In late 2019, I had the opportunity to attend CactusCon for the first time, and gave a talk on Google Cloud Platform security. For anyone who’s not familiar with it, CactusCon is a security conference in Arizona. It feels like a smaller version of DEFCON, which includes talks, workshops, a couple of villages, and a capture the flag (CTF) competition. In this post, I am going to cover a bit about the conference and why I think it should be on your list of security conferences to attend.
CactusCon 2019 took over a couple of buildings in the Mesa Convention Center, to host about 1500 attendees. It was an easy walk between them, and being in Mesa is really nice in December. It was much more comfortable than Las Vegas in August! In case you are wondering who attends this conference, there are lots of security practitioners from all different industries. While there was a presence from academia, the bulk of attendees seemed to be people from the industry who are a part of an operational security team. You would probably recognize a few people from other prominent security conferences too.
One of my favorite parts of the conference was the “Snow Talks” section, which you won’t even find on the schedule. These were similar to the Skytalks at DEFCON, where the Chatham House Rule was in effect. I can’t share much more about those talks, but they had some great folks talking about very interesting topics in an informal setting. This was only happening on one day of the conference, so it was hard to attend everything I wanted to. I hope in the future they either have this on its own day, or have it repeat throughout the conference, so I can attend more of them without missing the main talks at CactusCon.
A few examples of the talks at CactusCon covered topics such as software supply chain attacks, running honeypots in an enterprise, and how to target people on social media (for obtaining sensitive information). Besides my presentation, I don’t recall seeing any other talks on security related to the cloud, so that topic was definitely in the minority. The presenters were very knowledgeable and did a great job with their presentations, and the talks were delivered with the right mix of sarcasm and humor, yet highly informative. It was not just people from Arizona, there were attendees and presenters from all over.
I would encourage anyone interested in security to attend CactusCon, and anyone working on cloud security to submit a talk when the CFP opens up again (which was in July for 2019). My audience asked some great questions and seemed to be very engaged, so I hope to speak there again next year.
If you are interested in learning more about the security issues I discussed in my presentation, the slides are available here, and a blog post on the same topic is available here.
