What Permaculture Design Taught Me About Security

What Permaculture Design Taught Me About Security

Speakers: Laura Wratten, Application Security Engineer, Canva

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=JNjKhxQLCV0

Overview

In a refreshing departure from typical technical security talks, Laura Wratten, an Application Security Engineer at Canva, presented a unique perspective on security design, drawing parallels from the principles of permaculture. Titled "What Permaculture Design Taught Me About Security," Wratten's presentation at Kawaiicon explored how a holistic, systems-thinking approach, traditionally applied to sustainable living and gardening, can profoundly influence and improve application security practices. The talk aimed to equip attendees with a new "thinking tool" or lens through which to approach complex problems, whether in their professional security roles or personal projects.

Wratten introduces permaculture not merely as a gardening technique but as a robust design framework developed for building sustainable, resilient, and maintainable systems that effectively meet human needs. She articulates how its core ethics—Earth Care, People Care, and Fair Share—and its twelve design principles offer powerful insights applicable to the intricate challenges of modern security engineering. By illustrating these concepts first with personal anecdotes from designing her own chicken coop, then translating them directly to a complex Single Sign-On (SSO) implementation project at Canva, Wratten demonstrates that fundamental principles of observation, integration, and iterative development are universally valuable.

The central thesis is that adopting permaculture's mindful, long-term perspective can lead to more cohesive, easier-to-maintain, and ultimately more secure systems. This talk is particularly relevant for security professionals grappling with the ever-increasing complexity of software development, offering a human-centric and sustainable approach to security that prioritizes collaboration, simplicity, and a deep understanding of the environment in which systems operate. It's a call to move beyond reactive security measures towards proactive, integrated design.

Background

▶ Watch: Introduction: What permaculture is and its relevance (0:00)

Permaculture, a portmanteau of "permanent agriculture" and "permanent culture," was conceived in the 1970s in Tasmania by Bill Mollison and David Holmgren. It emerged as a response to destructive industrial agriculture practices, advocating for the design of human settlements and agricultural systems that mimic the resilience and sustainability of natural ecosystems. While often associated with organic gardening and eco-friendly homes, Wratten emphasizes that permaculture is fundamentally a design framework—a "toolbox of patterns and principles for building systems that meet people's needs while being cohesive, easy to maintain, and sustainable." Its foundation lies in observing natural systems and draws deeply from indigenous knowledges globally.

Crucially, Wratten posits that permaculture's applicability extends far beyond the garden fence, encompassing any system that involves people. This makes it inherently relevant to the field of security. Security, at its core, exists to protect people's data, their creative output, and the essential systems they rely on daily. People are not just beneficiaries of security; they are also intrinsic to its challenges, "clicking links, reusing passwords, and finding wonderfully inventive ways to break our best-laid controls." Without understanding and engaging with the human element, security efforts are incomplete.

Wratten highlights three core permaculture ethics that underpin all design decisions:

• Earth Care: The principle of looking after the planet that sustains us.
• People Care: Focused on doing the least harm possible to others. In security, this directly translates to the ultimate goal of reducing harm to users and organizations.
• Fair Share: About passing on surplus, sharing skills and knowledge to enable more communities to thrive, and defining what "enough" is within finite resources. Wratten connects this to effective security communication—making security accessible, useful, and empowering rather than confusing or scary.

Building on these ethics, David Holmgren developed 12 design principles. For the purpose of this talk, Wratten focuses on three key principles that she found particularly resonant in her security work:

1. Observe and Interact: Emphasizes using all senses to assess a system thoroughly before taking action. It's about understanding patterns, flows, and dynamics to design better, more integrated solutions. Wratten likens this to the scientific method, where understanding the system allows for targeted changes and observation of their effects.
2. Integrate Rather Than Segregate: This principle focuses on the relationships between elements within a system. By strategically placing elements, they can support each other, creating a stronger, more self-sustaining whole than if they operated in isolation. It embodies the idea that "the whole is greater than the sum of its parts."
3. Use Small and Slow Solutions: Promotes the idea that smaller, incremental solutions are often easier to maintain, less resource-intensive to set up, and more sustainable in the long run. Wratten draws a parallel to building a Minimum Viable Product (MVP) and finding elegantly simple solutions to complex problems.

