An especially thick haze hung over the Las Vegas valley as the smoke from the California wildfires drifted eastward. Combined with the excessive heat warnings — which in Las Vegas means it’s really hot — most people decided that staying inside and walking around the vendor floor at the annual Black Hat security conference wasn’t such a bad idea after all.

Participants at this year’s event were treated to Elvis Presley and Marilyn Monroe impersonators, magicians and vendor-branded mohawks — all the traditional sights of a Black Hat conference. Hot topics from previous years, such as endpoint protection, threat intelligence, threat hunting, artificial intelligence (AI) and machine learning, were once again hotly discussed and debated at vendor booths and in the conference halls.

IoT Security Risks at a Municipal Scale

Among the biggest topics of discussion this year was the Internet of Things (IoT) — not just at the consumer level, but also at the industrial level, especially with the deployment of IoT devices in many smart city environments. Devices such as traffic controllers, flood gauges, street lights, air quality control, municipal Wi-Fi and other technologies are being built and deployed quickly without much thought to the security within them.

Interestingly, many of the vulnerabilities researchers are discovering in these devices are the same ones that plague consumer IoT, such as hardcoded passwords and non-updatable software. However, the risks are much greater when we consider devices that control entire cities.

The Vulnerability Management Conundrum

A somewhat less sexy topic that also got a lot of play at this year’s Black Hat is the evolving nature of vulnerability and threat management. Vulnerability management has been around for a while to help security teams scan their networks, rank vulnerabilities and remediate them with the resources they have.

More recently, the industry has come to discover that this approach tends to fail at scale when organizations have thousands of endpoints to scan, resulting in tens of thousands of vulnerabilities, many of which are rated as critical by their Common Vulnerability Scoring System (CVSS) scores. How do you know what to patch first?

Vulnerability management has wrestled with this conundrum for years. Fortunately, the industry finally seems to be developing ways to better rank those flaw. By looking at additional data surrounding a vulnerability beyond its CVSS score, security teams can determine the likelihood of exploitation, including the risk to the business if exploited. This will go a long way toward stretching the slim resources that most organizations have when it comes to vulnerability management.

What Did We Learn at Black Hat 2018?

All in all, this year’s Black Hat was another one for the books. Sure, Elvis is still in the building, but the illuminating sessions and discussions that took place at this year’s conference demonstrated that we as security professionals are raising awareness in some areas, such as IoT security and smart cities, making progress in others, such as vulnerability and threat management, and continuously developing new techniques to help to secure everything around us.

Listen to the podcast: X-Force Red Team Lead Charles Henderson Announces X-Force Red Labs at Black Hat

More from CISO

Do You Really Need a CISO?

2 min read - Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer. A CISO is a senior executive in charge of an organization’s information, cyber and technology security. CISOs need a complete understanding of cybersecurity as well as the business, the board, the C-suite and how to speak in the language of senior leadership. It’s a changing role in a changing world. But…

2 min read

What “Beginner” Skills do Security Leaders Need to Refresh?

4 min read - The chief information security officer (CISO) was once a highly technical role primarily focused on security. But now, the role is evolving. Modern security leaders must work across divisions to secure technology and help meet business objectives. To stay relevant, the CISO must have a broad range of skills to maintain adequate security and collaborate with teams of varying technical expertise. Learning is essential to simply keep pace in security. In a CISO Series podcast, Skillsoft CISO Okey Obudulu recently said,…

4 min read

The Needs of a Modernized SOC for Hybrid Cloud

5 min read - Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint (EDR) technologies can detect and often stop entire classes of threats. Now we are seeing the emergence of technologies such as attack surface management (ASM), which are starting to help organisations get more proactive and focus their efforts for maximum…

5 min read

How the Talent Shortage Impacts Cybersecurity Leadership

4 min read - The lack of a skilled cybersecurity workforce stalls the effectiveness of any organization’s security program. Yes, automated tools and technologies like artificial intelligence (AI) and machine learning (ML) offer a layer of support, and bringing in a managed security service provider (MSSP) provides expertise that isn’t available in-house. But it isn’t enough, especially for the medium-sized businesses that would most benefit from an internal security team. However, the talent shortage doesn’t just impact present-day security concerns. The lack of a…

4 min read