My Final Impressions of Black Hat 2014

I attended Black Hat 2014 in Las Vegas last week and wanted to write a post while I’m still feeling the buzz of the event. Here are just a few of my takeaways:

1. Black Hat = High Energy.  I attended Interop at the same venue (Mandalay Bay) for many years but I noticed that the event was getting stale and rather morose recently.  It was quite invigorating then to witness the high-energy security crowd at Black Hat in comparison.  There was lots of energy, great discourse, and plenty of knowledge transfer.  Yes, there was commercialism and Vegas schmaltz, but Black Hat is more of a community get together than your typical stale trade show – and way more lively than Interop post the late 1990s.
2. Black Hat vs. RSA.  When I worked at EMC back in the late 1980s, one of the common sales mantras of the company was, “people who know how always work for people who know why.”  This was a “solution selling” message intended to get the sales team to focus on the “why” customers who own business processes, financial results, and budgets, rather than the “how” customers who twiddle bits and bytes.  With this analogy in mind, RSA is a “why” conference while Black Hat (and to some extent, (DEFCON) is a “how” conference.  With this explained, there is also a difference as cybersecurity is a hardcore “how” discipline that revolves around the folks who know how to twiddle bits and bytes or can detect when someone else has twiddled bits and bytes in a malicious way.  In my humble opinion, these two shows complement each other.  Yes, we need extremely competent CISOs who know business, IT, and security technology but we must also have security practitioners with deep technical skills, devotion, and passion.  RSA is focused on the former while Black Hat/DEFCON appeals to the latter. 
3. Security vendors should be at Black Hat.  Many leading security vendors passed on Black Hat and allocated event budget dollars to RSA and shows like VMware instead.  I get this but would suggest that they find ways to spread event investments around so they can attend Black Hat 2015.  Why?  Black Hat attendees may not be budget holders but they are the actual people who influence technology decisions and make up the majority of the cybersecurity community at large.  These are the people who choose cybersecurity technologies that can meet technical requirements.   Creative security technology vendors can also approach Black Hat as a recruiting opportunity, not just a sales and marketing event. 
4. I left Black Hat with even more cybersecurity concern.  I’m in the middle of this world all the time so I hear about lots more about the bad guys’ Tactics, Techniques, and Practices (TTPs) than most people do.  Even so, I spent the week hearing additional scary stories.  For example, Blue Coat labs reported on 660 million hosts with a 24 hour lifespan it calls “one-day wonders.”  As you can imagine, many of these hosts are malicious and their rapid lifespan files under the radar of signature-based security tools and threat intelligence.  I also learned more about the “Operation Emmantel,” (i.e. from Trend Micro) that changes DNS settings and installs SSL certificates on clients, intercepts legitimate One-time passwords (OTPs) and steals lots of money from online banking customers.  Black Hat chatter served as further evidence that our cyber-adversaries are not only highly-skilled, but way more organized than most people think. 
5. Endpoint security is truly “in play.”  A few years ago, endpoint security meant antivirus software and a cozy oligopoly dominated by McAfee, Symantec, and Trend Micro (and to some extent, Kaspersky Lab and Sophos as well).  To use Las Vegas terminology, all bets are off with regard to endpoint security now.  With the rash of targeted attacks and successful security breaches over the past few years, enterprise organizations are questioning the value of AV and looking for layered endpoint defenses.  Given this market churn, Black Hat was an endpoint security nexus with upstarts like Bromium, Cisco, Crowdstrike, Digital Guardian (formerly Verdasys), Druva, FireEye, Guidance Software, IBM, Invincea, Palo Alto Networks, Raytheon Cyber Products, RSA, and Webroot ready to talk about “next-generation” endpoint security requirements and products.  While the incumbents have an advantage, endpoint security is becoming a wide-open market as evidenced by the crowd at Black Hat. 

Black Hat is a great combination of Las Vegas shtick, hacker irreverence, and a serious cybersecurity focus.  Yup, it’s only a tradeshow but there is a serious undercurrent at Black Hat/DEFCON that is sorely missing from most IT events.