http://www.internetnews.com/security/article.php/3728856 

By Sean Michael Kerner
InternetNews.com
February 19, 2008

WASHINGTON, D.C. -- The name "Black Hat" for years has been synonymous 
with shadowy hacker activities. Many also know that the term refers to 
the popular annual security conference of the same name, long held in 
Sin City itself -- Las Vegas.

This week, however, the Black Hats aren't flocking to Vegas. Instead, 
they're meeting in the heart of the federal government: Washington, 
D.C., a setting that makes for a very different type of security 
conference.

[cob:Related_Articles]"It's almost the 'white hat' Black Hat, with much 
more focus on defense than offense," said Brian Chess, founder and chief 
scientist at enterprise security player Fortify Software.

Chess is no stranger to either Black Hat or Washington. His firm is a 
partner with the government-funded Computer Emergency Response Team 
(CERT) on automated compliance checking.

At the last Black Hat Las Vegas event, Chess also ran the famed Iron 
Chef Black Hat hacking challenge.

This week, he's expected to speak once more on security issues. This 
time around, Chess will be talking about software testing and using 
functionally tests to find vulnerabilities.

"It's about how you build software right, as opposed to how you break 
something," Chess told InternetNews.com. "We'll be talking about some of 
the less-than-ideal ways that people go about finding security 
vulnerabilities in their code."

In Chess' view, developers often fail to do a great job of security 
testing simply because they don't have to. Since plenty of bugs can be 
found easily, they typically feel little incentive to undertake a more 
rigorous and thorough search that might find all bugs, he said.

On the flip side, "if you actually want to build something that is 
secure, there actually is a lot you can do," Chess said.

Not surprisingly, the security conference's inside-the-Beltway setting 
also means it will have a special focus on government. Among the week's 
sessions are a talk on phishing and the Internal Revenue Service (IRS), 
and a discussion of potential cyber-threats to the 2008 presidential 
election.

The government focus is also reflected in the background of some of the 
speakers at the event. The only keynote of the Black Hat D.C. event is 
being delivered by Jerry Dixon, a former deputy director of US-CERT and 
the founding director of the IRS's Computer Security Incident Response 
Capability.

A former U.S. spy is also on the speakers list. In a talk about social 
engineering, Peter Earnest, a 35-year veteran of the Central 
Intelligence Agency, will discuss his experiences in espionage.

While this week's conference will offer a different perspective compared 
to its larger, more free-for-all Las Vegas counterpart, followers of the 
goings-on at Black Hat can still expect much of the same.

"It's still Black Hat," Chess said. "The reason why people come out for 
Black Hat is they want to get a taste for what's going on from a 
technical, vulnerability-researcher point of view. So I expect the 
presentation style will be about the same."


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn