Reflections from Black Hat and DEFCON: Trends, Community Energy, and the Future of OT Cybersecurity

Aaron Crow (0:2.028): What's up everyone just back from Blackhat and Defcon. This is the what first year I've been and I don't know probably 15 years where I didn't actually go on the floor at Blackhat and I did not stay for all of Defcon. Both things are pretty pretty rare for me here recently. Just too much stuff going on but I definitely wanted to make sure that I dip my toe in both of those. Had a great experience this week.

Aaron Crow (0:30.904): trying to stay cool, not too hot, melting into the pavement. We all know in Vegas in the summertime, it's always warm and hot. So Vegas in August, Black Hat Def Con, thousands of people. Let's talk about what went down, what stood out, and what's next. Lots of things coming on. Really excited about my buddies that are doing Reset Con this year. I'm actually gonna replay a episode from last year about that. So check out that. So just...

Aaron Crow (0:59.426): Back from Vegas, first impressions, it's still the same energy. Still quite a few people there, lots of vendors spending a lot of money, lots of AI conversations, talking about AI, how AI can be impactful, how they're bolting it on. Had some conversations with some vendors that are kind of frustrated because, hey, we've had AI in our product for 10, 15 years, but nobody knows it, right? And they're struggling to say,

Aaron Crow (1:28.910): How do we add that value now or so show it without just looking like we're slapping an AI sticker on like it seems and appears like many vendors are on the on the Vegas side. And I just I hate to say it, but I'm not a Vegas fan. It is so hot. It has gotten super expensive. You can't stay anywhere. Food. I mean, ordering a frickin coffee and a bagel, I mean, is 20 bucks. It's

Aaron Crow (1:57.888): It's so ridiculously expensive. And then talking with cab drivers and Uber drivers and all the things, everybody's struggling. It's definitely, the crowds are down. It's not a good sign for Vegas. They say that a lot of folks are not coming from overseas. A lot of people aren't traveling there this summer. It's struggling. But I'll say that the people that are there, there was still a great turnout from Black Hat. There was an amazing turnout for Def Con.

Aaron Crow (2:25.178): and the community is still incredible. I saw so many friends and folks there. Every hall's a conversation. It's hard to walk 10 feet without seeing someone you know, having a cool conversation, saying hi, giving a hug, high five, seeing people at drinks or dinner or whatever the things are, even just trying to run to the bathroom. mean, it's hard to get around in that space without seeing people that you know, which is awesome. DEFCON, mean,

Aaron Crow (2:53.550): set up the day before it actually opened with ICS Village and we walk in at 10 a.m. something like that and I don't know how many people there were thousands of people literally waiting in line to get swag. They wanted to buy Defcon shirts, which is awesome. I don't get it. But man, I'm glad that they're super excited about it. So that's what keeps these these conferences and these these events going. And that's the kind of energy that we need, you know, to make the next steps and to make

Aaron Crow (3:23.314): make changes and grow and all the things that, you the purpose of conferences, especially like DEF CON, is to grow, it's to hack, it's to learn, it's to play with technology, it's to, you know, connect with friends and others and attack problems together and all the things. So it's a lot of fun. So spent a lot of my time in the beginning at House of Blues, we had the Cyber Lounge there, awesome venue, right there, Mandalay Bay, you know, one of the best.

Aaron Crow (3:49.198): networking spots of the week. I saw so many people coming and going. Old friends and new conversations and had the OT wall there. Showed off, you know, technology of what a simple OT environment looks like. I think I've shown that picture on here, but definitely check out my LinkedIn posts. I've got pictures of it out there. It's actually got to get repaired because TSA loves to just break it. They love to just pry the tops off because there's electronics in. I'm sure on a X-ray scanner probably looks like something that's dangerous on an airplane.

Aaron Crow (4:18.542): want to say the word, but yeah, I mean I get it, but they continue to break it. So we just got to continue to fix it. Cool thing is is most of those conversations were about what we're working on struggles that were having fun times. All the things had a lot of folks that are talking about, you know, struggling in getting the next steps or you know whether it's OTC, cybersecurity or maybe there were quite a few that were getting into not not necessarily getting into OTC, cyber, but a lot of their customers were or their organization was.

