zones from California So avoid real-time meetings for God's sake don't have your Chinese and your Indian Contributors attending meetings at 11 p.m. Or 1 a.m. It's just anti-social. It's anti-family. It's anti-everything And I know I mean even in work. This is this is a common occurrence where where I Have contributors who I'd like Stop Inviting me to meetings while you're at dinner. It's just inconvenient We can do it an hour earlier or an hour later and it's still okay for me And you know, but let's not have a meeting at all if we can avoid it. So avoid real-time meetings. It's vital Be aware of major holidays every if I had if I had a dollar for every time That I heard somebody in an open-source community say look we had to choose a date and we can't make everybody happy I Would have quite a few dollars but if you are moderately culturally aware and You are aware of the major like the one Cannot miss it. This is the vital major holiday like Christmas for for Christians in the year You would avoid Maybe one week in September because of rush Hashanah. You wouldn't avoid one week around now because of Chinese New Year you would avoid one week in In perhaps November for Diwali and and that would be it that date like it's only four or five weeks in the year and you've covered Hindu most Indian most sorry Asian religions most Christian religions and and Judaism, right? It's not that hard to to identify the four major holidays across four major world religions Language is always going to be an issue and it's one that's unfortunately impossible to fix Well, it's very difficult to fix, but you can make it easier by avoiding Real-time meetings IRC even is hard because typing in a foreign languages is hard and you get left behind in the conversation And also I think encouraging those local communities with keeping them connected the whole helps with both the geography and the language issues Sorry, I rushed through a little a little bit at the end. Do I have time for a question or two? Couple of questions anybody have questions contributions. I'm not an expert in this You're welcome Thank you Community Yeah communication is a very good way to attempt to issue the situation. And I agree. Yeah. And so people tend to advise to do face-to-face talk, even if it has to be a true video conferencing tool. And I was told to avoid as much as possible written communication, which is OK. It's exactly the opposite. So let me provide context. I think the weekly status meeting is a waste of time. If there's an issue, it needs to be addressed. So the question becomes how do you identify issues before they become serious enough? And I agree. Like face-to-face, getting teams together is probably the most valuable way that open source projects can spend their money. But be aware that if you're bringing 10 Chinese contributors to a global conference, which is 1,000 people, what you're going to find is that those 10 people stay together all week, and they're not going to build any relationships inside that community, is my personal experience. So that's why I suggest bringing smaller numbers if you're bringing them to a big conference, because it can be overwhelming. And also make sure that there's a support net there when they arrive. For work, I think it's very valuable to meet each other, and it's very valuable for people to talk one-on-one when there's a need. I don't think there should be, like, don't have weekly status meetings if you don't need one. Have meetings with an agenda. That's actually just free tip on top. Thank you. Last question, I think? Right. Well, Ramadan would actually, funny enough, be one of the things that I would not particularly avoid, but A'eed would be the end of Ramadan. Although on asking, be careful, because some of those cultural dimensions, one of the things in communication style doesn't want to put other people out. So there are cultures where you're much more comfortable expressing when somebody is explicitly asking where you're much more comfortable expressing discomfort or disagreement than other cultures. So it's something to be aware of. Yeah, but probably it's also what you were saying earlier about the building relationships with people, and understanding how it works, which is also about having the channel have all the talk to do stuff. I agree. I think I'm out of time. So I'm happy to continue this outside. Thank you very much.


Once your plans and documents are approved, you will receive an email with instructions on how to download your approved documentation through the customer portal. Links are included in the email to download your plans as well as any outstanding conditions within your documentation. Clicking the download link will direct you to the agency's customer portal to log in. After you log in, you'll be directed to the Approved tab. Here, you'll see your plans listed along with any approved supporting documents. Clicking the download icon will download the approved documents, including any approval conditions on the plans as a PDF file. Let's now take a moment to review a few key things about the approved plan set as a PDF document. You will find the agency's approval stamp on each page. The agency inspector might ask for a copy of the approved plan set during the inspection phase of your project. However, if you lose track of it, you can always come back to the Approved tab in the digital plan room to download it again. In the final approved plan set, document bookmarks and thumbnails are automatically created to make navigation easier, and thus concludes this video tutorial on downloading approved plans.


