DEFCON 21 (and 20 oops!)
Monday, August 12, 2013
DEFCON 21 was in Las Vegas, NV from August 02-04, 2013 and we were there. Our real-time posts, references, and links are available over on @Technewsradio on Twitter.
We have a detailed report (PDF) from the sessions attended if you are interested. Just drop us an email to get the full report or a request via message on Twitter. A podcast summary is planned but not promised at this time.
Things that we are "worried about" from an Enterprise computing perspective:
- Social Engineering against users is like a hot knife cutting butter. Only defense seems to be training and awareness. Traditional information assurance (IA) protections: virus scanning, IDS, firewall, etc are not effective.
- You can't secure what you don't manage.
- Basic system administration tools and infrastructure services in the Microsoft Windows world can be used for evil: PowerShell, .NET, DNS, browsers, PKI, and SCOM.
- USB is not your friend.
- Mobile computing and Bring Your Own Device (BYOD) are really not your friend.
- Cloud computing could be your friend but probably won't.
- Developers writing code for an organization without a security focus is just asking for trouble.
- If you think your stuff is secure just because you have it behind a lock and a key you are in denial.
- In a year or less, penetration testing is going to include inexpensive mobile assault options via semi-autonomous very-small drones and robots.
P.S. x 1: We were also at DEFCON 20 and have that report available if you are interested. Just drop us an email or message on Twitter for a link.
P.S. x 2: There are also DEFCON 18 and DEFCON 19 reports. They are surprisingly still relevant IMHO -- same bat channel.