Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Difficult Conversations

Andrea M. Matwyshyn

PolicyI Am The Cavalry1 hr 31 minBeginnerOpen on YouTube ↗

Where

I Am The Cavalry
BSides Las Vegas

Duration

1 hr 31 min

Explores how security professionals could self-organize, drawing on licensing models from other professions.

Summary

Andrea M. Matwyshyn opens by arguing that the security field lacks a shared language and a set of trusted sources that ordinary people and policymakers can rely on. She frames the session around professional societies, explaining why occupations form self-regulatory bodies: to shape a public-facing reputation, to mentor newcomers, and to give members a collective voice when policy goes wrong.

The middle of the session draws on historical cases. A dam collapse that ignored engineers' warnings contributed to the formation of engineering societies and codes of ethics, and environmental crises pushed legislators toward clean air and water laws. She compares how fields such as law, medicine, financial advisers, and cosmetology handle licensing, exams, continuing education, insurance, sponsorship, and sanctions for misconduct. She also floats the idea of a "chief technology safety officer" role, a peer position inside organizations that could push back on unsafe releases.

In the question period, attendees raised concerns about membership costs, how the public can judge a practitioner's competence, the risk of regulatory capture, and whether a certification could be objective enough to be meaningful. The answers stressed starting small with shared values and bottom-up roundtables rather than waiting for government action. The session closed with the view that doing nothing is not an acceptable path as systems grow more interdependent.

Related talks