OK. Hello, everyone. I'm sorry if I sound a bit out of breath. We just did a talk six minutes ago and had to run from quite far away, so apologies.  My name is James Callahan. I'm a principal consultant at Control Plane, and I'm here with my esteemed colleague, Torrin. At Control Plane, we are a cloud-native security consultancy established in 2017. We are security specialists in Kubernetes, cloud and container security, but we do this for highly regulated organisations. We're over 50 people now across the UK, northern Europe and Australia, and we are still expanding. So what will we talk about today? First of all, we'll start off with a quick introduction to what threat modelling is and why it's a good idea to do it. We always think about our scope when we threat model, and it's important to say that this threat model report was first of all commissioned by Linux Foundation, and it's not an audit of the Argo CD project itself. It's not a red team engagement or anything like that. What it is is focused on end users and people deploying Argo CD in production. What are we building is the first of four fundamental threat modelling questions that we must ask, so Torrin later will give you an architecture overview of our sample multi-tenant implementation. Data, of course, is the thing that we care about protecting. It's the heart of threat modelling, so we need to understand our data and data dictionary so we can understand the impacts of a compromise of any of those data elements. How do we model it? We do this through data flow diagrams. This is where we start to catastrophise and ask the question what can go wrong and codify these catastrophisations in attack trees. Finally, we ask the question what are we going to do about it. This is where we devise our recommendations. These are the end user aspects of what you can do to harden our example infrastructure. Finally, just to note that threat modelling is iterative. We always have to ask ourselves, are we doing a good job? Is the threat environment changing? Are our assumptions sound and are our controls working? A threat modelling overview. Threat modelling is a systematic approach we can take to our IT systems where we codify what can go wrong and devise mitigations which end up reducing risk. Threats can lead to risks, risks can be quantified and we will always be left with some element of residual risk. It's the purpose of threat modelling to reduce these residual risks in line with something which will be acceptable in our risk management framework and is in line with our risk appetite as an organisation. It aids in finding and addressing security risks based on attack chains and attack trees which Torrin will show some good examples of later on and controls most importantly will be quantifiable. We can understand the impacts of implementing or not implementing certain controls and communicate this with assurance, compliance teams and ensure that we are within that risk appetite. Finally, most importantly, we can enhance developer retention because people don't spend lots of time re-implementing the same fixes and fixing things which are broken basically. So why threat model? Because we identify security flaws early on. We should threat model as early as possible but any time now is better than if you haven't started at the start, now is the best time. We can save time and money again. We don't consume complex redesigns and lots of new tickets to fix things which are broken. We identify data flows and complex risks which we might miss otherwise. And then finally, yes, we focus security requirements and enhance developer retention. The threat modelling process, we touched on it in the first slide but we follow a simple four step process kind of a spouse by Adam Shostack and co. The first question, what are we building, involves understanding our data, our use cases, our adversaries and our architecture. So artifacts that can help us here, our data flow diagrams, system architecture diagrams, information flow matrices, all of these things can be put on the table looking at the system from different viewpoints and often elucidate threats which might otherwise be missed. What can go wrong is the next step. This is where our little world is exploding. We are catastrophising. We are using threat intelligence sources as inspiration. We can use brainstorming techniques such as Stride to make sure we're not missing any threats and we can put all of this stuff together in attack trees to see how an attacker would get from some level of access or some credentials to actually doing something which matters and results in data being compromised. What will we do about it is the next question and this is where we devise our controls. Everything, as I said before, has to link back to a risk management strategy and we have to devise controls which mitigate our risks within the context of this strategy. Finally, did we do a good job? This is the iterative aspect. We can do things like map controls to attack trees to see if any branches are not covered. We can write automated tests which test not the implementation of a control but its actual genuine effectiveness in a representative system. Finally, we can revisit our threat model regularly if threat environment, threat landscape changes. There are many reasons why we might want to revisit our threat model. In terms of outputs, threats are the key. Threats can be codified in attack paths. Attack paths lead to attack trees and attack trees are the means for devising our controls. Finally, this is an example of an attack tree but we won't go through this one in detail. Torrin will go through a much more detailed example in a few slides time. All we will say here is that all the attack trees in this report use deciduous, a tool by Kelly Shortridge. We can do things like introduce controls so the blue security controls as indicated here break that can possibly break parts of the attack tree