Category: Announcement

Lock Picking Village and Contest at RVAsec

Now that we are all able to get physical again, it’s time to get back to picking some locks! A variety of example locks, from simple to extremely hard, along with a picks of all shapes and sizes will be available in our lock pick village.

Stop by and have some fun testing your skills!  Provided hand sanitizer will be required to help reduce the modern risks while we explore the oldest security mechanism on earth!

If you fancy yourself a strong picker or have a competitive streak, we are planning to have a time contest of a series of locks, with the fastest through them all taking home something epic.

We are thrilled to bring this back to RVAsec!

Register now!

Speaker Feature: Alex Nette

Alex started Hive Systems in 2018 with his passion for cybersecurity and the role it plays in today’s interconnected world. He brings executive-level expertise in the establishment and continuous improvement of preeminent cybersecurity programs and applies his work from various cybersecurity disciplines in a holistic approach that prioritizes organization’s operations. Alex has provided cybersecurity consulting for over a decade to the public sector for federal, state, and local agencies, and in the private sector for a wide variety of industry segments.

His work has reduced the cybersecurity risk for Fortune 500 tech, financial, healthcare, consumer goods, and energy companies; in addition to the US Department of Justice, Peace Corps, US Federal Aviation Administration, and US House of Representatives. Alex is also an active contributor to the development of the cybersecurity curriculum for grade school students in the Commonwealth of Virginia.

Talk the Talk: Communicating Business Risk During Cyber Incidents

It’s one thing to investigate and remediate a cyber incident with your team. It’s an entirely different beast to manage your organization’s leadership at the same time. Communicating about how an attack can disrupt business as usual is a critical piece of managing the incident response lifecycle. In this talk we’ll look at:

– Methods for effectively communicating about the types of cyber attacks;
– Shine a light on how business priorities may compete with incident response (including legal implications, crisis communications, and reputational risk); and
-Outline strategies to help you receive additional resources following a cyber incident.

Including your organization’s leaders will help, not hinder, your response in the long run. Add these tricks to your tool belt to conquer your next incident response.

Come see Alex at RVAsec! Register now!

Speaker Feature: David Girvin

David GirvinHusband, Dad, Missionary, BJJ, Surfing, Hydrofoiling, Traveler, Hacker of all things. David is just a weirdo trying to fix interesting problems and raise up everyone around me through servant leadership.

Bootstrapping Your First AppSec Program

Application / product security is a massive challenge. From the technical to the social it can seem overwhelming. I want to help you get started in a seemingly overwhelming problem. It’s not, just like eating an elephant we will start one bite at a time. No budget….No problem.

Come see David at RVAsec! Register now!

Speaker Feature: Collin Berman

Collin BermanCollin Berman is a pentester at Capital One Financial, focusing on web, cloud, and cryptography. After getting his start playing CTFs in high school, Collin went on to found the University of Virginia’s Computer and Network Security Club. When not on the Internet, Collin enjoys hiking, camping, climbing, and skiing.

Slippery SOP: Edge Cases in the Same Origin Policy

Why is the web full of cross-site scripting and cross-site request forgery even through browsers enforce the Same Origin Policy? Can we use the Same Origin Policy to mitigate these attacks? In this talk, we’ll answer these questions and more, including uncovering some shortcomings of the Same Origin Policy that can allow attackers to scrape sensitive information from internal websites without authorization.

Come see Collin at RVAsec! Register now!

Speaker Feature: Justin Varner

Justin VarnerJustin started his InfoSec career as a cryptographer at NASA, and 16 years later after exploring nearly every domain available, I’ve never been more excited to teach people how to use security to make their lives better.

Honeypot Boo Boo: Understanding Adversaries with Deception Technology

Breaches continue happening at unprecedented rates with huge financial impact to the global economy year after year and take a massive toll on the psychological well being of the security professionals tasked with constantly defending against threats from all angles.

Our traditional approach to breach detection that is focused on triaging alerts generated by massive amounts of aggregated data from disparate sources is not working. Adversaries know this fact and regularly benefit from it.

The average breach goes unnoticed for 287 days. That’s an exorbitant amount of time for anyone to surreptitiously run off with an organization’s crown jewels and inflict significant damage with ramifications that include consumer privacy violations, loss of trust, steep financial penalties, and irreversible reputational damage.

We need a new approach if we’re ever going to stop the madness.

This talk discusses this new approach to breach detection that is intended to improve alert fidelity, reduce time-to-detection, mitigate the blast radius of a breach, and prevent the massive level of burnout affecting the security community.

We will cover multiple methods for easily deploying effective breach detection technology right now regardless of the size and scope of your environment.

Come see Justin at RVAsec! Register now!

RVAsec 11 After Party — Illusions, Comedy, Mentalism — Register Now!

The RVAsec 11 after party, brought to you by GuidePoint Security and RVAsec, will be at in the main Omni Ballroom on Thursday, June 16th, right after the conference ends!

