Locknote: Conclusions and Key Takeaways

on YouTube ↗51m

" summary

Conference wrap lists concrete findings not platitudes: firmware analysis finds 12 Netgear routers sharing the same command‑injection bug; cars ship with 40 computers in the car and vendors prioritize features over security; Android malware exploits stable APIs rather than low‑level memory bugs; detection averages 200 days so emphasis shifts to rapid revert (immutable images, cloud snapshots) plus CI-driven fuzzing, bug bounties, unit tests, least‑privilege and two‑factor as the pragmatic controls.

AI-written summary · about

" chapters (53)

1. 0:00Introduction
2. 4:31Main Event
3. 5:18Diversity
4. 8:45Big picture
5. 9:13No incentive
6. 9:39Security
7. 11:29Bug classes
8. 12:15Problems with bug classes
9. 12:48Bugs vs worms
10. 14:28Mobile security
11. 15:03Software security
12. 15:23Embedded device security
13. 16:23Insurance
14. 17:33Problems
15. 17:58Black Swan
16. 18:20Audience Questions
17. 19:00Legacy Systems
18. 19:23Speed and Security
19. 20:41Slow or Fast
20. 22:44IT Operations
21. 23:33Continuous Integration Pipeline
22. 23:56Security and Scale
23. 24:48Bug Bounty
24. 25:23Security Metrics
25. 25:56Time from detection to remediation
26. 26:44Vulnerability lifetime
27. 27:14Immeasurable
28. 28:23Comparative benchmarking
29. 29:16The better metric
30. 29:52The investment needed
31. 30:27Infrastructure helps security
32. 30:51QA Question
33. 32:37Challenges
34. 33:12Arguments
35. 33:43Information Flow Control
36. 34:09New Frameworks
37. 34:42What Framework Should We Use
38. 35:59Detectable Breaches
39. 37:39TwoFactor Authentication Firewalls
40. 39:21Assume Breach
41. 40:15Logging
42. 41:08Detection to Response
43. 42:11ThirdParty Service Providers
44. 43:31Supply Chain Management
45. 44:24Email Security
46. 45:11Restore periodically
47. 46:07Data exfiltration
48. 46:52Better access control
49. 47:30How many people use Windows
50. 48:01Onetime tokens
51. 48:30Least privilege
52. 49:26Beyond Corp
53. 50:34Outro

" related talks

• 44mLocknote: Conclusions and Key Takeaways From Black Hat Europe 2017Jeff Moss, Andreas Lindh, Shawn Moyer, Sharon Conheady · Black Hat Europe 2017
• 41mLocknote: Conclusions and Key Takeaways from Day 1 locknoteFyodor Yarochkin, Ty Miller, Pamela O'Shea, Mika Devonshire · Black Hat Asia 2021
• 48mLocknote: Conclusions and Key Takeaways from Black Hat Europe 2018Jeff Moss · Black Hat Europe 2018
• 45mLocknote: Conclusions and Key Takeaways fromJeff Moss, Haroon Meer, Jennifer Savage, Marion Marschalek · Black Hat Europe 2015
• 44mNight of the living vulnerabilitiesS. Zanero, R. Clapis · Codemotion Amsterdam 2018
• 39mLocknote: Conclusions and Key Takeaways from Day 2Neil R. Wyler, Asuka Nakajima, Seungjoo Kim, Mika Devonshire · Black Hat Asia 2020
• 39mNight of the living vulnerabilitiesRoberto Clapis, Stefano Zanero · Codemotion Milan 2017
• 52mLocknote: Conclusions and Key TakeawaysJeff Moss, Leigh-Anne Galloway, Marina Krotofil, Daniel Cuthbert · Black Hat Europe 2019