and make some paths non traversable. Attack trees really help with visualisation. We can annotate nodes to provide extra context. We can even quantify things with likelihoods, impacts and do things which would feed attack trees into an overarching risk assessment. With that, I would to Torrin for a bit of project background. Awesome, thank you very much James. To get started here, we need to understand what our scope is and what we're actually trying to threat model here. For our project, as mentioned by James, we're not doing a security audit or review of the Argo project itself. Instead we are focusing on end user security considerations for actually deploying and managing Argo CD. To do this, we have created a sample deployment architecture in multi-tenant mode set up between a operations cluster or ops and multiple, in our case, three tenant clusters that it is synchronising application state to. In scope for our project here is that architecture that I previously mentioned, as well as the Argo CD interactions with the cluster components that it works with directly and as well the Getty source control management for actually managing the source repose for each of the applications. Out of scope, we are not looking at a security assessment of peripheral case components as well as the developments and building of the actual applications that are being shipped by Argo CD. For our case, we are setting up the deployment architecture with demo apps, but we're not looking actually at the assessment of the applications that are shipped to themselves. On top of that, we're not performing a penetration test or any sort of offset analysis of the system, and we're not looking to provide a hardening guide towards specific data classifications, whether that's PCI, PII or HIPAA. So what is the project overall? For those interested, we have the demo architecture on our public repository, although right now it is in a state of becoming open source. So stay tuned for that in the coming days and week so you guys can actually set up that yourself. But what that architecture looks like is Argo CD deployed to a private EKS cluster with an ops cluster that hosts the Argo CD control plane and I'll kind of get into the architecture specifics in a moment, but then it's synchronizing to three different tenant clusters within that EKS cluster. So for those interested, feel free once that's open source to try it out and test your hand at deploying it, as well as even trying your hand at developing some attack trees and numerating some threats. So for our threat modeling exercise, our published report is on the Argo project GitHub repository right now, so feel free to check that out as well if you want to see the detailed run-through of not only what we performed as far as security analysts, but also the controls and mitigations that we have provided as recommendations for what we found. And for our findings here and the key threats and recommendations, we are going to demo some attack trees and show how they enumerate some of the threats and map them out in a specific exploit chain later in this presentation. And those are mapped primarily on critical, high, medium and low severities to provide a risk strategy for actually prioritizing and categorizing them. So a few key assumptions starting here. Tenants are strategically assigned app teams within the same org and currently for our deployment sake we have tenant zero, tenant one and tenant two to simulate the multi-tenant mode deployment of ArgoCD. And ArgoCD deployment itself is deployed using Terraform modules and ArgoCD is running its control plane on the ops cluster and is synchronizing state to the tenant clusters but is not actually installed on the tenant clusters themselves. It is maintaining a synchronization between the ops cluster and the Getty source control for those repos. For repository organization we have Getty server hosted on the ops cluster itself and we have one CD repository per application team with separate folder for the manifest stored within that repository itself. For the synchronization process we have autosync set up for each of the tenants and that is triggered based on commits to the main. So whenever commits are being pushed to the main repository of each of those app repos hosted on Getty then autosync will be triggered and then push downstream to each of our tenant clusters to update and to synchronize that state. So what are we building here? Let's look a little into the architecture that we're working with before we can actually understand the scope and to see how we threat models our system. So, as I mentioned previously we are deploying this on an AWS EKS cluster which is hosted in a virtual private cloud. As far as access is concerned and if you run through the demo itself you'll be able to SSH through a secure bastion host that actually allows you to issue commands from your local machine or that's through the API directly or through Qtl to interface with the clusters to see what's going on and to investigate. For the setup we have, as I mentioned we have three different tenant clusters with tenant cluster one, two and three which are being synchronized up to the ops cluster itself which holds not only ArgoCD control plane but also the Getty server for source control management where we actually are storing the application repositories themselves. So in multi-tenant mode and as many of you may be familiar with in deploying ArgoCD we have set it up between our three tenants and running the tenants as app project resources and the applications as the application resource in ArgoCD. So I provided a sample of the actual app project and the application resource manifests and you can see how we're actually setting the destinations here so in the app project itself the destination of the tenant zero cluster and all namespaces providing ArgoCD with cluster-wide access to synchronizing the state of those applications