Careers & People

8/25/2017
10:30 AM
Lysa Myers
Lysa Myers
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

A Call for New Voices on the Security Conference Circuit

If the mere idea of talking in public makes you want to hide in a bathroom stall with a stuffed bobcat, think again.

There are certain things we can expect during the course of the annual conference season. Every year at about this time, the breathless headlines start rolling in, describing the impending doom due to some vulnerability or other. The stories we may hear less about, which could even be the most innovative, are those inaugural speeches by people who are new to the security conference circuit.

Many of us may feel like we shouldn't be on the stage if we can't bring headline-generating topics or a TED Talk level of showmanship. But it's those new voices that keep conferences interesting in the long run, and which may offer the perspectives that bring big changes in the effectiveness of security. As you attend conferences this year, it is my hope that you give some thought about how you could add your voice to the conversation.

My own inaugural security conference presentation was one born of necessity. I had been to enough events to get completely hooked on repeating the experience, and when travel budget cuts dictated the need for stronger justification to send people to future conferences, I submitted my first abstract for consideration. No one could have been more shocked than I was when it was accepted; I was a relative newcomer with zero experience in computers before I started in this industry. I could not have been further from the definition of a security expert at that point.

I prepared for this speech harder than I've ever prepared for anything in my life. I did all those things everyone tells you to do to ensure that you are comfortable and at ease, so that your talk will go smoothly. I had so many friends in the audience that it was not simply a mental game to pretend that I was talking to a group of my favorite people. The elements were all there for things to go well.

Of course everything went perfectly, right? As you might guess, the answer is a resounding No. It was a total disaster that was precipitated by my overwhelming anxiety, which led to a cascade of technical glitches, and me speaking so rapidly that I ran out of material way before the end of my allotted time. It took everything in my power not to vanish into an awkward puff of smoke when the talk was over.

And yet, it was not the end of the world, nor was it even the end of my speaking career. I learned two important things about public speaking that day: living your worst-case scenario is never as bad as you think it will be, and not all of us need to fit in a certain mold to be a good speaker.

If you've never read the Bloggess blog or any of Jenny Lawson's books, you should probably remedy that right now. If you have, you probably know that she is screamingly hilarious and that she has struggled with anxiety issues of her own. There was one particular talk she did (in a bathroom stall, and with her taxidermied service animal) that I found especially helpful to envision other ways I could speak effectively. And it served as an entertaining reminder of how much I personally enjoy talks that offer something truly unique.

There are only so many times one can watch a variation on the "Hacking (X) for fun and profit" theme. For the last few years, I have found myself seeking out conferences and presentations that offer an angle that's new to me: for example, speakers from outside the mainstream security industry discussing issues that are unique to certain business verticals, or who offer a different perspective on existing technologies or techniques. No joke — I've even gone to a herpetology conference for security inspiration.

If we keep doing things the way we've always done them, we will continue to get the same suboptimal results. We need new voices from people with different perspectives to help us make a substantive change in the way things are going. You could be one of those voices; even if you don't think you're the type of person whose talk would be accepted, even if the mere idea of talking in public makes you want to hide in a bathroom stall with a stuffed bobcat. There are ways to make your voice heard that make your differences creative advantages.

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
9/16/2017 | 1:01:43 AM
Re: Suggestions?
Sorry for the delay, it appears the first version of my comment disappeared into the ether! 

As for bigger conferences, the two that come most readily to mind are RSA and BlackHat/Defcon. But between those two extremes, there are countless dozens or hundreds of options. There are conferences that focus on defense, others on offense. There are some that are more corporate, some that are more informal. There are some that focus on specific aspects of security like usability, privacy, IoT, Anti-malware, etc. There are some that are geared towards particular demographics or regions of the country. And there are even a surprising number geared towards specific business verticals like Healthcare or Education. There are a ton of different cons to check out now: Google can actually be helpful for this, as can following coverage from Dark Reading, or security folk on Twitter. 
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
9/15/2017 | 3:25:48 PM
Re: Perhaps Some Tips?
"What you did wrong" may be as simple as "submitted to a conference with an overwhelming number of applicants".

Larry Zeltser has posted a list of tips that really sums it up for me.

https://zeltser.com/submit-security-conference-proposal/

The few times I've been on the reviewing end of the equation, the most important things I looked for in session abstracts were a topic that has some new or interesting angle/subject, and an abstract that clearly illustrated that they had a clear plan for what they would be covering.

Another thing to do is to find people who are on conference selection committees and ask for their unvarnished opinion on your submission. They may see issues that might be less intuitive to those of us who haven't had to wade through a sea of session abstracts.
geriatric
50%
50%
geriatric,
User Rank: Moderator
9/15/2017 | 9:05:14 AM
Perhaps Some Tips?
I have been thinking about doing a talk for some time now. I submitted an abstract to a security conference, but it was rejected (READ: ignored). So I really don't know what I did wrong. What about some tips from those who have cracked the elite circle for us wannabes?
SDiver
50%
50%
SDiver,
User Rank: Strategist
9/7/2017 | 9:30:42 PM
Suggestions?
Great article, Lysa,

 

I've spoken at local security conferences for the past seven years and would like to expand into the larger conferences.  Have any suggestions?  It seems that conferences come and go before I ever learn about them.
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19326
PUBLISHED: 2018-11-17
Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.
CVE-2018-19274
PUBLISHED: 2018-11-17
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.
CVE-2018-19324
PUBLISHED: 2018-11-17
kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.
CVE-2018-15769
PUBLISHED: 2018-11-16
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) on TLS clients during the handshake when a very large prime value is...
CVE-2018-18955
PUBLISHED: 2018-11-16
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resour...