These principles, initially explored through the practical example of designing a chicken coop for her new home, form the conceptual backbone for understanding Wratten's approach to application security.

Key Findings

▶ Watch: First principle: Observe and Interact (chicken coop example) (5:49)

The central finding of Laura Wratten's talk is that the timeless, ecological principles of permaculture offer a powerful, yet often overlooked, framework for enhancing application security design and practice. By consciously applying permaculture's core ethics and specific design principles, security engineers can move beyond reactive, siloed approaches to create more robust, integrated, and sustainable security outcomes.

Wratten demonstrates this by showing how three specific permaculture principles directly translated into tangible benefits during a complex security project at Canva:

• Observe and Interact fostered a deeper understanding of the existing system and constraints, leading to more context-aware and effective security recommendations. This initial period of "doing nothing" but observing, as she did with her garden, allowed for informed decisions rather than premature interventions.
• Integrate Rather Than Segregate facilitated close collaboration and partnership with engineering teams, embedding security into the design process from the outset. This approach built shared understanding and trust, resulting in a significantly more secure final product than traditional point-in-time security reviews might achieve.
• Use Small and Slow Solutions encouraged the team to seek out simpler, more elegant security mitigations that were easier to implement, test, and maintain, even when faced with initially complex proposals. This principle helped avoid over-engineering and focused on delivering tangible security benefits efficiently.

Ultimately, Wratten's key finding is that adopting a permaculture mindset in security not only leads to stronger technical designs but also cultivates stronger working relationships between security and development teams. It promotes a holistic, systems-thinking approach where security is seen not as an add-on or a bottleneck, but as an intrinsic, integrated, and continuously evolving aspect of system design, much like a thriving ecosystem.

Technical Deep Dive

▶ Watch: Applying permaculture principles to security (SSO project) (9:40)

Wratten's technical deep dive focuses on the application of permaculture principles to a real-world application security challenge: designing and implementing Single Sign-On (SSO) for Canva websites. Canva offers a document type that allows users to design and publish websites directly from the Canva editor. The goal of the SSO project was to enable users to configure their published websites with a preferred identity provider, redirecting visitors to their SSO page for authentication before granting access. As Wratten wryly notes, this involved SAML (Security Assertion Markup Language), a notoriously complex protocol often associated with "crying over specifications."

Let's explore how the three chosen permaculture principles informed the security approach for this critical project:

Observe and Interact in SSO Design

In the context of the Canva SSO project, the "Observe and Interact" principle was paramount. When Wratten joined the project, the engineering team already had a proposed architecture and initial security feedback. Instead of immediately dissecting the design for flaws, Wratten adopted a permaculture-inspired approach:

• Understanding Current State: She began by thoroughly understanding the team's existing plans, the trade-offs they had already considered, and the specific constraints they were operating under. This involved asking questions like, "How did they plan for it to work? What trade-offs had they made? And what constraints were they dealing with?"
• Contextualizing Risks: By gaining this foundational understanding, Wratten could then articulate security concerns and risks within the specific context of the team's goals. This allowed her to propose mitigations that were not generic, but tailored to fit within their technical and operational constraints. This approach contrasts sharply with merely identifying vulnerabilities without understanding the system's broader context, which can lead to friction and impractical recommendations.
• Building Relationships: This initial observational phase also significantly improved her working relationship with the engineers. By demonstrating a willingness to understand their perspective first, Wratten fostered trust and collaboration.

Wratten extends this principle to other security processes, notably design reviews and threat modeling. In these scenarios, a deep understanding of the "lay of the land" – the system's architecture, data flows, trust boundaries, and business logic – is essential before diving into potential concerns or suggesting changes. Even in urgent, "on-fire" situations, she argues that "Observe and Interact" still applies, albeit with a much shorter feedback loop, emphasizing the need for rapid, informed assessment before action.

