Venafi established the machine identity protection market, and our solutions protect the largest, most sensitive networks in the world. Leaders in the Global 5000 rely on Venafi to secure the cryptographic keys and digital certificates on which every business and government depends to deliver safe machine-to-machine connections and communications.
Come see us at RVAsec. Register now!
At Advanced Network Systems, we love helping organizations reach their business goals, and solve operational challenges, with the right information technology. We live and breathe IT, and are experts at combining the right people, products and processes to achieve successful business outcomes.
Come see us at RVAsec! Register now.
Privileged access security was born from the collaborative effort of CyberArk’s founders and customers. Since then, the same team continues to introduce new products, define the market and lead with innovations, proven methodologies and thoughtful customer service. CybarArk is well known as the market share leader and #1 vendor in the privileged access security space.
Come see us at RVAsec. Register now!
We are pleased to announce that Cisco are sponsoring our After Conference Reception on Friday, 8th June. The Reception will be held in the Commonwealth Ballroom directly after the last talk on Friday afternoon. Thank you to Cisco, and we look forward to seeing you all there!
Come see us at RVAsec. Register now!
Nat Hirsch is the Director of the Red Team at a large financial institution. He has been doing Red Teaming, Pentesting, and other offensive focused security assessments for the last decade.
Brian Brurok is senior director of Security Software Engineering at Capital One focusing on delivering software solutions and automations for Security Operations teams. He develops and deploys custom applications focusing on Data Analysis, Incident Management, Automation and Live Response. His software tools have been used across teams to improve hunt o
perations, analyst performance, and incident management. Prior to Capital One, Brian spent 16 years in security operations building, maturing and managing over 50 security operations centers across DoD, Intel, Defense Contractor and Federal spaces. He’s active in the cyber community speaking at various conferences, and also regularly hosts and builds realistic training scenarios for multiple Capture the Flag events.
Picture this, a Red Team and a Blue Team working together to make the organization more secure, and not just trying to prove that they are better then the other one. This is how we did it.
Come see Nat and Brian at RVAsec! Register Now.
Karen Cole is the CEO of Assura, Inc. a cybersecurity consulting firm located in Ashland, Virginia. Her company just celebrated its 11th year in business and is considered in the top 1% of women-owned companies in the United States according to a recent study by the U.S. Women’s Chamber of Commerce. Throughout her 20+ year career, Karen has worked with various executives, boards of directors, and legislators to bring cybersecurity to the executive level and get programs the support and resources they need. Many times, she has helped them work through their own 5 Stages of Grief to get them to embrace their new corporate responsibilities.
Most information security professionals got into the field to enjoy the technical challenges of keeping the hackers at bay. However, as information security has moved into the executive level of organizations, most professionals struggle to get connect with executives and get the support they need for their programs. Karen Cole has been successfully handling the most ardent opponents of information security (think politicians, board members, and C-suite executives) for 16 years getting her clients what they need. This session is focused on real-world actions you can take to get the support and resources for your program. Leave your governance theory at the door. This session is going to get real!
Come see Karen at RVAsec! Register Now.
Tyler works at BlackBerry Product Security as a Security Program Manager and is the lead incident manager during emergency response events. His focus areas include SDLC, sustained engineering, vulnerability management, and risk management across multiple operating systems. He is currently researching pre-acquisition and post-acquisition security processes. In the past, Tyler has been responsible for vetting malware being submitted to mobile app stores, and ensuring that users are properly informed of the privacy risks posed by mobile applications and mobile ad packages.
Does your company use Open Source Software (OSS) libraries in the products that it builds? Do you worry that your customers and company will be exploited because no one in your organization is maintaining those libraries with vulnerability fixes? Let’s do something about that.
During this presentation, we will start from nothing and build a process for identifying the OSS libraries that your company uses in order to build a bill of materials. We will source threat intel on those libraries, and we will take action to remediate the vulnerabilities in our source code repository so that we can keep our customers and company safe.
