Category: Conference

Speaker Feature: Rick Lull

Rick has had a hand on a wide variety of tech over the years and also seen it used for both good and ill. He spent a significant chunk of time at a health system, which gave him an appreciation for the reasons behind the technology. He was also very fortunate to be mentored by some great people during his IT career so he has a passion for passing on the knowledge to other. Currently working as the Lead Security Consultant at SyCom Technologies, he is focused on helping companies defend their assets – their people, systems and data.

Bits, Frames and Packets – Demystifying the Network

Think the network is a black box that magically gets your cat videos to you? This talk explains how it works at the fundamental levels.

Come see Rick at RVAsec! Register now.

Speaker Feature: Lou Botticelli and Kara Owens

Lou Botticelli serves as Executive Underwriter, Professional Liability for Markel Assurance Risk Management.  Prior to his employment at Markel in 2015 he worked for insurance broker Marsh & McLennan on the Private Equity & Mergers and Acquisitions team performing both advisory and placement responsibilities for various clients.  Before working at Marsh he worked for Arch Insurance’s Executive Assurance Division and Hartford’s Financial Products Division holding various roles in their respective private equity groups.  He began his career in the National Accounts Management Liability Division at AIG and now has over 15 years of insurance experience.  He graduated with a BBA degree in Business Management from Pace University in 2000.

Kara Owens is Managing Director, Global Cyber Underwriting Executive at Markel Corporation.  In this role, Kara is responsible for establishing and leading Markel’s cyber market strategy and working with cyber underwriters across the Company to achieve growth and profit initiatives. She is in charge of best practices for cyber underwriting and reinsurance strategies worldwide in all Markel divisions. Prior to this role, Kara was the Global Head of Cyber at TransRe and prior to that was a reinsurance broker at Guy Carpenter.  Kara graduated Magna Cum Laude with Bachelors of Business Administration with a dual focus in Risk Management and Insurance as well as Marketing from Temple University. She holds her RPLU, CPCU, ARe and ARM designations.  Kara is a frequent speaker at universities and cyber insurance conferences.  She is on the Board of the APIW (Association for Professional Insurance Women).

What is Cyber Insurance? Are you covered?

Attendees of this session will gain a clear perspective of what benefits Cyber Insurance can provide to their existing Cyber Security Program. Today, Cyber Insurance is no longer a “nice to have” but is a “must have” for every company doing business in a digital world. But how much coverage do you need and what’s really involved in getting cyber insurance? People who attend this session will gain a clear perspective on what Cyber Insurance can and can’t provide and where traditional insurance policies fall short.

Come see us at RVAsec! Register now.

Speaker Feature: Brandon Martin


Brandon Martin leads the Security Measurement Team at NorthState Technology Solutions.  His team focuses on risk assessments and penetration tests that enable customers to benchmark and improve their security maturity and capability.  Through his experiences he earned certifications like the Offensive Security Certified Professional (OSCP), Certified Information System Security Professional (CISSP), Certified in Risk and Information Systems Controls (CRISC) and 6-Sigma Blackbelt.  Brandon performed roles in software engineering, project management, business analysis, penetration testing, and compliance consulting.  Before his current role he worked in heavy industry and banking. In his spare time Brandon enjoys writing code, spending time with family, and mentoring young people with his church’s youth program.

Was I Supposed to Mix the Security in Before I baked it?

Security practitioners advocate ideals through clichés and analogies to help others understand complex problems.  One prominent analogy espouses baking security into a solution instead of bolting security on at the end.  This seems like an obvious analogy – a baker certainly can’t add flour to a cake after it’s in the oven.  In business reality, time-to-market beats security every day of the week.  How can an architect bake security into solutions when the extra time could result in a failed venture?  This talk explores the realities of blending security into the design and implementation of solutions with a goal of realizing better is not the enemy of perfect.  Some implementations bolt on security beautifully; other design patterns prove impossible to correct.  Look forward to a meme-filled tour of architectures, design patterns, and lessons learned that will help security practitioners and business people identify if they’re cooking soup or baking cakes (…if that sounds like a mixed metaphor, don’t be late for supper).

