Security conferences have been part of my life for the past two decades. I’ve learned so much, met lifelong friends, and got involved with countless interesting projects. There’s unexplainable energy to being surrounded by so many like-minded people that fuels your creativity and gives you ideas you wouldn’t have had otherwise. My experiences aren’t unique and they are shared by many other security professionals, making the current environment and lack of conferences a bit disappointing.

Given the current situation, conferences and security events are the furthest things from people’s minds, but not having the environment of security conferences may also negatively impact a company’s security posture. This negative impact may seem like a silly concept on the surface, becomes more apparent after digging deeper. 

What is a Security Conference Anyway?

Security conferences are different from other types of industry and academic conferences. These differences stem from the attendees and the culture they create around the event. Most other types of conferences don’t have attendees bringing burner phones or worrying about people bugging their rooms, regardless of how ridiculous it is. 

The perspective of what a security conference is may differ depending on your experience and position in a company. Sometimes this can be negative, but there is a good bet that the perception is of a one-to-many knowledge-sharing exercise. For me, security conferences are many-to-many knowledge-sharing events that allow for hands-on activities and spontaneous creativity. I split the makeup of security conferences out into three categories. 

• Content
• Networking and Socializing
• Entertainment

The content consists of the talks, demos, events, workshops, CTFs, and any other associated activity where someone can participate and learn. Content is what people typically think of when they think of security conferences. 

Networking is all of the activities surrounding the content. Networking may include discussions with presenters, chatting with peers, spontaneous meetups, meeting new people, recruiting, uncovering opportunities, and the list goes on. 

The entertainment aspect is not front and center when thinking about security conferences, but it does play a significant role. Entertainment is what keeps people engaged and heightens the energy level. Entertaining presentations and activities enhances attention and longevity and allows for higher levels of focus. You are less likely to give your phone attention if what you are seeing is entertaining. 

Here’s a question to think about, can a security conference with poor presentations still be valuable? I’d argue, yes, it absolutely can. As long as the other components of content, networking, and entertainment are in place, you can still get quite a bit of value out of the event even if the presented talks fall flat. 

Virtual

Let’s start by stating that no matter how you look at it, a virtual security conference will never have the same value that an in-person event has. Despite this, some companies like O’Reilly have gotten out of the in-person conference business.

The truth of the matter is, you aren’t going to have spontaneous ah-ha moments or get your hands on a voting machine to hack virtually. These are the kind of discoveries you have just walking around observing people work on things. 

With security conferences, there’s also the paranoia aspect. This paranoia isn’t the burner phone type, but people don’t want to be on record talking about their work. This perception is a massive problem for virtually hosted conferences and associated chat channels. The outcome means that real and meaningful conversations may not happen.

For all of their disadvantages, virtual conferences do have one massive benefit over in-person events, and that is increased accessibility. It’s not easy to get schedules lined up, travel across the globe, and coordinate the logistics that people need for physical attendance. 

That said, there are ways to maximize your value for virtual conferences. 

Maximizing Value

It’s painful to hear stories about how someone’s manager feels that conferences are just an excuse for time away from work or other slacking. This perception couldn’t be further from the truth. Like most things in life, conferences are what you make of them, and is especially true with virtual conferences. 

When it comes to virtual events, above all, be patient. Virtual is a new ground for many of the organizations hosting these events. There are going to be hiccups and issues, but by focusing on things you control, you can find ways to maximize the value and ensure that you get the most out of the event. 

Inventory Activities

Identify all of the activities, both official and unofficial, surrounding the conference. It’s hard to gain value from activities you don’t know exist. An inventory is also essential because registration for specific activities may close in a time window before the conference, so planning ahead of time is critical.

• How is the conference delivered?
• Is it video only? 
• What tools are made available? 
• How do you ask questions? 
• Are there specific chatrooms and meetups? 
• What about activities outside of the official activities? 

These are just a few of the questions you should ask yourself to identify what’s available. You don’t want to be figuring these things out on the day of the event. 

Have a Plan

Depending on the event’s size, there may be an incredible amount of noise as organizations, vendors, and external events clamor for your attention. This noise is why you must have a plan.

Start with a couple of questions. 

• What would you like to get out of the conference? 
• What would it take to make that successful? 

