OpenSec: An Osquery Overview

Jason Meller (@jmeller) is the CEO of Kolide, a startup that builds osquery fleet management software. In his presentation, Jason discusses the core principles and advantages of osquery, an open platform for host analysis.

There are three properties that differentiate osquery from other technologies; osquery is “platform agnostic”, meaning it can run on a wide array of machines. Osquery is also extremely scalable, as it has been used over at Facebook, demonstrating that it can run on one machine or hundreds of thousands of machines. Finally, osquery is an open source project, meaning that the community is doing much of the development and pushing the technology forward.

This lighting talk demonstrates the value of osquery as an open project, especially in security settings. While only scratching the surface of osquery, Jason does a great job explaining the factors that are making osquery one of the most important open source projects available today while painting a broad picture of the platform’s capabilities and uses.

OpenSec: The State of Open Source Cyber Security

Liam Randall (@Hectaman) is the Senior Director of Software Engineering at Capital One and the Founder and CEO of Critical Stack, a sensor delivery network. Liam’s keynote presentation gives a detailed overview of the state of open source cyber security.

Being a security professional himself, Liam’s presentation is incredibly insightful in terms of approaching the problems currently facing the cybersecurity space as a security professional, and what open source projects can do to not only help companies, but also help themselves stay one step ahead of attackers. Perhaps the most significant takeaway from Liam’s talk is the importance of application delivery within organizations, and how the use of containers, which provide modular and isolated application delivery along with backwards compatibility.

Liam delves into great detail about certain open source projects, especially the Mitre attack framework, making this talk relevant for anyone interested in cybersecurity. He also understands that agility is critical, as it drives organizations towards responding rapidly in an advanced environment, providing valuable business insight as well.

OpenSec: Sleuth Kit Lightening Talk

Brian Carrier (@carrier4n6) is the Vice President of Digital Forensics at Basis Technology, a software company specializing in applying artificial intelligence techniques to understanding documents and unstructured data written in different languages. In this lightning talk, Brian gives an overview of his experiences in using and designing open source security tools.

Brian begins his talk with a little about his experience in security, and how security tools were very limited early on. When Brian was still a student, Dan Farmer and Wieste Venema released The Coroner’s Toolkit (TCT), and from there, Brian built on top of that to deliver a more friendly user experience, resulting in Autopsy. He then discusses the evolution of digital forensics, moving from individual tools to platform-based tools.

This talk zeroes in on the importance of the user experience in digital security and how the security space is constantly evolving. Brian focuses on the importance of extensibility in the security space, and gives real-world examples of how improving the design of security tools leads to more users.