An especially thick haze hung over the Las Vegas valley as the smoke from the California wildfires drifted eastward. Combined with the excessive heat warnings — which in Las Vegas means it’s really hot — most people decided that staying inside and walking around the vendor floor at the annual Black Hat security conference wasn’t such a bad idea after all.

Participants at this year’s event were treated to Elvis Presley and Marilyn Monroe impersonators, magicians and vendor-branded mohawks — all the traditional sights of a Black Hat conference. Hot topics from previous years, such as endpoint protection, threat intelligence, threat hunting, artificial intelligence (AI) and machine learning, were once again hotly discussed and debated at vendor booths and in the conference halls.

IoT Security Risks at a Municipal Scale

Among the biggest topics of discussion this year was the Internet of Things (IoT) — not just at the consumer level, but also at the industrial level, especially with the deployment of IoT devices in many smart city environments. Devices such as traffic controllers, flood gauges, street lights, air quality control, municipal Wi-Fi and other technologies are being built and deployed quickly without much thought to the security within them.

Interestingly, many of the vulnerabilities researchers are discovering in these devices are the same ones that plague consumer IoT, such as hardcoded passwords and non-updatable software. However, the risks are much greater when we consider devices that control entire cities.

The Vulnerability Management Conundrum

A somewhat less sexy topic that also got a lot of play at this year’s Black Hat is the evolving nature of vulnerability and threat management. Vulnerability management has been around for a while to help security teams scan their networks, rank vulnerabilities and remediate them with the resources they have.

More recently, the industry has come to discover that this approach tends to fail at scale when organizations have thousands of endpoints to scan, resulting in tens of thousands of vulnerabilities, many of which are rated as critical by their Common Vulnerability Scoring System (CVSS) scores. How do you know what to patch first?

Vulnerability management has wrestled with this conundrum for years. Fortunately, the industry finally seems to be developing ways to better rank those flaw. By looking at additional data surrounding a vulnerability beyond its CVSS score, security teams can determine the likelihood of exploitation, including the risk to the business if exploited. This will go a long way toward stretching the slim resources that most organizations have when it comes to vulnerability management.

What Did We Learn at Black Hat 2018?

All in all, this year’s Black Hat was another one for the books. Sure, Elvis is still in the building, but the illuminating sessions and discussions that took place at this year’s conference demonstrated that we as security professionals are raising awareness in some areas, such as IoT security and smart cities, making progress in others, such as vulnerability and threat management, and continuously developing new techniques to help to secure everything around us.

Listen to the podcast: X-Force Red Team Lead Charles Henderson Announces X-Force Red Labs at Black Hat

More from CISO

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

6 Roles That Can Easily Transition to a Cybersecurity Team

With the shortage of qualified tech professionals in the cybersecurity industry and increasing demand for trained experts, it can take time to find the right candidate with the necessary skill set. However, while searching for specific technical skill sets, many professionals in other industries may be an excellent fit for transitioning into a cybersecurity team. In fact, considering their unique, specialized skill sets, some roles are a better match than what is traditionally expected of a cybersecurity professional. This article…

Laid Off by Big Tech? Cybersecurity is a Smart Career Move

Big technology companies are laying off staff as market conditions change. The move follows a hiring blitz initially triggered by the uptick in pandemic-powered remote work — according to Bloomberg, businesses are now cutting jobs at a rate approaching that of early 2020. For example, in November 2022 alone, companies laid off more than 52,000 workers. Companies like Amazon and Meta also plan to let more than 10,000 staff members go over the next few years. As noted by Stanford…