It’s Black Hat week in Las Vegas, this summer’s event marking the 20th year of the hacking convention that never fails to entertain. You never know what you’ll find here, or what disruptions you may encounter as a result of the hijinks of the fun-loving attendees. (Do not even think about using the free Wi-Fi!) With hackers, security experts, and vendors gathering from near and far to talk shop, we thought we’d share a few topics that have risen to the surface at this year’s show.
Are machines learning?
The bragging rights at Black Hat always go to folks who prove they can hack the craziest things. But after years of abuse, it seems that that the machines are finally learning to defend themselves with some form of artificial intelligence? At every turn on the vendor floor, we see another spin on machine learning.
While being able to extract higher meaning from a random sample of alert data is a noble pursuit, it’s also important to realize that there is no replacement for an integrated system that paints a full picture from the start. Much of what machine learning can do is add meaning to data that exists in isolation. Such meaning is helpful and a natural outgrowth of an industry that’s spent years building security stacks that don’t work together or natively share context. While machine learning does have its place, let’s not forget that when threat data starts off in an integrated platform that shares meaningful context across the whole security stack, threat hunting and visibility become so much easier. If you get a chance, check out how Zscaler delivers the full security stack as a service in support of this noble pursuit.
IoT fights back!
Many of the sessions this week brought demonstrations of how attackers leverage software and hardware vulnerabilities to turn everything from electronic locks to carwashes against us. That’s right, carwashes. In one session, presenters discussed a case in which hackers could take control of the sensors that allow the roll-up doors to open, successfully trapping someone in a carwash. They could also control the carwash arm to push the car or even injure the occupant. While the possibilities at the car wash are interesting to mull, disruptions like this could apply to any number of other industries with alarming implications. Defeating latch sensors at pharmaceutical companies, for example, or killing the light systems at commercial factories would carry serious consequences for the companies and people affected.
Why connect such systems to the Internet in the first place? In the case of the car wash, there are plenty of legitimate business reasons. Owners may be able to obtain trend analyses, for example, or track sales and identify the most and least popular packages. But, as devices become more intelligent and connect to the Internet, it’s critical to have a proper layer of security between those devices and their Internet connections that is always on regardless the connection type. If you’re interested in IoT, check out the Zscaler ThreatLabz blog that analyzed the IoT traffic we’re seeing in the Zscaler cloud. Or jump over to read more about Zscaler Internet Access, which allows companies to easily layer on security across the organization to help close the IoT security gap.
We hate our VPNs
While a lot of vendors were talking about the importance of VPNs, there were even more attendees proclaiming their disdain for the age-old technology. At the Zscaler booth, we had a for our discussion on Zscaler Private Access, the revolutionary VPN replacement technology. While the concept may be simple, the implications are profound. By enabling an internal or IaaS app to make an outbound call, Zscaler fundamentally changes the VPN game. Your apps are never exposed to the Internet, users never need to be on a network, and organizations can use the Internet as a secure network, avoiding the need to build a complete inbound VPN stack. If you hate your VPN, and we know you do, jump over to the Zscaler Private Access page to learn more.
Black Hat 2017 been characteristically interesting, with a valuable exchange of ideas, as well as eye-opening demonstrations that challenge the status quo for everyone charged with IT security. We look forward to getting back to San Jose and going back to work to help more companies discover how to stay ahead of evolving threats by securely connecting users and apps totally in the cloud. But before that, it’s best to check the refrigerator, the thermostat, baby monitor, alarm system, and sprinklers to make sure their passwords and firmware are up to date. We’ve seen what these guys can do.
