Orlando, Florida, is one of the most visited places on Earth, partly because it is home to Disneyland, which is roughly the same size in land mass as San Francisco. It is also unique geographically, as it is made up of over 100 lakes. This same spirit of many travelers coming together, connecting many things into one, made it the perfect backdrop for a security event that brought together professionals and students with a wide range of backgrounds: University, BSides Orlando was able to grant
BSides Orlando Swag
AI is, often, not going to get it right on the first try
In his updated keynote " took us through a history of AI use and laid out a path for all security professionals to better leverage this rapidly evolving technology. This new version of his talk compared 19 different AI tools he has experimented with over the last couple of years, talking through the strengths and weaknesses of each offering.
Jason also walked us through how he builds ChatGPT bots, such as his
"Red/Blue/Purple AI" from the one and only Jason Haddix
Using Data Lakes to manage logs in a cost-effective way
. As giant object stores, this is a much more cost-effective option. However, it does come with some technical overhead, as you will need to implement a way to effectively retrieve logs of events you want to investigate, which he showed as an example in his presentation.
This approach is ideal for any long-term data you want to keep, such as DNS logs, which are expensive to store in traditional analytics tools. In one instance, his storage bill shrank to around $80,000 vs. the $2 million it would have cost if they had stored these same logs in Splunk directly. He did warn this approach requires an economy of scale, meaning if you don't require storing thousands of gigabytes of logs a day, you might not see substantial savings. However, it is a good idea to review how you store logs and the associated costs, no matter how large your enterprise is, as there might be better alternatives than just paying your SEIM for more storage.
, challenged the notion that the blue team needs to be right all the time and that attackers only need to be right once. First, it is unrealistic to expect any professional never to make a mistake, regardless of focus. That is demoralizing and sets everyone up for failure and frustration.
Kevin said that getting into an environment in his work as a pentester should be the easiest part. Moving around undetected should be much harder to do. He said, "Once I am in, I have no idea how the system is laid out and what actions I do will trigger alarms."
We need to increase our security posture with this in mind, spending time building traps and early warning systems when something or someone does not seem right rather than continue to spend as much time trying to harden our perimeter. We also need to stop blaming the user for 'clicking the wrong link' when we have made their job dependent on clicking links. Blaming the user for failing security does not help us improve security. While we must work to raise awareness through security education, we need to understand users and what matters to them, which we can only do through listening to a lot more and thinking about how we can make the easy path the safest one.
, walked us through what it means to conduct assessments from the perspective of someone who might want to do these professionally and from the viewpoint of an organization who is facing being assessed.
In the world of
'Conducting Security Assessments--Lessons for those being assessed and those wanting to do it" by Michael Brown
Choosing our own security adventure
This year's event theme was "Choose your own security adventure." . We would also encourage you to think outside of just security events. After all, we can only really help secure systems if we understand the folks building and using those systems. They all have conferences, too, like DevOpsDays, Developer Days, and programming language-specific meetups. You are more than welcome to go and be part of the larger world of computer science conversations. Maybe you will even see GitGuardian there.
SOCIAL SHARE CARD GENERATOR