Come and see Robert at RVAsec! Register now.

Introducing Our 101 Track–We Need You To Help Us!

Ch-ch-ch-changes! Every year we grow & tweak RVAsec to provide the best experience possible, and this year is no exception. The biggest change is that we’ve added a third room for talks, the “101” track, where the foundations of cyber security topics will be presented. While you can learn in any of our tracks, if you’re new to security, or want to learn the basics of something new, this is the place for you!

While the track is called “101”, this isn’t meant to come across negative. These talks are given by some of the best speakers, and will provide amazing insight. The big difference is that in this track, concepts are explained, and the intended target is anyone that wants to learn about a specific topic.

Here is the current 101 line up:

Wednesday, May 22

11:00am - Intro to Infosec and Overview of the 101 Track - Deana Shick

1:00pm - What is Cyber Insurance? Are you covered? - Lou Botticelli • Kara Owens

2:00pm - Vulnerability Assessments and Penetration Tests - David Sullivan

3:00pm - Social Engineering, Physical Security & USB Attacks - Brad Thornto
Thursday, May 23
10:10am - Risk Assessment - The Heart of Risk-based Security - Barry Kouns

11:10am - Network Security 101 - Rick Lull

1:00pm - Being Secure Doesn’t Mean You Are Managing Risk - Charles Tango

2:00pm - RVAsec 101 Panel - Deana Shick

Room Planning & Schedule Request:

Finding the space to handle a third track at VCU proved to be challenging. Therefore, we need some assistance from our attendees to help us determine which rooms are appropriate for the speaking tracks. We are asking everyone to take a moment and update your Schedule in Sched.

When you registered for the conference you should have been automatically signed up for Sched.  It would be best that you check your email for the invitation and follow the instruction.

Once logged into Sched, you can visit the Conference Schedule and then select the talks that you plan to attend. This will be particular helpful for us if are planning to attend talks in the 101 track.  Then you can click the Radio Dial next to each talk Title that you plan to attend:

This helps with using Sched to its fullest, but also for capacity planning.  We would like to request that you do this as soon as possible.

We are very excited and also thrilled to have Deana Shick from CERT/CC with us this year helping to run this 101 track!

Hospitality Sponsor: Sentinel One

We are pleased to welcome Sentinel One as a Hospitality Sponsor this year! All the food and drink served on Wednesday 22nd will be sponsored by them, so be sure to stop by their table to say hi and thank them for feeding everyone!


RVAsec 2019. Register now!


Speaker Feature: Brad Thornton


Currently a Senior Penetration Tester with ICSynergy. I’m a husband, father to an amazing baby boy, curious learner, and a hacker. I participate in multiple CTF events, belong to several security focused organizations, and attend numerous conferences on the subject. Historically, I’ve served in various defense style roles in relation to privilege identity and access management.

Droppin USB’s like it’s hot

You may think that USB drops are a thing of the past but that’s certainly not the case. Sometimes breaching a target with a massive defense budget is as simple as a $10 USB dropped at the right location. In this talk I’ll share how an organization could start their own USB drop assessment by detailing the history, common research, tools of the trade, tactics, and mindset of a potential attacker.

Come and see Brad at RVAsec! Register now.

Speaker Feature: Robert Simmons


Robert Simmons is an independent malware researcher. With an expertise in building automated malware analysis systems based on open source tools, he has been tracking malware and phishing attacks and picking them apart for years. Robert has spoken on malware analysis at many of the top security conferences including DEFCON, HOPE, botconf, and DerbyCon among others. Robert also is a maintainer of plyara, a YARA rule parser written in pure python.
Robert, also known as Utkonos, has a background in biology, linguistics, and Russian area studies. He has lived extensively in Russia and Ukraine and has been known to swear profusely and constantly in Russian.

Comparing Malicious Files

A critical step taken during the malware analysis process is to attempt to determine the malware family a sample may belong to. Even if one cannot link a file to a family, one must at least try to find files that are similar and extrapolate information about the sample from comparison with these similar files. This talk reviews a variety of methods for comparing files from simple to complex.