Integrate Rather Than Segregate in SSO Implementation

The SSO design was inherently complex and carried significant security risk, necessitating a deeply integrated approach. The "Integrate Rather Than Segregate" principle guided Wratten to embed herself closely with the engineering team throughout the entire design and implementation lifecycle, moving beyond a traditional point-in-time security review:

• Security Partnerships: This embodies the concept of security partnerships, where security engineers work directly with or embed within specific development teams. This proactive engagement allows security to shape and guide design and implementation from the earliest stages, rather than operating from the "sidelines."
• Early Engagement: Wratten was involved early in the design phase, collaborating directly with the team to architect a more favorable and secure solution. This included co-authoring the design document, ensuring security considerations were baked into the foundational blueprint of the system.
• Continuous Consultation: Throughout the implementation phase, she acted as a continuous consultant, providing ongoing guidance and feedback. This iterative involvement meant that security concerns could be addressed as they arose, preventing them from becoming larger, more costly issues later.
• Comprehensive Review: The process culminated in a thorough code review and penetration test of the built solution. This comprehensive engagement, from concept to deployment, ensured that security was not an afterthought but an integral part of every stage.

This level of collaboration, while not feasible for all projects, was critical for the SSO feature. It fostered shared understanding, built strong trust between security and development, and ultimately led to a more robust and secure outcome, demonstrating the power of breaking down organizational silos.

Use Small and Slow Solutions in SSO Mitigations

The principle of "Use Small and Slow Solutions" proved instrumental in refining the security mitigations for the SSO project. Initially, Wratten identified unmitigated security issues in the original design. The engineering team, highly receptive to security, reworked their design to address these. However, the revised solution, while mitigating some risks, was "super complicated and honestly didn't yield massive security gains for all the effort and complexity."

• Avoiding Over-Engineering: This scenario highlighted the risk of over-engineering security, where complex solutions consume significant resources without proportional security benefits. Wratten recognized this complexity as a potential source of future vulnerabilities and maintenance overhead.
• Seeking Simplicity: Drawing inspiration from the elegantly simple, low-tech chicken feeder example, Wratten engaged with the team to research and discuss simpler, alternative options. The goal was to find solutions that offered "more tangible security benefits" without introducing undue complexity.
• Optimized Design: The final design for the SSO security mitigations was "cleaner, simpler for the team to implement and much easier to test and review from a security perspective." This outcome directly reflects the permaculture principle: prioritizing solutions that are sustainable, maintainable, and efficient, rather than complex and resource-intensive. It aligns with the concept of building an MVP for security features, focusing on core protections delivered effectively.

By applying these permaculture principles, Wratten and the Canva team not only built a more secure SSO system but also cultivated a more effective and collaborative security engineering process. The technical deep dive reveals that "systems thinking" from permaculture can directly inform practical decisions in complex application security projects, leading to better outcomes for both the technology and the people building it.

Demo / Proof of Concept

▶ Watch: Small, slow solutions: Simplified, sustainable security design (13:08)

This talk was primarily conceptual and illustrative, using analogies rather than demonstrating a technical security exploit or tool. Laura Wratten's "demo" was her personal journey of applying permaculture principles to build a chicken coop in her garden, which then served as a metaphorical and practical foundation for explaining their application to application security. There was no live technical demonstration or proof of concept in the traditional security conference sense.

Defensive Implications

▶ Watch: Conclusion: Systems thinking and the 'get goats' request (14:30)

The application of permaculture principles to security design offers profound implications for defensive strategies, shifting the focus from reactive patching to proactive, integrated, and sustainable security engineering. Defenders can leverage these insights to build more resilient systems and foster more effective security cultures.

1. Prioritize Deep Observational Understanding:

• Design Reviews and Threat Modeling: Security teams should dedicate significant time to truly "observe and interact" with system designs before making recommendations. This means understanding the business context, technical architecture, data flows, existing controls, and operational constraints. Effective threat modeling and security architecture reviews should start with comprehensive listening and understanding, rather than immediate critique.
• Incident Response Post-Mortems: After an incident, thorough post-mortems should go beyond identifying immediate causes to observe the broader system, its interactions, and underlying cultural or process issues, akin to understanding the "patterns, flows, and dynamics" of an ecosystem.
• Contextualized Risk Assessment: Risks should be assessed and communicated within the specific context of the development team's goals and limitations, leading to more practical and adoptable mitigations.

