An especially thick haze hung over the Las Vegas valley as the smoke from the California wildfires drifted eastward. Combined with the excessive heat warnings — which in Las Vegas means it’s really hot — most people decided that staying inside and walking around the vendor floor at the annual Black Hat security conference wasn’t such a bad idea after all.

Participants at this year’s event were treated to Elvis Presley and Marilyn Monroe impersonators, magicians and vendor-branded mohawks — all the traditional sights of a Black Hat conference. Hot topics from previous years, such as endpoint protection, threat intelligence, threat hunting, artificial intelligence (AI) and machine learning, were once again hotly discussed and debated at vendor booths and in the conference halls.

IoT Security Risks at a Municipal Scale

Among the biggest topics of discussion this year was the Internet of Things (IoT) — not just at the consumer level, but also at the industrial level, especially with the deployment of IoT devices in many smart city environments. Devices such as traffic controllers, flood gauges, street lights, air quality control, municipal Wi-Fi and other technologies are being built and deployed quickly without much thought to the security within them.

Interestingly, many of the vulnerabilities researchers are discovering in these devices are the same ones that plague consumer IoT, such as hardcoded passwords and non-updatable software. However, the risks are much greater when we consider devices that control entire cities.

The Vulnerability Management Conundrum

A somewhat less sexy topic that also got a lot of play at this year’s Black Hat is the evolving nature of vulnerability and threat management. Vulnerability management has been around for a while to help security teams scan their networks, rank vulnerabilities and remediate them with the resources they have.

More recently, the industry has come to discover that this approach tends to fail at scale when organizations have thousands of endpoints to scan, resulting in tens of thousands of vulnerabilities, many of which are rated as critical by their Common Vulnerability Scoring System (CVSS) scores. How do you know what to patch first?

Vulnerability management has wrestled with this conundrum for years. Fortunately, the industry finally seems to be developing ways to better rank those flaw. By looking at additional data surrounding a vulnerability beyond its CVSS score, security teams can determine the likelihood of exploitation, including the risk to the business if exploited. This will go a long way toward stretching the slim resources that most organizations have when it comes to vulnerability management.

What Did We Learn at Black Hat 2018?

All in all, this year’s Black Hat was another one for the books. Sure, Elvis is still in the building, but the illuminating sessions and discussions that took place at this year’s conference demonstrated that we as security professionals are raising awareness in some areas, such as IoT security and smart cities, making progress in others, such as vulnerability and threat management, and continuously developing new techniques to help to secure everything around us.

Listen to the podcast: X-Force Red Team Lead Charles Henderson Announces X-Force Red Labs at Black Hat

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today