This post was directly inspired by @secmoose and I having a conversation over the last week, and was originally driven by my disappointment this year at DEF CON that, once again, we’re idolizing people that break things. To be clear, I break things. I have nothing against pen testers (I am one) or security researchers. But we show up in Vegas, listen to people talk about breaking stuff, try to break stuff, and then go home. Who builds anything? I know the DEF CON Kids program is doing a bit of this (awesome) and there’s certainly a handful of IR/intrusion analysis/monitoring/etc talks…but we are definitely skewed towards the “I broke this, look at me!” scene.
What to do? Well, here’s what I am NOT suggesting – let’s NOT stop what we’re doing. We are exposing some awesome issues, having better conversations than ever before (and with the NSA listening in to all of them, what could be wrong?), and slowly and steadily marching onward in this bizarre field. No, what I’d like to see, at least an initial dialogue on, is how we incentivize people who defend and build security versus find flaws in it. We all know that both are critical. So what can we do to get more “build” and “innovative defense” talks at cons, as well as activities that have a more dominant “build and defend” element?
@secmoose had some great thoughts on a more defense-oriented aspect of CTFs. CTFs are great for building and testing skills, but primarily for the offensive side. While there are definitely defense aspects included today (malware reversing, PCAP manipulations, “waterholing”, etc.), there could probably be a lot more. What about an entire campaign focused on “
active defense” aggravating attackers using techniques and tools like those in the ADHD distro from @jstrand, @secureideas, and @pauldotcom? More “innovation” ideas on tools for defeating attacks, identifying malicious behavior and thwarting it? Just thinking out loud, really. Would love other ideas and thoughts you guys may have.
In fact, and this was one of my talk ideas for DEF CON this year (rejected) that we look at what the original spirit of a “hacking conference” was, and try to get back to those roots. Let’s invite more people that have nothing to do with breaking, building, *anything* in security, but have great ideas and do other work in science, robotics, engineering, etc. Let’s get some new blood and people outside our industry thinking about some of this and try to get back out of the box we’re in, creatively. Who knows? Could be fun.