InfoSec Conferences

For some reason people think that it's really normal and standard to go to a conference about comics or anime or medical equipment but very weird to go to a conference about hacking. Hacker Cons (which I tend to call "infosec conferences" in work-speak) are just what they sound like. Like Comicon if you had panels on breaking into databases instead of upcoming TV shows.

I really enjoy cons - hell, my first date with my spouse was at a con - and I think that people should go to them. If you're interested in learning about InfoSec in a serious way, a con is a good way to start to meet people, see cutting edge talks, and get a feel for the attitudes of the industry.

Why go to an InfoSec Conference?

Conferences are fun, first and foremost. I've seen people talk about hacker cons as work events but that's generally not in the way that most people think of "work" conferences. Sure, you can learn work-relevant stuff at a con, but it's unlikely that you'll do a job-relevant workshop or have a sit-down with a vendor at a hacker con. Hacker cons are for bullshit and trolling and they're great.

Socializing

Cons are, first and foremost, social activities. I have gone to dozens of cons and truth be told, I have gone to almost zero talks because I'm not there to go to talks, I'm there to talk to people. I've made good friends at conferences, and met a lot of cool people, and made a lot of cool connections.

This is also actually the most work-relevant thing about conferences because another word for "Socializing" is "Networking." People tend to think that networking is a dirty word but it's only gross if you go out and obnoxiously try to sell yourself to everyone you meet as a potential future employee/co-worker. If you go out and just act like you want to meet people you'll end up meeting people and getting onto mailing lists and chats with them and suddenly it's three years later and you're moving to a new city and your friend you've been chatting with and hanging out with at cons for a few years happens to know of an opening at their job. I know so many people who have found work (or even started companies) because of cons, but essentially none of them saw the con as a "networking event" and all of them saw it as a party.

Learning

Okay but there are talks. The talks are there for a reason, and it's to teach you things, and you can learn cool stuff at a conference. You may not be able to learn a lot about a new topic in an hour-long talk but that's long enough to get a solid introduction and to learn the terms you need to know to go and seek out more info.

I tend to find that talks at hacker cons come in two flavors: extremely general or very specific. Extremely general talks are the ones that introduce you to a totally new topic, very specific talks are the ones that are functionally a post-mortem of a particular security incident. If you're new to hacker cons, try to go to a few of both at whatever conference you're attending to get a feel for what kind of talk is more informative to you or relevant to your interests. I really like the post-mortem explorations of how various teams responded after an attack, but hacker cons have all kinds of great talks. I've seen talks about near-space exploration, disaster preparedness, and making silly robots at cons and those have all been both entertaining and educational.

Talks also aren't the only way to learn at conferences; you will also often find that there are workshops and open learning "villages" scattered around a con. Maybe you're not going to get a lot out of a talk, but you might get a lot out of sitting down at a table with a few hundred padlocks and trying to pick them.

Fun Activities

Most cons have a variety of fun stuff to do that includes everything from art contests to capture the flag to dance parties. The con that I like best has a tamper-evident contest where the goal is to get into something that you shouldn't be able to and leave no trace; the same con has robot fights with terrible robots.

Many cons have hardware villages where you can work on assembling your badge (which is often some kind of nifty purpose-built computer) and other kinds of activity centers where you can try to hack IoT devices or play pinball or learn how to solder.

Games are also quite common, and you'll sometimes see cons making hacker-specific versions of game shows.

Most cons also include some kind of entertainment event on the main night of the conference - this can be a dance with DJs or a performance by a freak show or a casino night; there are lots of options and many cons vary their entertainment from year to year.

Challenge Mode for your Liver

You absolutely positively do not have to be someone who drinks alcohol to enjoy a hacker conference. I know many people who are sober, many people who are straight edge, and many people who are medically excluded from consuming substances who have a great time at cons.

I also had someone offer me 'shroom chocolate at a con last year and I know people who carry their own shot glasses around conferences because it's just so common for people to offer to pour alcohol into your mouth. If you are someone who enjoys partaking in mind-altering substances with varying degrees of intensity and legality, you will probably have a great time at a hacker con. Just. You know. Drink water and don't get alcohol poisoning.

I also know people who have found that conferences exacerbated their substance use issues and had to change their behavior around cons as a result. Take care of yourself and go in with the understanding that people will be using substances at the con.

How do I find a conference?

Look if you want to jam with the console cowboys in cyberspace, you can't expect someone to hold your hand every step of the way. I get a lot of people asking me "how do I become a hacker?" and that's a question you only answer by going out and becoming a hacker. If you want to know how to find a conference, you should probably try searching either "hacker conference near me" or "infosec conference near me" as your first step. And anyway I don't think a con is the best first step; see if you can't go to some InfoSec Meetings before you try to hit up a con.

That being said, you could also see who or what is affiliated with the conferences below.