The security world recently convened in Las Vegas at Black Hat 2023 for a jam-packed week of training, briefings, and vendor sessions on all things cyber. And Dashlane was there to take it all in.
While the conference had something for security enthusiasts of all stripes and skill levels, the following are the most impactful discussions and the most important issues that will set the tone for cybersecurity going forward.
AI has the power to attack, defend, and counterattack
It’s no surprise that AI was front and center at this year’s show. In her opening keynote, Azeria Labs CEO Maria Markstedter reminded us that AI has the power to attack, defend, and counterattack. However, just like a human, it can also be duped into following a phishing link (time to make the switch to passkeys, anyone?). It’s clear that we’ve only scratched the surface of AI’s capability for offensive and defensive security, and there’s much more to come.
Hackers were human. They’re becoming AI.
How do you defend against a social engineering attack in which an AI bot calls you and talks exactly like your boss? Think back to Terminator 2 when the T1000 impersonated John's foster parents; Terminator Arnold counters by imitating John and asking the T1000 a question only the mom would know to detect the impersonation. As AI-driven hacks rise, determining that you can trust who you’re communicating with is going to be more important than ever.
It’s all about data
Another common thread was the importance of data as intelligence, such as how to use it to train AI models and leverage it to prevent, detect, and respond to threats. Data is also an asset, and much of the discussion at Black Hat was centered on how to protect it and prevent unauthorized access and loss. One session speaker, Brian Vecci of Varonis, quipped “data is like Jurassic Park: it will end up in places you don’t expect, in a way you don’t expect, when you don’t expect.”
AI chatbots are quickly becoming an everyday tool. Discover how AI chatbots like ChatGPT could impact jobs.
Identity must be thought of as a core part of security
Even after so many years, we in the security industry still struggle to make identity a core part of security. Compromised identities—human identities, as well as those used by machines to communicate with other machines—are and will continue to be the root cause of the majority of breaches. Fortunately, we're seeing identity now brought into nearly every aspect of security as organizations modernize. Things like user behavioral analytics, zero trust, and the principle of least privilege are having much more success when approached through an identity lens.
Passkeys are the future, especially in the age of AI
There’s been a concerted, industry-wide effort by tech leaders to make a passwordless future a real possibility. And phishing, as always, was a big topic of many of the sessions. With things like multifactor authentication (MFA) bombing, fatigue, and proxying, MFA is no longer the bulletproof method for guaranteeing identity we once thought it was. Uber, Microsoft, and Twilio were all victims of having their MFA bypassed by this new breed of attack.
A public and private cybersecurity partnership is critical
Acting National Cyber Director Kemba Walden discussed the National Cybersecurity Strategy and challenges caused by the considerable shortage of cybersecurity talent. White House Office of National Cyber Director staff has increased six-fold, but the government knows they can’t handle all threats alone. ONCD, CISA, and other agencies are now working closely with the private sector, including with white hat hackers. If you’ve attended past Black Hat or DefCon conferences, government officials weren’t welcome—there was even a “spot the fed” competition to root them out. But this year, there were high-level federal officials presenting sessions and even keynotes. This participation highlights how both the private and public sectors recognize that they need each other to keep high-level nation-state attacks at bay and fend off cyber war.
The war in Ukraine makes it all real
Jen Easterly, Director at CISA, and Victor Zhora, Deputy Chairman of Ukraine’s cybersecurity division, discussed the importance of the U.S. and Ukraine partnership in the fight against sophisticated nation-state attacks. Due to the intense challenges Ukraine is facing, we’re learning as much from them as they are from us. What makes the cyber attacks more real is the idea of “cyber war crimes” that Zhora talked about; these are when cyber attacks result in loss of life, showing we’re further than ever from the era of kids in basements harmlessly hacking computers for fun.
It’s reassuring to witness so many security experts share knowledge about how we can proactively and responsively address each new challenge together. While the cybersecurity landscape continues to evolve swiftly, so will we.
Interested in generative AI? Learn about its impact on online safety, its ethical concerns, and how to use it mindfully.
Sign up to receive news and updates about Dashlane