  • 5:00pm to 7:30pm: Food/Beverage
  • 5:30ish: Show Begins!

Chris Michael…Illusions, comedy, mentalism, music, and endless fun—all wrapped into one magical show. Chris’ unique blend of light-hearted but POWERFUL magic and humor have been dazzling audiences for 10+ years! Chris has been blessed to travel the world bringing fun and happiness to Fortune 500 companies, colleges and universities, and even major sporting events—he’s done shows for GE, US Army, Marriott International, Amazon, facebook, the FBI and multiple conferences and events.

This is an exclusive event, so you must be registered to attend or you will not be allowed entrance–no exceptions!

Important Notes:

  • You must use the same email you used to register to RVAsec.
  • Each attendee must have his/her own name listed (duplicates will be deleted).
  • If you are not registered for RVAsec,  your ticket will be deleted. 
  • Age Restriction: You must be 21 and over to drink alcohol. Non-alcoholic beverages will be available.

Even if you have a ticket for RVAsec and said that you wanted to attend during the signup process, you MUST now registered for the party!

Register For The After Party Now!

If you haven’t bought a ticket for the RVAsec conference yet, now is the time…. click this link, you know you want to!

Or if you know better, don’t click that link, copy and paste this ( in and purchase that ticket!

Capture The Flag (CTF) Run By MetaCTF and Sponsored By SafeBreach

The MetaCTF ( team is back for this year’s Capture the Flag competition!

We’ll be providing a practice environment on Day 1 of the conference to help participants prepare for the competition, find teams, and get familiar with the platform. If you’ve never participated in a CTF before, this is a perfect opportunity to get started! The actual competition will take place on Day 2. There will be plenty of challenges for participants at all skill levels, so whether you’re a seasoned CTF player or a beginner, there will be something for you! Among others, challenge categories will include web exploitation, reverse engineering, OSINT, cryptography, forensics, and binary exploitation.

You’ll need a laptop to participate. Teams can have up to 4 people, or you may compete as an individual.

For those who like to come prepared, we suggest that you have a VM or two ready. You can download Kali Linux here ( or get a free Windows VM here ( or here ( Some tools that might be helpful include CyberChef (, BurpSuite, Ghidra, Pwntools, and Wireshark.

The MetaCTF team has been involved with the RVAsec CTF since 2016. They also run private cybersecurity training for technical employees. If you’re interested in learning more about the CTF at RVAsec or what MetaCTF has to offer, please reach out to roman[at]

Thank you to our CTF sponsor SafeBreach!


RVAsec 2022 Speakers and Schedule Announced

This year we will again have a single track conference! This decision was made as we continue to ensure that we have both a safe and engaging event.

We had many great submissions to the CFP and given the limited number of speaking spots it was extremely hard, but the CFP team has managed to select a great lineup for RVAsec 2022.

Without further delay, here are the speakers for the RVAsec 2022!

For the full details and times for specific talks, please see the schedule page.

Can you believe we are under 30 days away?  Please register as soon as possible so we can plan accordingly for a smooth event! Now is the time to register if you haven’t yet!  Please also help us spread the word and share with your colleagues.

Hotel Reservations @ the Richmond Omni

We were able to secure an excellent rate at our conference hotel of $145 per night, plus tax. The room block will expire on May 25, 2022. The rate is available 6/15 to 6/18. All overnight guests will be able to valet park at the reduced rate of $10 per day and receive free WiFi in their guest rooms. 

Please use this link to make your reservations as soon as possible:

Things are looking great for the conference and we expect more details will be provided soon!

RVAsec 11 – Registration is Open!

Tickets for RVAsec 2022 are now on sale!

RVAsec Badges Registration the RVAsec 2022 security conference, located in Richmond, Virginia, is only $225 for two full days of talks, meals, snacks, drinks, reception, after party, prizes, a capture the flag contest, t-shirt & swag!

Once we sell out there will be no more tickets available.

Conference ticket prices and deadlines:

  • $225 regular price until 3/31
  • $300 late registration until 5/19
  • $500 super late registration until 5/31

** Please note that the only the first 300 registrations will be provided an electronic badge. **

If you are unable to attend due to the price, please contact us to discuss as we have stipends available for students, and we have a volunteer opportunities that provide a great way to get in for free!

Once again there will be no tickets sold at the door, and don’t forget that RVAsec has sold out every year–so don’t wait!  Please note we are unable to provide refunds due to processing fees.  You can, however, easily transfer your ticket to another person.

Register now!

RVAsec 2022 Rescheduled – June 16-17, 2022

Due to several conflicts the conference will be now held June 16-17, 2022 at the Omni Richmond Hotel.

We thank you for your flexibility and we look forward to seeing you all in person later this year!

Quick reminder that the CFP is still open and tickets will go on sale shortly!

-Chris and Jake