Day One Feedback Loop: What did we hear?

This session is a feedback round held at the end of the first day of I Am The Cavalry's track at BSidesLV 2022. Josh Corman opens by recapping the day's talks, which covered how critical infrastructure risk has grown over nine years, from healthcare and vaccine supply chains to water, food, energy, schools and municipal services. He also reviews recent policy changes, including the situation facing good-faith security research, and poses the open question of whether the group's original mission is complete or whether it should change.

The middle of the session is an audience speed round. Attendees raise themes such as the gap between well-funded organizations and under-resourced operators, the concentration of risk in a few large vendors and facilities, and the lack of diversity in who takes part in security work. Others argue that connected devices and software should be treated as public infrastructure, that vendors' incentives favor cheap products over secure ones, and that the field needs better metrics to show whether security is actually improving. Corman responds with examples, including unsupported Exchange servers in hospitals and the value of measurable confidence-building practices such as patchability, vulnerability disclosure programs and software bills of materials.

The closing portion turns to the tension between private commercial interests and public good, with proposals for an opt-in designation for public-interest security work and debate over whether consolidation or diversification better protects essential services. Corman concludes that progress is real but outpaced by adversary activity, and he asks attendees to bring ideas to the next day's brainstorm on possible open-source tools for under-resourced organizations.