There's a great discussion going on right now on Twitter about what's wrong with security conferences: do we have too many? Are they focusing on the wrong things?
Josh Corman threw out the figure that more than 60% of conference paper submissions these days were on Android security issues. This sounds pretty excessive when you consider all the other security topics out there. However, let's not forget that there are many different audiences for security talks, just as there are different sub-communities within the security industry. For "breakers," Android security is a hot topic these days, and you would expect to see a lot of talks on mobile security in general at conferences "by breakers, for breakers." And because that's a hot topic among breakers, you'll see defenders and builders eyeing it as well, because in the security ecosystem, what's getting targeted the most is what everyone will tend to focus on.
That's not to say that security conferences are homogeneous. There is a very different culture and flavor at work at a conference for defense-related security (law enforcement and military, and to some extent critical infrastructure), as opposed to a meeting of financial services CISOs, or civilian government, or academia, or "hacker ethos" tribal gatherings. Even if the hot topics are nominally the same, the perspectives and timbre of discussions will be very different. And a conference that features roundtable discussions will bring out information exchanges that aren't as readily forthcoming at classic "stand up and present" functions (even if you count the hallway track).
So even though the sheer number of security conferences these days is dizzying, I think the variety is healthy. We need the grass-roots B-Sides just as much as the vendor-oriented RSA, or the raucous Shmoocon, or the Chatham House Rules-driven CISO roundtable. If anything needs to be changed or tweaked, I simply think that we need to make sure that the same speakers aren't touting the same perspectives at all of these different venues. Everyone wants to hear a sexy war story about mobile every so often, but I really admire the efforts to bring in first-time and local speakers to certain events as well. The "democratization" of security conferences is a trend that I'd like to see continue.