in our other clusters so in tenant two and tenant three those are actually being synchronized at... sorry, in tenant one and tenant two those are being synchronized on namespace level only and not cluster-wide. You can also see the selection of the resource repos that we're actually using in creating in Getty and when you run through the demo you can create these over the UI or create them through CLI commands whichever way you prefer and they are linked through the application itself defining which ones should be synchronized to each application. So an overview of what this looks like and many of you might be intimately familiar with the UI offered by ArgoCD but you'll see that we have our app one, two, three and four applications each of them healthy and synchronized to the app cluster itself and the ArgoCD control plane hosted within it and here you'll be able to update and configure the manifests and the configuration for the apps as well as the app projects itself to play around with the demo itself. After we understand the architecture overview we need to understand what our critical data assets are so what we are actually concerned with protecting and what a simulated attacker or a malicious threat actor might be interested in compromising so to do this we create what is called a data dictionary which is essentially acts as a blueprint of your critical data assets so to model your dictionary you need to answer a few questions so what data is crucial to your system functionality what data or secrets are used to secure your system this could in many cases by default is Kubernetes secrets or some sort of API token and then what data if misused could alter or disrupt the system itself all important questions in their own right that allow you to fine tune and focus on the actual critical data assets that are ported into your system in our case to ArgoCD and Getty synchronizing AppState so once you identify this you can then begin to categorize each of the identify assets in our case we use the RAG approach or the red amber green which associates red with high and then amber with medium and then green with low risk levels for our data assets this is not the only approach we took for this threat model exercise so I'll do kind of a quick run through this but for those interested there is a detailed run through on the Argo project end user threat model report that you can find that runs through each of these but these are some of the enumerated critical data assets for ArgoCD so for example the Kubernetes service count token for ArgoCD as well as the init admin password for actually setting up different users and configuring ArgoCD from startup we also enumerate local user credentials we will actually accessing and manipulating the applications and app projects within ArgoCD and then we assign them their RAG classification or their high, medium and low risk priority and we put that against the CIA tryout so the impact of confidentiality, integrity and availability of end user data is then mapped to our RAG approach which is put into our data dictionary and allows us to begin the threat modeling exercise and start moving into attack trees but before we actually touch into attack trees themselves we need to still kind of model how data procedurally moves through the system and to do this we create data flow diagrams and this acts or answers the next question of how you model your system and to begin you want to start with an architecture overview but once you understand the system you're actually creating and modeling then you need to understand how you're actually moving and flowing through it so to do this we've created two levels of increasing granularity of the system itself and you'll notice that the dotted green line that moves between the system itself is denoting the trust boundaries right so the namespace trust boundaries and as well as the cluster trust boundaries that needs to be transcended for data to move in and out of your system and interact with the different components as well as in our case to interact with the different applications so here we have our ArgoCD hosted in the ArgoCD namespace and Getty in the Getty namespace both within the operations cluster and to move out of the cluster itself we need to transcend first the namespace and then cluster trust boundaries to synchronize to each of the tenant clusters which we'll see in the next data flow diagram so level one gets a little bit more granular so it shows each of the components as well and how they are operating within ArgoCD and the tenant clusters so after transcending the operations cluster boundary then the auto sync will trigger into each of the tenant clusters in the case of tenant cluster one that is cluster wide so ArgoCD has access to the entire cluster and is able to synchronize across namespaces in our case with app one and app two namespaces tenant one tenant two and tenant three those are namespace scoped so it's two specific namespaces in our case for application three and application four is what ArgoCD actually has permission and is directed to synchronize so once we understand how data is moving in our system we understand our architecture overview we can get into the catastrophisation kind of as James had mentioned with creating attack trees so what can go wrong what is our doomsday scenarios what is a potential threat actor looking to exploit in our system so to begin I'm going to give one of our larger threat model attack trees for this specific use case which maps out five high priority threats in our case in different auto the box configuration as well as different threats we have enumerated from this threat modelling exercise and a key note before I kind of get into one of the specific attack chains here is the reality step you start at the left hand side here of the reality where the attacker is and typically you'll break this out into an external and internal attacker