Keynote

Bruce Potter opens with his path into security, starting in Fairbanks, Alaska, and his work with an Alaskan internet provider that brought connectivity to remote communities in the mid-1990s. He describes how his team delivered DSL over alarm circuits to get around a telephone company, and argues that early security work often happens without a clear playbook, with plenty of mistakes along the way.

The middle of the talk draws comparisons between gold rush economics and digital bearer assets such as cryptocurrency. He points out that ransomware is paid in untraceable currency and that private victims lack a institutional backstop comparable to police response for physical crime. He questions where federal responsibility for private-sector cyber harm sits. He then reviews how evaluation frameworks such as the Orange Book and Common Criteria fell behind continuously updated software, and criticizes checkbox penetration tests and SOC 2 reports. He also covers AI as a third wave of development and raises concern about synthetic media and about assessing models at a single point in time.

He closes by urging listeners to learn from past mistakes, using MFA push fatigue as an example of a convenience feature that enabled breaches. The practical takeaway is to anticipate how systems will change and to build resilience rather than rely on point-in-time snapshots of security.