Hi everybody, we are here in front of the U.S. Congress to talk with you for a little
bit about the policy department at DEF CON. DEF CON is the annual hacker conference that
takes place each summer in Las Vegas, Nevada. This year it is going to be August 10th through
the 13th. DEF CON has been held since 1993, so this is the 31st DEF CON that is going
to be coming up. And as those years have gone by, cybersecurity policy has become a lot
more important. Both the enterprise as well as society and the policy makers have come
to seek out the expertise of the security community that is present at DEF CON. And
the security community has gotten more involved in policy making. And so this has evolved
to become a policy department, an official policy department at DEF CON. It was featured
there last year, it's going to be here again this year and going forward. The policy department
brings together security pros, hackers, as well as policy professionals and government
officials to mix because we all recognize that cybersecurity policy making is better
when you have community input. Now last year, the policy department at DEF CON held a lot
of bridge building events as well as mixers and fireside chats with White House staff
and senior government officials like Jen Easterly, the director of CISA, and Leonard Bailey,
the head of the computer crimes division at the Department of Justice, as well as a lot
of great policy content. Some of that content includes stuff like aviation policy, foreign
affairs, hacker law and how it affects security research, and a lot more, election security.
We can't reveal the policy content for DEF CON, the DEF CON policy department this year
just yet, but you can expect it to continue to engage with government officials, security
pros and hackers, and have deep dive conversations, hilarious conversations about some of the
most important cybersecurity policy issues that are being discussed right now. Those
can include the National Cyber Strategy in the United States, which was recently released
by the White House, and the implementation plan for that National Cyber Security Strategy
is going to be released soon. It touches on virtually every sector of the economy, including
security research. As part of that, critical infrastructure is going to be a hot topic.
The White House has directed regulatory agencies for sectors like electricity, water, food,
aviation and many others to look into ways to increase the resilience of the owners and
operators of those critical services. IoT cybersecurity is going to be another one.
There is going to be a labeling announcement that will be announced by the White House
here pretty soon that would create a security label that can be put onto consumer IoT devices.
And the criteria and the details of that have yet to be figured out. AI, of course, is another
extremely hot topic. The White House has announced that it's going to forge ahead with the National
AI Strategy that will include security. The White House has also announced a partnership
with the AI village at DEF CON to work with companies to open up some of the most important
generative AI models to independent security evaluation at DEF CON this year.
This is, of course, not just a U.S.-centric audience. The EU's Cyber Resilience Act,
as well as other pieces of legislation from the EU, are also going to get discussed.
The Cyber Resilience Act is an important one. That would require a lot of security features
to be built into the development and deployment of software sold in the EU. It'll have a GDPR-like
effect if and when it passes. It's already passed the EU Commission. It's now being discussed by
the other two parts of the EU Parliament. We can expect the passage of that in coming months.
And then lastly, but not least, supply chain and SBOM. Those requirements are flowing out
right now to federal contractors. SBOM is becoming more and more adopted into supply chain security
processes. We can expect continued discussion about that, as it is a major issue for anyone
that is making software, particularly if you're selling it to the U.S. government.
So, hope to see you at DEF CON this year. Wear something weird. Come and stop by the
DEF CON Policy Department. We'd really love to see you, August 10th through the 13th.
And in the meantime, follow us at DEF CON Policy on Twitter,
Mastodon, or LinkedIn, or visit us at defcon.org forward slash policy.
Thanks very much and hope to see you there.