Come see Robert at RVAsec! Register now.

Speaker Feature: Jeff Cummings

Jeff Cummings, Senior Systems Engineer and Security Subject Matter Expert, Infoblox
Jeff has held this position at Infoblox for over five years supporting customers in the Virginia, Maryland, and Washington DC geography. He previously was a Security Engineer at CACI for almost 20 years. While at CACI, Jeff built and managed their Cyber Security Solutions lab in Chantilly, Virginia where he helped create and test security solutions, leveraging relationships with various security technologies. Prior, Jeff was on CACI’s Cyber team where his responsibilities included assessing security posture of numerous customers’ infrastructures and security stacks, as well as proposing/deploying remediation and improved security protections. Jeff graduated with a bachelor’s degree in electrical engineering from West Virginia Institute of Technology and is a current CISSP (#40254).

Preventing the Attack – DHCP and DNS for the Win!

When is the best time to prevent something? BEFORE it happens of course! This talk will describe the unique abilities of DNS and DHCP to protect your network by preventing potential malicious activity BEFORE it occurs. Both of these protocols can literally block malicious activity BEFORE it occurs! As the Internet of Things explodes on all of our networks, and complexity of networks increases, knowing what it on your network is critical. The increased number of devices, many of which are not in your control, can lead to an increased number of threats to your network. A simple, centrally controlled mechanism that can control access to ALL devices exists in your network already. Attend this session to find out how it works.

Come and see Jeff at RVAsec! Register now.

RVAsec 8 After Party at The Circuit — Register Now!

The RVAsec 8 after party brought to you by RVAsecRisk Based Security, and GuidePoint Security, will be at the awesome Circuit Arcade Bar on Wednesday, May 22nd, right after the conference!

This is an exclusive event with limited availability, so you must be registered to attend or you will not be allowed entrance–no exceptionsRVAsec registration does not guarantee a spot at the after party.

Important Notes:

  • You must use the same email you used to register to RVAsec.
  • Each attendee must have his/her own name listed (duplicates will be deleted).
  • If you are not registered for RVAsec,  your ticket will be deleted.

Wed, May 22, 2019
5:30 PM – 7:30 PM

The Circuit is located at:

3121 W. Leigh St
Richmond, Virginia 23230

The Circuit is an arcade bar in the Scott’s Addition Beverage District of Richmond, VA. We have a growing family of 70 arcade games, pinball machines, and skeeball lanes, as well as a forever rotating 50-tap beer wall boasting both local and national favorites.

This is an exclusive event with limited availability, so you must be registered to attend and bring your RVAsec badge or you will not be allowed entrance–no exceptions!

Even if you have a ticket for RVAsec and said that you wanted to attend during the signup process, you MUST now registered for the party!

Register Now!

Speaker Feature: Kashish Mittal


Kashish Mittal is a Security Researcher and Engineer. He currently is the Head of Security at MileIQ, a Microsoft startup. He has worked for companies such as Elevate Security, Duo Security, Bank of America, Deutsche Bank etc. By choice, he is an ethical hacker and an addicted CTF player. He is a member of PPP (CMU’s elite CTF group). Prior to joining Duo, he did Security Research at Cylab, Pittsburgh. He has a BS and a MS from Carnegie Mellon University with a focus on Security. He is passionate about delivering Security awareness and training for employees, college students and high schoolers etc. He has been invited to presented his research and work at various national and International Security conferences.

One Man Army – Playbook on how to be the first Security Engineer at a company

How often have you heard that ‘Early stage startups don’t care much about Security because if there is no product, there is nothing to secure?’ Although there is merit in the argument that startups need to build product so as to sustain and grow, it often puts the person in charge of securing them in a tricky position. For most startups, this person is the first Security Engineer who can be somewhere between the 10th to 300th employee. By the time the first Security Engineer is on-boarded the attack surface has usually become quite large and he or she faces an uphill battle to go about securing the organization. In such cases, the Security Engineer needs to perform as a ‘one-man army’ keeping the attackers at bay. In this talk, i will present a playbook on how to perform as one.

Come see Kashish at RVAsec! Register now.