Introduction to the Track, Reflections on a Decade of IATC

This opening session of the I Am The Cavalry track at BSides Las Vegas marked the group's tenth year. The lead speaker, Jen Ellis, could not attend in person, so her recorded address was played. The presenters framed the session as a retrospective on where the effort began ten years earlier, when concern about connected devices affecting public safety prompted a call for researchers and practitioners to work with regulators and manufacturers.

Much of the talk traced how policy has shifted over that period. Ellis described early pressure on security researchers from legal threats and anti-hacking statutes, and how conversations with lawmakers gradually made the value of research clear. The presenters described a small medical device security meeting held in a hotel room as an early step, which led to work on device guidance, a recall, and eventually the PATCH Act becoming law. They also pointed to an IoT cybersecurity improvement act, a federal task force during the pandemic, and staffers who came through the community and later took roles in Congress and the White House.

The closing portion looked at what remains. The presenters said progress has been uneven, that many connected systems still cannot be patched, and that the effort needs a new phase. They announced a planned gathering to set direction for the next decade and previewed the day's sessions on electrical, food, water and emergency care. The main takeaway is that lasting policy change came from sustained relationships between practitioners and government, and that the work is far from finished.