internal might look something like your infrastructure provider or your cluster operator or system administrator whereas external attacker is someone outward looking in on your system itself but there's a lot going on here so we're going to break this down into a specific attack chain and see how an external attacker might move through the system so from an external attacker's standpoint they are looking at an eventual takeover of a tenant cluster on our simulated infrastructure so to begin to do that they first need to enumerate some credentials and a critical asset to doing that is the argocd service account token to be able to maliciously configure or otherwise enumerate secrets within argocd's deployment itself so moving from the chain you can see that after the attacker first enumerates the cube config credentials they need somehow to access the secure bastion host that might look like socially engineering a developer to get their credentials to SSH into the system itself or some sort of phishing effort and once they do that they then can access the network itself and can begin to issue malicious commands on your tenant clusters so at this stage the attacker has cluster admin permissions so after lifting the cube config credentials and being able to steal the SSH credentials of in this case the app developer they then can move further and transcend your trust boundaries in your system and now are operating on your ops cluster and from here they will look to maliciously configure your downstream tenants and try in our case to deploy a malicious deployment to those tenant clusters so once the service account token is compromised and there is a list of information about the argocd deployment can be enumerated this looks like something like the init password which is not deleted by default but is suggested so by the project as well as other secrets and tokens stored on your clusters so from here the attackers now have cluster wide access so then they can move from your ops cluster into your downstream tenant clusters and begin to attempt a malicious deployment into your tenant clusters in this case the end goal for the attacker is a full cluster takeover which is possible through the steps that we have outlined and ran through here after reading the cluster wide secrets enumerated on the ops cluster then they can move and transcend to the tenant cluster itself so this is a larger example of a mapping of a few of our high-party threats but I'm going to look after this into a more granular focus on one of our other attack trees so this attack tree looks at the tenant cluster takeover due to the unrestricted default project of ArgoCD so starting out you have your reality and from reality the attacker can then begin to enumerate some of the initial passwords and specifically the initial admin password of ArgoCD to maliciously configure ArgoCD and as you were running a little bit or low on minutes so I will glance over this one and then we'll look at some of the security threats and recommendations that we have enumerated off of this so what can we do about it so what are our controls what are our mitigations that come from this threat modelling exercise so some security threats and considerations follow a few key questions here so who can access or who can ArgoCD access in this case looking at giving ArgoCD namespace specific or namespace scope access as opposed to cluster wide access and limiting the permission of service account tokens in ArgoCD's deployment itself as well as using workload identity this could look something like Spiffy Inspire and there's a lot of other implementations as well to connect to the tenant clusters themselves securely and on the second question who can actually access ArgoCD so this kind of gets into our multi-tenant deployment as well as disabling some of the out-of-box configurations specifically the local admin user that's actually created with admin level access to ArgoCD to create other users and modify your app project and application resources to protect the credentials themselves using an external key management service and then using SSO to enforce MFA if it is applicable and is not overkill in your use case as well as limiting user account base on RBAC this can be done natively through Kubernetes as well in our demo deployment and then finally how does ArgoCD actually manage applications so in our case app projects and application sets the first recommendation here is actually deleting the default ArgoCD project as it has a lot of insecure out-of-box configurations that are very useful for setting up but should be deleted and at least controlled if it is not deleted to begin with as well as limiting the repos and clusters that app projects can manage to limit the blast radius of an attack if it were to be realized and finally admins of whether that's an application admin or a system administrator themselves should be the only ones to actually manage your application sets this kind of gets into the principle of least privilege here at the end so there's a few high priority findings given we're kind of short on time here I won't run through each one of them the ArgoCD and user threat model reports on the Argo project repository and it will go through each one of these and kind of give you some recommendation strategies on them so to the last question on how can we improve and we need to first kind of understand did we do a good job to iteratively approve right so through the exercise that we performed on ArgoCD we numerator 19 threats six of them being high priority based on the stride approach and provided recommendations and mitigation strategies for each of them and key to note here is the actual mapping of the high priority threats on our two attack trees and implementing controls to break those attack chains so a quick thank you to Linux foundation and the Intuit team for helping us with this and thank you everyone for listening in