Black Hat 2023 – Las Vegas. Sitting in one of my favorite bars in the Mandalay Bay Shoppes, 1923 Prohibition Bar, I had an opportunity to sit down and talk with Stuart McClure. For those that do not know, I worked at Cylance while Stuart was CEO there and left shortly after Blackberry purchased the company. We spent a few moments talking about the Cylance days and how the concept of Cylance impacted the cybersecurity industry. It was one of those times when the right concept was introduced at the right inflection point and combined with the right team to get it into the hands of the public. From there we moved on to Stuart’s latest endeavor, Qwiet AI.

Las Vegas – So Black Hat 2023 and Def Con 31 have come and gone, and while the exhaustion that comes from this epic combined event might not be completely gone, I am ready to give my thoughts on the events. Before I get started, understand that this is my personal opinion on the show(s) as well as my general takeaways from them. As always, your milage may vary. Either way, I hope that you enjoy the article below and that your time and camp this year was amazing (mine was). So, let’s get started!

As we head into Hacker Summer Camp in Las Vegas, the emails are already flowing freely into my inbox. Some of them are the regular players that I see every year and others are new. Still more are people that I hear from each year but with new faces to talk to. This is part of what I love about going out to Black Hat, talking new people, talking to well known people in the industry and then getting an understanding of what everyone thinks is the “big thing” for cybersecurity. This year, by far, it is AI and automation.

Hey, remember that supply chain attack on NPM that happened recently? Which one? Yeah, that is sort of the problem with recent supply chain attacks. In particular the ones that are targeting the development pipeline. This is because they are starting to happen so often that they all blur together, yet NPM and other critical components of the development supply chain are still targets for attackers to either get their malicious packages onto development systems, or in the final compiled binary that is then sent out to the general public. To call this problematic is to describe a nuclear bomb as a big firecracker. Ok, soapbox on the importance of SDLC (Software Development Lifecycle) hygiene and security put away for now.