The answers to both of these questions allow you to identify the bare minimum for you to achieve this goal and formulate a plan. 

Make sure there are some entertaining or fun activities as well, it doesn’t have to all be about slamming knowledge into your head. 

Also, don’t forget to plan for regular breaks and meals. Depending on the schedule and the conference’s hosted location, breaks for meals like lunch may be at an odd time for you, account for this in your plan. 

Now, looking at the plan, ask yourself another question.

• Is this realistic for me to do in a day?

If you have doubts about whether you can keep the pace, then look at talks or events that you’d be willing to sacrifice if it got to that. Don’t wait until the day of the conference to figure this out. 

Document this plan somewhere and add the events to your calendar for ease of reference. If the conference has an app, take advantage of it for scheduling and reminders. As a final note, even though you have a plan, don’t be afraid to wing-it if the need arises or you make a discovery during the conference.

Minimize Distractions

Distractions are unavoidable but will sabotage your experience. Every year at Black Hat, I see people typing emails instead of watching or talking on the phone in the hallway instead of being inside the room where the briefing is taking place. These impulses to do other things are far worse for virtual events.

There are steps you can take to minimize distractions and give yourself the best chance for success in a virtual environment. 

• Shut down apps and disable notifications 

Shutting down apps and disabling notifications means that these alerts won’t catch your eye while you are trying to focus. If you must, just keep your phone close for emergencies, but still put it on vibrate. If possible, don’t even check your email on breaks between talks. In the immortal words of Admiral Ackbar, it’s a trap. You can get pulled into responses and other activities that could probably wait, and you will miss out on valuable content. 

• Block off your calendar 

Make yourself unavailable for non-critical meetings and office activities. If you don’t have a slot on your calendar, the hope is that people won’t schedule meetings, and if they do, you have an excuse to decline them. I know it’s hard, but at least put in the effort. 

• Go Somewhere 

If you have resumed working from an office, don’t attend the virtual conference from your normal office work environment. People will assume if you are at work, then you are available. The same can be said if you are working from home and have distractions. You could go outside, close the door and hang a do not disturb sign on it or find another option that works. The point is to separate yourself. After all, you are attending a conference, and it doesn’t matter if you traveled to get there or not. 

The Right Mindset

On a related note to minimizing distractions, you have to be in the right mindset for a virtual conference. If not, the content won’t hold your attention regardless of whether you’ve checked your email or not. Activities for getting in the right mindset may be different for everyone, but one thing you can do is take notes. 

Take Notes

One of the best ways to get your mind right is by taking notes. Taking notes is a good idea for conferences in general, but it is much more critical in a virtual environment. Notes will keep you engaged and make you feel more like an active participant. 

Jot down your thoughts, questions, and any other relevant information as the presentation moves along. Any way that you can tie the information together. Ultimately, the notes don’t even need to make sense. The activity is what’s important and will tie you in. 

Take Regular Breaks

As someone who’s been working remotely for many years, I can’t stress the value of a good break. Breaks can be tough to do when you are on someone else’s schedule, such as a conference, but you need to find time to take them. You’ve accounted for these in your plan, so take advantage of them. You should be breaking once per hour, even if it’s only for 5 minutes. Stand up, stretch, and think about something else. It’s the recharge your brain needs. 

Be Social

Being social is one of the biggest challenges to virtual conferences, regardless of whether they are security-focused. Social aspects are such a big challenge, I’m not sure it will ever be solved entirely for virtual events, but you can try and make the most out of it. 

Refer to your plan and identify any specific meetups around the conference and participate in those conversations. This participation will also be a welcomed break from the presented content. It’s an opportunity for you to meet new people and get involved with groups. 

Quite a bit of the social aspects may be experiments, but go along with it and take advantage of any available social features built into the conference. Even though they may be sub-optimal, you might be surprised at the value you get from them. 

In Closing

When it comes to virtual conferences, be patient. Many hosts are just trying to figure all of this out, and it’s uncharted territory. Things will get smoother with the virtual delivery of more conferences.

Virtual security conferences aren’t a replacement for in-person events, but with the right preparation and an understanding of the takeaways, you can maximize your participation and make the most out of it. Have fun.