Aaron Crow (4:47.372): getting, you really opening that OT cybersecurity door, which was awesome to see. Obviously everyone's talking about AI and how it can impact them. I would not want to have this conversation without mentioning all of the villages and all the spaces. Obviously I have a few that are close to me being ICS village. That's one I spend most of my time at.

Aaron Crow (5:11.482): Tom Van Norman and Bryson, all the folks, the volunteers, everybody that's, you know, the sponsors, everybody that comes out there. This was the biggest event ever. The space was amazing. It was huge. So much things going on. Maritime and red teaming and all the different villages were there. It's amazing to see how this thing has grown and how many people come out to see this and ask amazing questions and want to be part of the CTFs they want to.

Aaron Crow (5:36.939): dig into what's going on, why OT is different, even the ones that frustrate me when every year I seem to have the arguments with people that come up to me and try to convince me that there's no difference between IT and OT, there's no difference between technology and a power plan or a manufacturing facility than the same as that's in their house or whatever, right? And sometimes the technology is the same, but I continue to have the understanding from working in the field and understanding what's different about it. And sometimes it's a hard

Aaron Crow (6:6.818): to understand as a cyber and technologist. It's hard to understand why you would want Windows XP running in your environment, it's never that we necessarily want that. It's just that it's there and sometimes it's easier or almost impossible to get it out so. Defqod crowd and energy man. It was packed. I don't know how many people there talked to some of the goons on Thursday night Friday. I don't remember which it was and they were. They were just talking about how.

Aaron Crow (6:35.938): You know, it's more of the same. So many people, those goons, guys, if you've never been to DEFCON, the volunteers for DEFCON are called goons. They're wearing the red shirts. They stand there all day long. walking hundreds and thousands of steps. It's incredible how much effort and work they do. And they're volunteers, guys, right? Just like me and everybody else at the ICS Village, we're volunteers. We don't get paid for that, right? We're there to volunteer to help, to give our time.

Aaron Crow (7:4.886): And those DEFCON goons, man, they are just overwhelmed. There's so many people there. So be nice, be kind, ask my amazing questions, buy them a drink, get them a popcorn, get them a candy bar. Those guys and gals and folks really, really work hard to make sure that everybody has a fun time, is safe. And we can continue having these types of events. So DEFCON has everything from students to seasoned hackers.

Aaron Crow (7:31.363): people that have nothing to do with cybersecurity that just want to come out and hang because it's cool. It's fun. There's amazing villages and contests and weird projects and there's there's hidden games and codes everywhere. I remember one of the first years being there, I was sitting at a talk and literally in the seat next to me, there was a business card and I looked at the business card and long story short, it ended up becoming a puzzle, right? You had to figure out the puzzle and if you figured it out in time and then you got to this place and it was just a door to a hotel room and it was just a party.

Aaron Crow (8:0.270): Right? It was just, but me and a few folks, like we spent hours on that thing figured out because you know, step one would take you to this place and you go to this other place. Like it was, it was a lot of fun. So somebody put a lot of time and effort and those things are all over the place. So it's you get out of it, what you put into it. But you know, going back to just the bigger conference, looking at black hat, many of big conferences still exist. The issues in the big conferences still exist. It's one of the reasons why we do, you know, with this Lone Star Cyber. If you're, if you're seeing my hat.

Aaron Crow (8:30.158): I've got my Lone Star shootout hat on. My daughter loves socks. So anytime I go to a conference, which I did in this year as far as going in, I'll want to get t-shirt or a pair of socks or whatever. But then you get bombarded with the sales outreach and, you came to our booth and you seem to be interested in this and you seem to be interested in that. And unfortunately, most of the folks at those booths are just working there. They don't necessarily understand and they're not actually asking. They're not getting the quote unquote ICP.

