Recently, over 30,000 cybersecurity professionals, government officials, and members of the press descended upon Las Vegas, Nevada for the spectacle the security community has come to love, known as Hacker Summer Camp. This was the first year since the pandemic where all four events were held in person, and we’re excited that over 20 Datadog employees were able to represent us—and present 11 panels, presentations, and workshops—throughout the week. We also unveiled our latest open source security tool, Threatest, at DEF CON! Needless to say, it was an action-packed week, and we’re happy that we were able to catch up with old colleagues and friends, sync up with customers, and connect with the security community.
In this post, we’ll cover the highlights from each of these events.
What is Hacker Summer Camp?
Hacker Summer Camp is a long-standing tradition for the security community, consisting of 10 days (Aug. 6–16, 2022) of four cybersecurity conferences and various training opportunities. 2022 marked the 30-year anniversary for the conference that started it all: DEF CON.
Across-the-board themes
Across all of the events we attended we noted that the security industry is clearly in a phase of maturity, especially with regard to cloud computing. This is a boon to consumers of security products like the Datadog Cloud Security Platform because it means that we can move the needle in the right direction by adopting architecture patterns, tools, and common practices. Instead of operating from the mindset that companies will never be breached, we are seeing a change in mindset as assume-breach is gaining popularity.
Some of our favorite talks across all Hacker Summer Camp events include:
“IAM The One Who Knocks,” by Igal Gofman, Head of Security Research, Ermetic and Noam Dahan, Research Lead, Ermetic
"Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling," by James Kettle, Director of Research, Portswigger
"Breaking Silos: Your Operational Experience is Needed in Legislative & Policy Spaces,", by Ayan Islam, Associate Policy Director, Cybersecurity and Emerging Threats, R Street Institute
These standout presentations demonstrated a few themes of this year's Hacker Summer Camp. It’s very clear that cloud is here to stay, and as an industry, we’re still coming to terms with the level of operational maturity required to manage multi-cloud environments. Given the widespread standardization of browsers, REST, and microservices, attackers have developed an amazing arsenal of tools to exploit features of these HTTP standards. All the while, legal and compliance frameworks are playing catchup to try to provide a strong baseline for companies of all sizes.
Datadog's talks at BSides Las Vegas
To kick us off, Trupti Shiralkar (Engineering Manager, Software Security) and Hossein Siadati (Security Engineer) presented their talk on various Software Bill of Materials (SBOM) challenges and how to fix them. Vladimir De Turckheim (Staff Engineer) followed up on Wednesday with his illustrious talk, “Everything I Know About Prototype Pollutions: How to React when Confronted to a Brand New Vulnerability.” BSides Las Vegas is a grassroots conference that prides itself on fostering a sense of community, and these talks were certainly a great warm-up for the week to come.
Black Hat 2022
For many, Black Hat is the main event of the week. It has come to be the premier place for security vendors to release new products, features, and even announce new partnerships. Many security researchers also release tools and research that they’ve been working on over the past year. It truly is an exciting conference, and this year, it celebrated its 25th birthday. We had our own exhibit where we were able to chat with current and prospective customers about our security offerings and how we can help solve their pain points.
Christophe Tafani-Dereeper (Cloud Security Researcher and Advocate) provided live demonstrations of our Stratus Red Team adversary emulation tool, which has garnered support and contributions across the open source and security communities. Guillame Fournier (Senior Security Engineer) also presented his latest research on how to leverage eBPF to detect kernel-level exploits.
The Diana Initiative
The Diana Initiative starts on the same day as Black Hat and takes place over two days. Since 2016, the Diana Initiative has played a pivotal role in welcoming minorities into the security industry and ensuring their success. We were very happy to sponsor the event this year!
Our very own Karishma Asthana also contributed to the mission by presenting her talk, “Hacking Your Career: How to Successfully Pivot to Your Next Professional Role.” Trupti Shiralkar and Hossein Siadati also gave a talk on leveraging SBOMs to foster open source software security.
DEF CON
Lastly, the week was capped off by DEF CON, which is arguably the most notorious hacker conference in the world. The event takes place over four days and boasts 30,000 attendees and over 30 Villages dedicated to the intersection of security and niche domains, such as artificial intelligence, quantum computing, car hacking, and cloud security.
DEF CON is meant to be the physical incarnation of the hacker mindset. If you were to show up on-site, you would see everything from attendees in black t-shirts to elaborate cosplays covered in LEDs. Whimsy aside, DEFCON has been the place where researchers release zero-day exploits that have shocked and awed journalists for many years.
In the 30 years since DEF CON’s inception, it has added a number of Villages that were not solely focused on “breaking things” or “breaking into things.” This year, Datadog participated in the Cloud, BlueTeam, BioHacking, and Crypto Villages for the first time. These spaces were all unique and focused on a very specific security niche. Many have both offensive and defensive content that is heavily practitioner focused.
At the Cloud Village, we released Threatest, an open source project for end-to-end testing of your detection infrastructure. Threatest complements our Stratus Red Team tool by allowing you to measure SLOs for your detection rules. Stratus Red Team also received a new feature: support for Google Cloud Platform. For more information on Threatest, check out the launch announcement.
We also delivered standing room only session in the BioHacking, BlueTeam, and Crypto Villages. While these Villages are not inherently cloud focused, it’s clear that cloud is at the very center of problems like data privacy in healthcare, auditing at scale, and defending the enterprise.
See you next year
It was great catching up with members of the community, building on existing relationships, and seeing attendees from a wide variety of backgrounds embody the hacker spirit. We’re already excited to see what next year has in store for Datadog at Hacker Summer Camp!
