I spent the last decade or so traveling the world- attending as many of the "non blackhat / defcon" style security conferences as I could. I attended blackhat once- it wasn't a bad experience- what was lacking, at-least to me, was the sense of shared mission and camaraderie. You need conferences like DEFCON, I had a really hard time getting into it. You're able to meet a lot of people, but without a shared mission, it's hard to build good relationships from venue's like that. I ended up at the bar, the problem, it was with people I already knew, not the people I needed to introduce myself to.
Over the years I've built my closest relationships based on a shared sense of mission. It might make me sound altruistic about Internet security, but in order to build a good relationship- you need to lay some common groundwork. Trust is a partnership of sorts- if your ideals and goals aren't in alignment, there's only so much you'll be able to accomplish together. That's not to say you won't get stuff done, it just means at some point you'll grow apart as your goals will diverge as well as the relationship.
As the kids have gotten older- I've started being a bit more picky with my travel. If the conference isn't focused on eCrime, research and/or tooling- it pretty much doesn't make the list anymore. Most of the public security conferences end up on YouTube or a blog somewhere, which makes the investment decision come down to:
What are the chances I'll meet some new people with a shared sense of mission? People that will help me get things accomplished in the future?
Of course- there's the obligatory "how far do I need to then travel for this?", that's more of a personal preference. If it's a conference that's near a major hub- and the hotel isn't too far off the beaten path, those are easier. I'd take a DoubleTree by the airport any day of the week, vs some fancy hotel (where I CLEARLY DO NOT BELONG) off the beaten path in a congested city. The food and beer usually go further and the conversations tend to last longer.
If I wanted to be on vacation- I'd go on vacation. When I want to get stuff done, I want to get in, not really have to leave to find food, spend more time talking / working with people and get out. Life is too short and I'd rather use that time out in the woods than some fancy dinner which just makes the conference more expensive. Gimme a dive bar with some decent pub fries and I'm good to help the world solve its Internet security problems.
The annual APWG eCrime Research conference pretty much hits the nail on the head for me- year after year. It's one of the few conferences where they focus on the eCrime and less on the glitz. Industry and Academia coming together to influence research that actually needs to be done. At the same time offering researchers the opportunity to work with real operators out in the field.
The conference organizers spend more on food and booze that keeps folks in the same room, rather than fancy "nights out" that can actually inhibit networking opportunities. I've found it to be a healthy experience in leaving my a-hole attitude at the door and understand how others (often non-operators) think through the various eCrime related problem spaces. I've learned over the years, not everyone's an extreme extrovert like myself. Most of the good ideas come from those who don't appreciate "center stage". Getting them to share those ideas is the trick, this conference makes it look easy.
The core group of researchers and industry practitioners that drive this conference have done a spectacular job at balancing academic style research with operations. Having both sets of talented individuals in the same room together reinforces that shared sense of mission for me. In this, operators like myself are able to forge deeper, stronger and more specialized relationships with other like minded individuals to get stuff done. Something that's really special and hard to come by in my regular day to day life.
This is the one conference I try to hit year after year.
Keep up the great work APWG!