Aaron Crow (8:59.980): the understanding of who the ideal customer is. And if I'm interested, they're not asking this question. So usually when I go up to these booths, I'm like, look, I am or am not interested in your product. I really just want a pair of those socks. If that's okay, I'll grab a pair. If not, no harm, no foul, right? And most of them don't really care. They're there to give out their stuff. They don't want to go home with it, right? Because I've been in the vendor space and you don't want to take that stuff back on the airplane with you. So you just want it to all be gone when you leave.

Aaron Crow (9:24.652): Because Black Hat has gotten so big and like that, there's a lot of decision makers that don't go. I know when I was an asset owner, I never had the budget to go, not never, but rarely I would have the budget to go. I think I went twice as an asset owner to Black Hat. One time I went for a day and then ended up having to get called out because an issue happened at a plant. And then I tried to get back. I don't remember if I was able to or not, but it's really hard to get the budget. I know I was speaking with one of my friends that had

Aaron Crow (9:53.943): was even speaking at DEF CON and had gotten his, company had turned down his approval to travel. So we had to pay for it out of his pocket, which is, it's frustrating, right? Is they don't necessarily see, and what that tells me is they don't necessarily see the value in the conference for them. What is the ROI? You know, why would they invest money in their people to go to this thing when it seems like they just see it as a party or

Aaron Crow (10:23.035): a sales organization or whatever, right? So that's a struggle when you have the ROI being questioned by organizations and why they wouldn't send it, why the CISOs don't go. Or if they do, many times you don't see CISO on their name because they don't want to get bombarded. It's one of the reasons why I work, we're doing what we do, as well as why I work with organizations and I advise with building cybersecurity and Resetcon. So Resetcon is one that's coming up in October.

Aaron Crow (10:52.915): Savannah, Georgia. ResetCon is focused, it's more, I would say it's more like DefCon than Black Hat in that it's focused on cutting edge research, exploitation, trade craft, things like that in critical industry. It's like DefCon meets university research, meets critical infrastructure. So it's really focused, it's really niche. It's the second year. Last year went amazing venue.

Aaron Crow (11:19.885): Amazing city, amazing talks and conversations. It's not huge. It's very curated and niche, but you know, really great feedback last year, had a lot of great conversations, a lot of great, a great talk. So highly recommend checking them out, really working to get a lot of the villages out there. And I think the prime sponsor this year is Amazon. So there's definitely some, some big value being seen in this space. You know,

Aaron Crow (11:46.617): We'll be playing the replay episode from that ResetCon with the founders from it last year. But really check that out. If you're OT or IT or somewhere in between, you're wanting to get in, you're in that research conversation, anything like that, definitely check out that episode on ResetCon. I think it's episode 18 talking about ResetCon. So if you're a Black Hat or DefCon, love to hear your side of the story. How did it go? What was your favorite thing?

Aaron Crow (12:14.939): What did you like? What did you not like? If you're going to ResetCon, definitely let me know. Reach out to myself if you haven't heard about it or you want more details. They may still have talks open. I don't know. It's pretty late. But there's definitely some opportunities for folks to volunteer and or just come and be part of it. It's a great location. It's a great venue. It's lots of great conversations.

Aaron Crow (12:39.836): Definitely there's not a whole bunch of ad scanning and salesy type stuff. It's very much more villages and conversations and deep dives. With Lone Star, are doing some Austin local events here coming up. you're in Austin, Texas area, we've got a couple of happy hours and a dinner coming up with the big event coming in November where we're doing the next Lone Star Cyber Shootout where it is a two or one and a half day event.

Aaron Crow (13:8.559): where we start out with cyber dinner and then the next morning we do, you know, shooting. We shoot guns, out of helicopters. This year we're gonna do some cool stuff talking with our helicopter person. We are gonna be shooting out of the helicopter at Humvees as the Humvees are moving. We'll be shooting paintballs, we're not gonna be hurting anyone, but it'll be a lot of fun. So shotguns, pistols, great dinner, bourbon cigars,

Aaron Crow (13:38.745): Texas skyline after it's cooled down quite a bit. So definitely want to check out details to be coming up in the next week. So definitely please reach out for that and reach out. You'll have a good one. And until I see you guys the next next conference, thanks a lot.

Transcript lightly edited for readability.