By Dan Cornell
I sat down witih Jeanne Friedman last week and recorded a short podcast preview for my upcoming presentation at RSA 2012 “Remediation Statistics: What Does Fixing Application Vulnerabilities Cost?” You can see her post online here and you can download the 8 minute podcast here. The actual session is ASEC-302 and will be Thursday, March 1st, 2012 at 9:30am in Room 302. Hope to see folks there!
Contact us if you want to meet up at RSA.
--Dan
dan _at_ denimgroup.com
I recently had the opportunity to attend the ASIS International Annual Seminar and Exhibits in Orlando, Florida. ASIS is the largest physical security conference in the world and arguably one of the oldest security trade groups in the US (they have been around since 1955). With 20,000+ in attendance, it’s hard to argue that this wasn’t one of the premier conferences in the security industry. I’m probably more of an information security guy than a physical security person, whose limited exposure to the physical security world has been through the CISSP certification (one block of instruction) and during the infrequent red team exercises I’ve participated in during my career where breaking and entering a client’s office complex was part of a contracted project.
What brought me to the ASIS conference was the ISC2, the International Information Systems Security Certification Consortium, and its Security Congress. The Security Congress tracks ran concurrently with the ASIS conference, attracting nearly 1,000 attendees from the traditional information security field. ISC2 had separate speaker tracks that addressed application security, cloud security and social networking. My session had about 40 attendees – a little light but a good group. The interaction was solid and the questions insightful. In short, the speaker session might as well have been at any mainstream information security conference.
Where I experienced culture shock the most was on the ASIS expo floor. For those that argue that the physical security and information security fields are converging, my first ASIS led me to believe otherwise. For starters, more than half of the exhibitors wore dark suits, as did many of the attendees (and, yes, I did see a fair share of three-piece suits). This was in stark comparison to RSA, where most of the booth workers look liked they just hopped off the 18th hole, albeit with matching company golf shirts.
There was a formal air to the expo, including several dark panel wood booths that looked more like a law office library room than a trade show expo stand. Like the info security world, 85-90% of the attendees were men, but the average age at ASIS felt 10-15 years older than RSA, by comparison (I did not quantify that!)
Having said that, there were some very cool things I saw at ASIS that I would never see at a mainstream information security conference. Barbed wire, for example. Seeing a barbed wire display actually jolted me into full awareness that I was not at an infosec conference. The company selling remote-controlled helicopters for SWAT surveillance tickling the geeky side of me. Seeing the fully-Kevlared out SWAT booth worker could not have been cooler too. And who could knock the executive security folks and their booth video showing how they whisk high-profile executives out of harm’s way. I want that.
My head was totally on a swivel as I walked through the acres of trade show booths. I guess it makes sense, but there were a ton of security badge vendors hawking their wares too. Not proximity badge guys, just the guys that actually manufacture the plastic badges and lanyards.
We get pretty wrapped up in the infosec and appsec world, so ASIS was a good reminder that the physical security world is a robust industry that is as highly valued, if not more valued, than our own. There appeared to be some heavyweight buyers on the tradeshow floor, if the elaborate booths were any indication.
I’d like to see more events where the two worlds converge, but candidly, after ASIS it struck me how far they are in fact apart. Different people, different vendors, and different concerns. I know physical security guys will jump all over this, but my vote is that convergence is still more an aspiration than a reality, at least as evidenced by ASIS 2011.
Contact us for more information about software security at your organization.
--John
john_at_denimgroup_dot_com
@johnbdicksonBy Dan Cornell
As expected, the Security BSides Austin conference was a blast. There were a lot of great folks in attendance and plenty of great talks to go around. And of course there were Hackers on a Duck Friday night. Take a look at Jack Daniel’s photos from BSides Austin to get a feel for the event.
Everyone loves the coffee truck servicing Austin Security BSides
For some reason (mostly thanks to Ben Tomhave’s trickery) I ended up doing a number of talks during the conference. The slides should now all be up online:
Also you can find links to the source code from my smartphone app analysis on the Google Code repository attached to the www.smarphonesdumbapps.com site.
John Steven lays down the law about Threat Modeling
I really enjoy the BSides conferences. They’re less vendor-driven that some of the big security conferences like RSA and BlackHat. The talks also tend to be a good mix of in-the-weeds technical topics and interesting perspectives on other security industry topics. Hopefully future BSides Austin events will be further integrated with South By Southwest (SxSW). Getting the security message out to developers and social media
Contact us for help designing and building secure mobile applications and remediating software security vulnerabilities.
--Dan
dan _at_ denimgroup.com
