An especially thick haze hung over the Las Vegas valley as the smoke from the California wildfires drifted eastward. Combined with the excessive heat warnings — which in Las Vegas means it’s really hot — most people decided that staying inside and walking around the vendor floor at the annual Black Hat security conference wasn’t such a bad idea after all.

Participants at this year’s event were treated to Elvis Presley and Marilyn Monroe impersonators, magicians and vendor-branded mohawks — all the traditional sights of a Black Hat conference. Hot topics from previous years, such as endpoint protection, threat intelligence, threat hunting, artificial intelligence (AI) and machine learning, were once again hotly discussed and debated at vendor booths and in the conference halls.

IoT Security Risks at a Municipal Scale

Among the biggest topics of discussion this year was the Internet of Things (IoT) — not just at the consumer level, but also at the industrial level, especially with the deployment of IoT devices in many smart city environments. Devices such as traffic controllers, flood gauges, street lights, air quality control, municipal Wi-Fi and other technologies are being built and deployed quickly without much thought to the security within them.

Interestingly, many of the vulnerabilities researchers are discovering in these devices are the same ones that plague consumer IoT, such as hardcoded passwords and non-updatable software. However, the risks are much greater when we consider devices that control entire cities.

The Vulnerability Management Conundrum

A somewhat less sexy topic that also got a lot of play at this year’s Black Hat is the evolving nature of vulnerability and threat management. Vulnerability management has been around for a while to help security teams scan their networks, rank vulnerabilities and remediate them with the resources they have.

More recently, the industry has come to discover that this approach tends to fail at scale when organizations have thousands of endpoints to scan, resulting in tens of thousands of vulnerabilities, many of which are rated as critical by their Common Vulnerability Scoring System (CVSS) scores. How do you know what to patch first?

Vulnerability management has wrestled with this conundrum for years. Fortunately, the industry finally seems to be developing ways to better rank those flaw. By looking at additional data surrounding a vulnerability beyond its CVSS score, security teams can determine the likelihood of exploitation, including the risk to the business if exploited. This will go a long way toward stretching the slim resources that most organizations have when it comes to vulnerability management.

What Did We Learn at Black Hat 2018?

All in all, this year’s Black Hat was another one for the books. Sure, Elvis is still in the building, but the illuminating sessions and discussions that took place at this year’s conference demonstrated that we as security professionals are raising awareness in some areas, such as IoT security and smart cities, making progress in others, such as vulnerability and threat management, and continuously developing new techniques to help to secure everything around us.

Listen to the podcast: X-Force Red Team Lead Charles Henderson Announces X-Force Red Labs at Black Hat