At Black Hat gathering, passions flow on the B-Side

LAS VEGAS — Attendees at this week’s Black Hat Briefings and Defcon will have an alternative cybersecurity conference to consider, the Security B-Sides conference being held Aug. 3 and 4 a couple miles off the Vegas Strip.

"We are the conversation area of Black Hat," said Security B-Sides co-founder Chris Nickerson. The goal is to provide a more intimate venue for high-level security talks. "The biggest difference about a B-Sides conference isn’t the topic, it’s the way it’s presented. It isn’t a talk-at, it’s a talk-with."

The B-Sides conferences are free, open-source events that began two years ago as a one-off alternative to Black Hat in Las Vegas and have since expanded with more than 30 conferences from Boston to Berlin, Austin to Ottawa. They are corporate-sponsored but organized by local volunteers.

Related coverage:

Averting another Stuxnet will require new cybersecurity approach

The volunteer structure and lack of corporate ownership allow greater latitude and less liability for revealing sensitive information and previously unknown vulnerabilities.

"There are scads of zero-days at B-Sides," Nickerson said. Presentations that would be nixed by lawyers at Black Hat can be given at B-Sides. "They know it’s a private event and you can release these things in conversation."

Presenters also are free to talk about their passions rather than the areas of their professional expertise.

The name of the conference refers to the throwaway song that often backed the hit on the A side of 45 RPM singles in the days of AM Top 40 radio. (If you don’t remember 45s or AM radio, ask your father or grandfather.)

"The A side was the record company’s pick," Nickerson said. "The B side was the artist’s choice."

"There was a lot of good music on B sides," said conference co-founder Jack Daniel. "But they weren’t AM music for the ’60s."

In their day jobs, Nickerson is a penetration tester and founder of Lares Consulting, a Denver-based security consulting firm, and Daniel is product manager at Tenable Network Security and a self-described security curmudgeon.

The original Security B-Sides conference was put together from rejected presentations from the 2009 Black Hat Briefings. "When all the rejection notices went out for Black Hat, there were some very good talks that weren’t accepted because they weren’t Black Hat talks," Daniel said. "We wanted to take a shot at having an event that was more community driven."

The first conference was held in a house in Las Vegas rented by Nickerson. "It went extremely well," Daniel said, with several hundred people passing through over the two days. "People wanted to do more of these."

The Las Vegas conference moved to a larger house in 2010 and this year it has outgrown houses, Nickerson said. "This year we rented the Artisan," a boutique hotel north of the Strip.

In the meantime it also has expanded to other cities. The original idea was to hold B-Sides in parallel with major conferences, such as RSA in San Francisco and Source in Boston, but smaller regional events also have been produced and foreign events as well. Most of the events are held outside the typical hotel conference center venue, from rented houses to bars and vacant theaters. "Each event reflects the local community and the local organizing team," Daniel said. "The idea is to have a space without distracting from the talks."

The B-Sides events are not sour grapes festivals, the organizers say. They are intended to complement rather than compete with large conferences, and organizers have worked with RSA and Source in organizing parallel events in San Francisco and Boston. But that does not mean they adopt the corporate format.

"Most conferences stifle progress in security," by focusing on or promoting a specific topic, Nickerson said. This means that presenters are talking to audiences rather than listening to them to learn what significant issues are. "One of the many problems with other conferences is they name a theme."

B-Sides is something of a throwback to the earlier days of hacker conferences, Nickerson said. "It’s more like Defcon was 10 years ago;" the annual Las Vegas conference started by Jeff Moss that spawned Black Hat.

Size, along with the lack of corporate ownership, is one of the defining characteristics of the B-Sides conferences. Small crowds make it possible to have conversations rather than lectures. But Daniel and Nickerson are not worried that they will fall victim to their success.

"Regional events are going to stay small because of their nature," Daniel said. The two events that might be at risk of outgrowing their purpose are those in Las Vegas and San Francisco. "Las Vegas is the big, noisy event of the year. If it needs to be scaled back, it will." But that is not likely because of its nature. "It is all volunteer."