RSA 2019 Summary

Overall trends

The overall trends I saw this year included:

AI talk has become a lot more tempered and realistic. People are realizing it’s more like saying you have a database, and you really have to describe HOW you use it, and not just say you have it.
Lots of threat intelligence stuff
Lots of focus on orchestration

I’m dissapointed to not see much about asset management.

Maybe next year, when the Linux desktop becomes popular.

Ghidra release by NSA

I was in the talk where NSA released Ghidra, and I thought it was quite interesting.

As I wrote after the announcement for the talk, I thought the whole thing was basically a well-meaning PR stunt. That is, a PR stunt for all the right reasons. So, more like a gesture of kindness.

And that was spot on.

What I found interesting about the tool—and the thing that made all the difference—is that Ghidra was not a new tool that they just released for some good press. Oh, no. It’s the primary tool they themselves use, and have been using for years.

The undisputed king of reverse engineering tools has been IDA Pro forever, but with this release the market has instantly changed.

Not only is Ghidra free, while IDA Pro is multiple thousands of dollars, but it actually has many unique features that even IDA doesn’t have.

There’s a back button for changes that won’t mess up your entire session
There is support for many platforms
There’s a decompiler that can go from binary to C pseudocode
There are collaboration features

…and these are just a few of the differences.

Ghidra instantly became the one and only true competitor for IDA Pro, and in many ways its far superior.

This couldn’t have come at a better time, because I’m about to learn some basic RE myself.

It’s quite impressive actually, and I can’t wait to dive into some basic RE CTF challenges.

Summary

Solid show, for what it is.

If you come to RSA thinking you’re at Gartner Security, or reInvent, or DEFCON, you’ll be sad.

But if you see it as a chance to see old friends and learn what the industry is doing, it can be enjoyed.

Think of it as the Momentum Partners PDF in real life.

Notes


NSA also has other open source tools, including an SDR framework called REDHAWK.

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.