My first post on the new blog is going to be more of a philosophical rant than a technical entry, but hopefully still enjoyable. I've been having interesting conversations with Ed Skoudis, Peter Silberman and tons of other people informally about these topics for some time, and decided to share some of my thoughts for whatever its worth.

First; security conferences. Originally they were places to meet up with friends you don't see often, exchange ideas, and learn about new things. Increasingly they have become advertising venues for your product, company, or researcher brand name. Now that's not all bad, it helps people move forward, get opportunities and advance the industry but we should try to remember our roots and not lose that sense of discovery and pursuit.

An aspect of this that I think we are all guilty of is: "I've got this great new idea / tool / 0day and it blows your socks off, but I'm not going to tell you about it unless you come to the con." Somewhat necessary to promote talks but starting to get out of hand, and often the talk doesn't really provide what the advertising offered.

Next is the fact that the security industry has the same problem the music industry has, which is, if something "works" i.e. gains a lot of press and general interest, they try to milk it with 100 variants following the same formula for some period of time. (Boy bands, britney spears types, emo, hypervisors, rootkits, cloud).

Another issue is that a lot of talks are ones the speakers would like to see, which generally trend toward the more theoretical and academic. While there is definitely a place for this, what I hear over and over from general audience members is that they come to cons hoping for something they can take home with them and use. An hour lecture on operating system design, virtual memory management or the latest tricks on upcoming architectures aren't much help when the enterprise back at home is still running XP SP2 and they just want a baseline security audit or some way to help from getting owned by today's threats.

Now I've been involved in talks like these which usually gain interest from other speakers but I've also given practical tool and technique driven talks which usually get 10x the appreciation from audience members. (validated by feedback numbers) I have become a big fan of talking about actual hacking at hacking cons rather than just computer science.

For penetration testers (big consumers of conferences btw) the unfortunate situation has arisen (or maybe always been there) that companies have a vested interest in buying a poor pen test. Many companies have not yet developed the ability to identify, document or even discuss the real risks to their business and are barely holding on by figuring out whatever regulations they need to follow and checking off the boxes. They need to pass. Shinking budgets mean they need it cheap. This means that pen testers are selling something with little real world, but lots of bureaucratic, value.

Therefore being the best pentesters, using the latest tools and techniques can actually have a negative effect rather on your ability to gain customers, rather than a positive effect. I haven't come up with a lot of creative ways to fix this, but one idea was to couple incident response with pen testing somehow. If the in-brief, or pre-roe includes real world examples of how places got hacked, and the actual effect on business perhaps it would be easier to sell some of those less "conventional" but more realistic techniques. I think pen testers need to do a better job at both describing the real threats as well as expending beyond the scan/exploit numbers game into physical, SE, and monitoring what the bad guys are actually doing.

This leads finally into incident response. There are two kinds of organizations out there in my experience (I encourage other examples!). One that wants to know exactly what the bad guys did, what they were after, capabilities, techniques and tools. The more data about what happened the better. The other type is one that doesn't care what happened, just want's the attacker gone and their infrastructure back up. I'm finding its very important to figure out which one of these two you are dealing with going into a situation because the response is completely different. This is probably old hat to IR people but I'm used to dealing with organizations that want to know what happened.

So lets see, compare infosec to pop music? check. Dis the academic community? check. Tell pen testers their work is for naught? check. Now that I've alienated just about everyone in the infosec industry, I think this is a good place to wrap up the post :). Hey at least I didn't discuss vuln disclosure.

Thanks for reading,

V.