8/1/07
Welcome to the inaugural posting to our new blog “Fearless Security” hosted by Penton/Windows IT Pro. We intend to focus on life in the Infosec lane.. call it a “lifestyle” blog for us in the white/grey hats. Less about feeds and speeds of the latest firewall and more on what shows/trainings/certifications will offer you the most for your training/certification dollar and other career stuff along with whatever fun stuff we can somehow tangentially related to Infosec. Join two grizzled (ok, one of us is less grizzled than the other) industry veterans for biting and hopefully witty commentary and discussion on all things Infosec, IT and computing in general.
It’s raining here as the Annual Blackhat security conference starts here in Las Vegas. Its a rare event in the desert, keeping the skies overcast and cooler than the average 105 degrees F in July. An inauspicious beginning to a conference trying to refocus its mission while broadening its audience, a hard thing to do even when you aren’t under new ownership. The show was sold last year to CMP Media, not exactly your avant garde, counterculture company so its going to be hard put to keep its just this side of legitimate cred. However, Blackhat always was the respectable grown up cousin to the accompanying Defcon unabashed hack fest that starts a day later. Blackhat was the show that you could get your company to pay for, so that you could attend Defcon on the weekend. So perhaps a transition to more corporate participation is a natural thing. After all, we aren’t getting any older and most of us have real jobs, mortgages, kids and a house in the burbs now. However, just like your kids, it’s a bit bitter sweet to see them grow up.
However, not all hope is lost yet. Our classic measure of a show “jumping the shark” is what we like to call the “pony tail to suit” ratio. As soon as the show attendance ratio of Ponytails (read practitioners) to Suits (read salespeople or other folks simply on a company paid junket), it has passed it ability to give useful education and serves mainly as a corporate showcase and another way to drain your company training allowance. We saw this happen in the computer reseller industry, the network industry and the ISP industry. In fact, once you start referring to a group of companies as an industry, you are well on your way. However, I’d rate Blackhat’s P/S ratio at about 70/30 right now so perhaps we have a few more good years. But I think this process is inevitable and a big company taking over the reins certainly doesn’t slow it down, though I’m sure Jeff Moss will do his best (when hes done counting his millions). By the way, congrats Jeff on a well deserved reward for providing us with years of two great shows.
Another sunny forecast is the swag report. It seems this year vendors remembered that the way to a geeks heart is not a pile of literature or a rambling sales pitch but rather free tshirts and other geeky gear. After all, we will be mowing the lawn in that t-shirt and drinking coffee from that mug long after the literature has been deposited in the hotel room trash cause we couldn’t fit it all in our suitcases.
Deep pockets also has other benefits. The check-in facilities are now what you expect at a show of this size, long rows of check in booths. Granted we didn’t get checked in any faster than before. The key note speeches were delivered to multiple rooms with a video link to the main ballroom. This cut down on the standing room only jam-packed rooms of the past and made it much more comfortable. Though, it was a bit Big Brotherish watching a giant talking head on the screen (especially when its Richard Clarks face yapping). Weird seeing the speaker react to things off screen or take questions from unseen speakers. However overall, an improvement.
And of course its still blackhat in all the ways we’ve come to love and hate. A/V screwups, unintelligible speakers and schedule typos. Some things just don’t change.
CMP has also brought in gold plated sponsors such as Cisco and Microsoft. Even though they are a platinum sponsor (The biggest you can buy), I think MS is still a big unsure of what to do at this show. They don’t want to not be there, especially when half the seminars are about breaking their software, but they haven’t figured out where they fit in. So they have a booth where they hand out drink coasters disguised as Windows 2008 Server beta copies and look vacantly into space or play with their blackberries. Honestly Ive never approached a vendor booth at a show and not been drawn into the “vendor tractor beam” of attention and salesmanship like I was at theirs., It was both refreshing and disturbing at the same time.
The keynotes were given by Richard Clarke and Bruce Schneier. Richards was more of his less government is good screeds which is curious considering he was President Bushes staff just a few years ago promoting exactly the opposite. I guess that cured him of being a big government fan.
Bruce’s speech was quite interesting if a bit obtuse about the psychology of security and our unexpected penchants for risk/reward. A good topic for the setting (Las Vegas) and Bruce is always an engaging speaker regardless of the subject.
The sessions have been nicely technical. I know if I feel out of my depth in some of the presentations, then the show hasn’t truly lost its technical edge yet. Lets hope they can keep it up.
Now we are off to Defcon (after a pitstop at the blackjack and craps tables to test out some of those risk/reward theories of Bruce’s). More on that in a few days.
