{"id":144091624,"date":"2023-02-21T15:50:00","date_gmt":"2023-02-21T15:50:00","guid":{"rendered":"https:\/\/danconn.dev\/blog\/2023\/02\/21\/openuk-state-of-open-con-23-talk-modelling-threats-in-the-open-source\/"},"modified":"2024-07-28T11:34:02","modified_gmt":"2024-07-28T11:34:02","slug":"openuk-state-of-open-con-23-talk-modelling-threats-in-the-open-source","status":"publish","type":"post","link":"https:\/\/danconn.dev\/blog\/2023\/02\/21\/openuk-state-of-open-con-23-talk-modelling-threats-in-the-open-source\/","title":{"rendered":"OpenUK State of Open Con 23 Talk &#8211; Modelling Threats in The Open (Source)"},"content":{"rendered":"<h2 class=\"wp-block-heading\">I get to do my 2nd in person talk and a very nervous me realised it&#8217;s a much larger and more serious stage (gulp)!<\/h2><p>Wow! If you\u2019d have said even 6 months ago that my next talk would be talking at OpenUK\u2019s State of Open Con alongside Camille Stewart Gloster (Deputy National Cyber Director, Technology &amp; Ecosystem Security at The White House), Chi Onwurah (Labour MP for Newcastle upon Tyne Central &amp; Shadow Minister Science, Research &amp; Technology), Damani Corbin (Strategy &amp; EcoSystem Growth at Boeing) and Jimmy Wales (yes THE JIMMY WALES FROM WIKIPEDIA!!), well I\u2019d have thought you were bonkers &#8211; yet here we are!<\/p><p>I\u2019ll be honest, this talk was incredibly nerve wracking for me. Firstly, the venue. Very serious and very huge! I don\u2019t think my initial puns went down well and I realised that perhaps I should have been wearing something much smarter than a t-shirt. This was the stage and half of the room and it was incredibly daunting when the tables were filled!<\/p><figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/danconn.dev\/blog\/wp-content\/uploads\/2024\/07\/0ab6a225-312b-4e45-bffe-6044a1c8b8b8_1440x785.jpeg\" alt=\"\"\/><\/figure><p>Secondly, Andrew Martin and my friend, Sal Kimmich, were the hosts for the security track and I\u2019m great admirers of their work. In a separate body of work to the one I explain in my talk, Andrew\u2019s company, Control Plane, had also threat modelled Argo CD (in a much more comprehensive manner than I did) so I was rather nervous to see what he thought about it!<\/p><p>Thirdly I say \u201cya know\u201d a lot! I joked later that I suffered a \u201cyaknow-mageddon\u201d!<br\/><br\/>That being said I did thoroughly enjoy it and I really loved the conference as a whole! I have loved the idea of OpenUK and what they do, and seeing this conference in action was fantastic!<\/p><h2 class=\"wp-block-heading\">Yaknowmaggedon Time!<\/h2><p>The aim of the talk was to introduce threat modelling at a high level. OpenUK is full of people from various pillars of the open source world such as open software, open hardware and open data, and I aimed for this talk on a cybersecurity concept to be as inclusive to all as it could be. <br\/><br\/>I do joke about the overuse of \u201cya know\u201d but to be honest, it went OK and people were very kind afterwards and interested in threat modelling and the collaborative process we had going with Michael Crenshaw, Zach Aller, and Sal Kimmich on teh Argo CD project. <br\/><br\/>By the way if you do want to see any of the docs produced and a glimpse into what can be done with the awesome Threagile, then you can<a href=\"https:\/\/github.com\/danjconn\/argo-threagile\"> find my GitHub fork of Michael\u2019s repo here!<\/a><br\/><br\/>Also here is the talk if you just want to watch that. As usual, below are my thoughts around the talk and concepts to pull from it:<\/p><figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Modelling Threats Out In The Open (Source) | Dan Conn | SOOCon23 Security\" width=\"500\" height=\"281\" data-cookieconsent=\"preferences, statistics, marketing\" data-src=\"https:\/\/www.youtube.com\/embed\/bqNSb32trEI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><div class=\"cookieconsent-optout-preferences cookieconsent-optout-statistics cookieconsent-optout-marketing\"><\/div>\n<\/div><\/figure><p>The talk covered the basics of what Threat Modelling was, and well known different types of threat modelling such as MITRE ATT&amp;CK, DREAD, PASTA, LINDUN, and STRIDE. <\/p><p>I then explained the different types of questions we should ask to uncover threats and how tools such as <a href=\"https:\/\/threagile.io\/\">Threagile <\/a>can help to model data flow diagrams and RAA (Relative Attacker Attractiveness) scores. For threat models in open source, using something like Threagile which allows data flow diagrams to be generated from YAML is hugely beneficial. There are simply not enough open source volunteers as it is, let alone ones capable of helping to facilitate threat modelling sessions. Perhaps tools like <a href=\"https:\/\/threagile.io\/\">Threagile <\/a><a href=\"https:\/\/owasp.org\/www-project-pytm\/\">OWASP PyTM<\/a>, or <a href=\"https:\/\/owasp.org\/www-project-threat-dragon\/\">OWASP Threat Dragon <\/a>can help open source developers improve security through templating some base architectural configurations and allowing open source teams to add to these models using YAML or Python. These in turn called be stored in a \u201c.security\u201d folder in the codebase along with other security concerns. This can then be used to evaluate how security is thought about in the project. By making them a folder and editable, this makes security a living breathing process, using living documents rather than capturing a snapshot in time too. <br\/><br\/>Interestingly I also was chatting to both Andrew and Sal who have been thinking of this templating idea for some time already so they may produce something before I even get started!<\/p><p>Whilst at OpenUK State Of Open Con, I also got chatting to the people at EM360 so this video is below too!<\/p><figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"&quot;The future of open source will be collaborative&quot; Dan Conn, Sonatype @ State Of Open Con 2023\" width=\"500\" height=\"281\" data-cookieconsent=\"preferences, statistics, marketing\" data-src=\"https:\/\/www.youtube.com\/embed\/dMqb6PbPxuA?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><div class=\"cookieconsent-optout-preferences cookieconsent-optout-statistics cookieconsent-optout-marketing\"><\/div>\n<\/div><\/figure>","protected":false},"excerpt":{"rendered":"<p>I get to do my 2nd in person talk and a very nervous me realised it&#8217;s a much larger and more serious stage (gulp)!<\/p>\n","protected":false},"author":2,"featured_media":147072127,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55],"tags":[12,97,50,49,51,20,96,81,82],"class_list":["post-144091624","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-talks","tag-application-security","tag-argo-cd","tag-open-source","tag-openuk","tag-oss","tag-public-speaking","tag-talks","tag-threagile","tag-threat-modelling"],"_links":{"self":[{"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/posts\/144091624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/comments?post=144091624"}],"version-history":[{"count":2,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/posts\/144091624\/revisions"}],"predecessor-version":[{"id":147072271,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/posts\/144091624\/revisions\/147072271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/media\/147072127"}],"wp:attachment":[{"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/media?parent=144091624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/categories?post=144091624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/danconn.dev\/blog\/wp-json\/wp\/v2\/tags?post=144091624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}