Phone Number +1-202-802-9399 (US)

Thycotic is now Delinea!

The Lockdown

Thycotic’s Cyber Security Blog

Top 5 Black Hat 2019 Sessions Not to Miss. Plus: Bonus Travel Tips to Hacker Cons

Written by Joseph Carson

August 1st, 2019

The Black Hat USA 2019 conference is about to start. Over 17,000 security professionals will come from all around the world to Las Vegas, USA.

They will learn, share, educate and disclose security research on the latest cyber-threats and attacks, vulnerabilities, and techniques used to bypass security used by most governments and organizations globally.

Without clear collaboration and transparency, cyber-crime will continue to grow, with full-on cyber war as retribution

Cyber-attacks cross country borders and disrupt our way of life, with no nation-states taking responsibility. In recent years cyber groups have been behind many cyber incidents that have resulted in major data breaches, ransomware attacks, or government agencies’ confidential data being stolen. Several governments and companies have linked these cyber groups to nation-states, though without sharing concrete proof. Those nation-states refute any involvement. Without clear collaboration and transparency, this problem will continue to grow, with full-on cyber war as retribution.

All this will be discussed at Black Hat USA 2019 with the hopes of finding a solution that will make our online world safer.

As you prepare for the journey to Las Vegas, planning ahead is critical so you can be sure you don’t miss the sessions that are most valuable to you. Reviewing hundreds of Black Hat sessions is a challenge, so I have listed my “Top 5 do-not-miss sessions” at Black Hat this year. I’ve also thrown in some bonus travel security tips at the end—be sure not to miss them.

My Top 5 Do-Not-Miss Black Hat Sessions:

The Keynote Wednesday – August 7 | 9:00am – 10:00am

Every Security Team is a Software Team Now

Speaker – Dino Dai Zovi 

This is a keynote I always find interesting during Black Hat. I usually agree with the message, especially with previous keynotes from both Alex Stamos (former CSO for Facebook) and Parisa Tabriz, who is Director of Engineering at Google (aka the Security Princess.)  However, this year I am not quite sure I agree, but I will listen carefully to find out why every security team is now a software team. I will share my thoughts later after the conference.

Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically  – Wednesday, August 7 | 10:30am – 10:55am

Speaker – Wenxu Wu  |  Researcher, Tencent Security Xuanwu Lab

Service accounts can be a pain for organizations to manage, especially across multiple accounts for different services, tasks and other applications, and in sync—it’s time consuming and error prone when done manually. Service account password management is another challenge: administrators can’t safely change a service account password if they don’t know where it’s used without risk of bringing down other applications.

So, a session on the Battle of Windows Service should be a great way to learn about new privilege escalation risks and possible errors that enable cyber criminals to take advantage of service accounts.

Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD) – Wednesday, August 7 | 11:15am – 12:05pm

Speaker – Sean Metcalf  |  CTO, Trimarc & Mark Morowczynski  |  Principal Program Manager, Microsoft

I always enjoy listening to Sean Metcalf. And of course, a session on Cloud is critical given the pace at which companies are transitioning to cloud services.

A snippet on the abstract indicates that this session is surely one not to miss:

“This presentation focuses on the Microsoft Cloud (Office 365 & Azure AD) and explores the most common attacks against the Cloud and describes effective defenses and mitigation. While the content is focused on the Microsoft Cloud, some of the attack and defense topics are applicable to other cloud providers and are noted where applicable.” – Abstract Description

On Trust: Stories from the Front Lines – Thursday, August 8 | 9:00am – 9:25am

Speaker – Jamil Farshchi  |  Chief Information Security Officer, Equifax

Given that Equifax has been in the headlines numerous times in the past year, I believe it is important to get a view from the front lines and hopefully some good lessons on how we can improve incident response. Incident response is now one of the most critical aspects on responding to major data breaches.  I believe this session is surely one of those not to miss during Black Hat.

Adventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers – Thursday, August 8 | 3:50pm – 4:40pm

Speaker – Paula Januszkiewicz  |  CEO, Cybersecurity Expert, CQURE Inc.

At conferences I always seek out amazing and inspirational speakers, and of course one of those not to miss during Black Hat is Paula Januszkiewicz.  Go to Paula’s session during Black Hat and learn about CQTools along with new discoveries she will share.

Bonus Travel Security Tips for Attending Hacker Cons

When attending Black Hat or Defcon I follow some simple tips to ensure I stay safe and reduce my risk of becoming the next cyber victim. Though honestly, I follow these on any travels I take, but during Black Hat and Defcon I usually go a little bit further to reduce the risks even more.

Tip 1. Do not disturb
When staying in a Las Vegas hotel I always have the “Do Not Disturb” sign up during the entire stay. However, due to last year’s “random hotel room checks” I recommend keeping anything you want to remain out of sight locked in your suitcase. Scan your room for any sign of hidden cameras just to be sure no one else is watching.  This is becoming all too common.

Tip 2. Smile for the camera

It is almost impossible to not be tracked walking around Vegas. Thousands of security cameras collect tons of metadata about you: biometrics, clothing, location history and social sphere (meaning who is near you.) So, avoiding being tracked is impossible—even with a baseball cap and sunglasses you cannot fool some of the sophisticated cameras. In Vegas, accept that “What happens in Vegas stays in Vegas” is no longer true and get used to my new version: “What happens in Vegas gets caught on camera and stays on camera.”

Tip 3. Secure your devices

Now, before travelling to Vegas I check all my devices for security updates, patch each device, take backups of my systems and data, and remove anything from my devices that could be sensitive in nature. This is just good practice for any travel and should not be limited to Vegas for Black Hat and Defcon.

To reduce the risk of my devices being hacked, I completely power off the devices that I am not actively using, including those I leave locked in the hotel room. The devices I carry with me are kept in airplane mode most of the time until I need to check something, though never using public Wi-Fi.  If you must use public Wi-Fi then do so knowing your data will be collected and monitored, so always use a VPN and a device that does not contain anything sensitive. And of course, never view sensitive data over the public Wi-Fi.

Tip 4. Carry good, old-fashioned cash

Use cash for payments as much as possible. This is getting more difficult so if you do carry a credit card that uses contactless payments keep it safe in an RFID-protected wallet. When I take cash out of ATM’s I use only those inside banks and not the ones on the street as they have a higher likelihood of being scammed or tampered with.

So, in a short list, here are my tips:

  • Keep valuables in your hotel room locked in your suitcase
  • You are going to be caught on camera and tracked, so accept it
  • Update, patch, backup your devices before you leave home
  • Power off devices you are not using
  • Leave sensitive data at home
  • Use cash and keep your contactless cards in an RFID protected wallet
  • Always assume someone is watching and monitoring you
  • Avoid Public Wi-Fi and use mobile data always with a VPN

 Visit Thycotic at Black Hat USA 2019, BOOTH #1410. I’d love to meet you!

PAM Experts Guide

Take your Privileged Access Management to the Next Level

Free Download: Expert's Guide to Privileged Access Management (PAM) Success