Come see Tyler at RVAsec! Register Now.
Mike Hodges is a senior consultant for the Optiv Attack and Penetration Practice. He has a background in application development and is currently OSCP, Assoc CISSP, and CEH certified. He is currently interested in evasive penetration tactics and techniques and is constantly looking to build new ways to automate attacker evasion.
Organizational spending on cybersecurity is at an all-time high. From an attacker’s perspective, this means that target networks are becoming increasingly hostile environments to operate in. This has pushed attackers to look for new ways to diminish a defenders ability to identify their activity. The introduction of cloud providers and their associated content delivery networks have provided ample ways to attack and communicate with attack infrastructure while piggy-backing on the cloud provider’s infrastructure and reputation.
Techniques and tactics such as domain fronting for multiple cloud providers, distributed scanning, and leveraging API gateways will be discussed. Also, more nuanced aspects these cloud services will be explored as they sometimes provide many benefits to an attacker’s infrastructure, including encryption. Most importantly, mitigations for these techniques will provided so that defenders can go about better protecting their network.
Come see Mike at RVAsec! Register Now.
Simone is Chief Cyberstrategy Officer at CyberVista where she leads product development and delivery of cybersecurity training and education curriculums as well as workforce initiatives for executives, cyber practitioners, and continuing education. Previously, Simone was a Senior Associate at Booz Allen Hamilton in the firm’s commercial sector cybersecurity practice focusing on the creation of cyber fusion centers and the integration of cyber security operations. Prior to that, she led the firm’s all source cyber threat intelligence business in the national security and Defense sectors, including intelligence support to both defensive and offensive operations. Simone received her J.D. with honors from Catholic University Columbus School of Law and graduated from Georgetown University with a B.A. in Government and a M.A. in International Law and Policy.
The industry relies upon a strong and knowledgeable talent base to protect both commercial and national interests, but without a more universal and standardized education model we still have an overall cybersecurity workforce shortage.
This session, designed both for leaders and learners, will explore the current training landscape, describe a model for the new/emerging cybersecurity profession and introduce a career model based on skills/knowledge that are mapped to the field. Participants will leave this session understanding all the tools available for cybersecurity managers to effectively grow the profession from the bottom up, top down, and through the middle via upskilling, reskilling, continuing education and mentoring. They will understand the foundations upon which a framework can be built to address the needs of the individual and the profession as a whole. Finally, participants will recognize the optimal way to balance qualitative measures in the cybersecurity profession (i.e. degree, certifications, etc) and qualitative ones (i.e. continuing education, practice, experience).
Come see Simone at RVAsec! Register Now.
Dr. Robert Mitchell is currently a member of technical staff at MITRE. He received the Ph.D, M.S. and B.S. from Virginia Tech. Robert served as a military officer for six years and has over 13 years of industry experience, having worked previously at Sandia National Laboratories, Boeing, BAE Systems, Raytheon and Nokia. His research interests include game theory, linkography, moving target defense, computer network operations, network security, intrusion detection and cyber physical systems. Robert has published 25 peer reviewed articles.
Increasingly, cyberspace is the battlefield of choice for twenty first century criminal activity and foreign conflict. This suggests that traditional modeling and simulation approaches have stalled in the information security domain. We propose a game theoretic model based on a multistage model of computer network exploitation (CNE) campaigns comprising reconnaissance, tooling, implant, lateral movement, exfiltration
and cleanup stages. In each round of the game, the attacker chooses whether to proceed with the next stage of the campaign, nature decides whether the defender is cognizant of the campaign’s progression, and the defender chooses to respond in an active or passive fashion. We propose a dynamic, asymmetric, complete-information, general-sum game to model CNE campaigns and techniques to estimate this game’s parameters. Researchers can extend this work to other threat models, and practitioners can use this work for decision support.
Come see Robert at RVAsec. Register Now.