1. Foster Integration and Security Partnerships:

• Embedded Security Engineers: The "integrate rather than segregate" principle strongly advocates for embedding security engineers within development teams or establishing dedicated security partnerships. This moves security away from being a gatekeeper function to a collaborative enabler.
• Early Engagement: Security involvement should begin at the earliest stages of design and architecture, allowing security considerations to be "baked in" rather than "bolted on." This includes co-authoring design documents, participating in architectural discussions, and continuous consultation.
• Shared Ownership: By integrating closely, security and development teams build shared understanding and trust, fostering a sense of collective ownership over security outcomes. This reduces friction and improves the quality of security implementations, as demonstrated by the Canva SSO project's successful code review and penetration test phases that were built on continuous collaboration.

1. Embrace Small, Simple, and Sustainable Solutions:

• Avoid Over-Engineering: Defenders should critically evaluate proposed security solutions for unnecessary complexity. Complex solutions are often harder to implement correctly, test thoroughly, and maintain over time, potentially introducing new vulnerabilities.
• Minimum Viable Security (MVS): Similar to Minimum Viable Product (MVP), security teams should strive for Minimum Viable Security solutions that provide significant protection with the least amount of complexity and resource overhead. This means focusing on the most impactful controls first and iterating.
• Elegant Simplicity: Encourage finding elegant, simple solutions to complex security problems. This might involve leveraging existing platform capabilities, well-understood patterns, or straightforward configurations over custom, intricate security logic.
• Iterative Improvement: Security should be viewed as an iterative process, much like a garden evolving over time. Small, slow, continuous improvements are often more sustainable and effective than large, disruptive overhauls.

1. Uphold People Care and Fair Share:

• Reduce Harm: Defensive strategies should always prioritize reducing harm to users and the business, aligning with the "People Care" ethic. This means focusing on user-centric security design and incident response that minimizes negative impact.
• Accessible Communication: Security communication should be clear, accessible, and empowering, avoiding jargon or fear-mongering. "Fair Share" applies to sharing security knowledge and best practices in a way that enables all stakeholders, from developers to end-users, to make informed decisions and contribute to security.

By adopting these permaculture-inspired defensive implications, organizations can build security programs that are not only technically sound but also deeply integrated into their culture, fostering resilience, efficiency, and continuous improvement.

Key Takeaways

• Permaculture as a Design Framework: Permaculture is a powerful, holistic design framework, not just for gardening, but for building any sustainable, resilient system involving people, including software and security.
• Core Ethics Guide Security: The permaculture ethics of Earth Care, People Care, and Fair Share offer a moral compass for security, emphasizing harm reduction, accessible knowledge sharing, and responsible resource use.
• Observe Before Acting: The "Observe and Interact" principle is crucial in security, advocating for deep understanding of systems, contexts, and constraints through practices like design reviews and threat modeling before implementing solutions.
• Integrate Security, Don't Segregate It: Close collaboration and "security partnerships" with development teams, embedding security throughout the entire lifecycle (from design to code review and penetration testing), lead to stronger, more trusted, and more secure outcomes.
• Favor Small, Simple, and Sustainable Solutions: Avoid over-engineering security. Prioritize "small and slow solutions" that are easier to implement, test, and maintain, focusing on Minimum Viable Security (MVS) for tangible benefits over unnecessary complexity.
• Systems Thinking for Better Security: Applying a permaculture mindset fosters systems thinking, leading to more cohesive security designs, improved team relationships, and ultimately, more robust and sustainable security postures.

About the Speaker(s)

Laura Wratten is an Application Security Engineer at Canva, a global visual communications platform. Her professional focus lies in securing the applications and systems that enable millions of users to create and communicate. Wratten's talk at Kawaiicon highlights her unique perspective, demonstrating how her personal passion for permaculture and sustainable living has provided her with invaluable insights and a distinct lens through which to approach complex security challenges in her professional role. She effectively bridges seemingly disparate fields, showcasing a deep understanding of both ecological design principles and the intricacies of modern application security.