Andrew Hendela

• Video: RVAsec 2023: Andrew Hendela – Software Bills of Behaviors: Why SBOMs aren’t enough
• Slides: https://rvasec.com/slides/2023/Hendela_Andrew-SBOM_rvasec_12.pdf
• Twitter: @zelkathak

Most software supply chain-related tools fall into a few categories: SBOM generation, vulnerability analysis, build policies, and source-code analysis. These do not address the problem exemplified by the SolarWinds supply-chain malware insertion attack. Software Bills of Behaviors provide an understanding of what the software is doing and how it has changed providing a defense against Solarwinds-style attacks.

About Andrew – Andrew has over a decade of cybersecurity experience leading teams tackling hard challenges. His technical expertise involves automating a wide range of problems, including cyber attribution, malware analysis, and vulnerability research.

Drew Schmitt

• Video: RVAsec 2023: Drew Schmitt – Ransomware Rebranding … So Hot Right Now!
• Slides: https://rvasec.com/slides/2023/Schmitt_Drew-Ransomware_Rebranding.pdf
• Twitter: @5ynax

Ransomware rebranding is becoming a common technique that ransomware groups are leveraging to obfuscate their operations and remain under the radar. From high-profile groups like Evil Corp to groups like AlphV and Blackbyte, the rebranding process has provided viable solution for extending operational capabilities after high profile attacks. This talk will examine rebranding trends since 2020 and provide a thorough review of the impacts ransomware rebranding has had on the operational capacity of multiple ransomware groups. Lastly, this talk will analyze methods that threat intelligence analysts can utilize to compare traits and behaviors between ransomware groups to determine if the group is a likely rebrand or a new group altogether.

About Drew – Drew Schmitt is the GuidePoint Research and Intelligence Team Lead Analyst and is responsible for coordinating threat research, malware analysis, and operationalized intelligence teams. Drew is especially fond of malware research and reverse engineering. When not neck deep in malware, he loves to create new and open-source tools and improve his techniques and capabilities. Drew is also an avid teacher and mentor, and really enjoys helping other people realize their love of malware, threat intelligence, and–above all–making threat actors’ lives harder. In past lives, Drew spent time as an incident responder, threat hunter, and IT administrator.

Brendan O’Leary

• Video: RVAsec 2023: Brendan O’Leary – Shakespeare, Bacon, and the NSA
• Slides: https://rvasec.com/slides/2023/Oleary_Brendan-Shakespeare_Bacon_and_the_NSA.pdf
• Twitter: @olearycrew

The peculiar story of the history of cryptography – featuring a code-breaking Quaker poet

About Brendan – Brendan O’Leary is Head of Community at ProjectDiscovery. He spends his time connecting with developers, security engineers, contributing to open source projects, and sharing his thoughts on cutting-edge technologies on conference panels, meetups, in contributed articles and on blogs.

Aliscia Andrews

• Video: RVAsec 2023: Aliscia Andrews – Cyber, the Commonwealth and You
• Slides:
• Twitter: @alisciaandrews

Discussion on the importance of a whole of government approach to cyber.

About Aliscia – Aliscia Andrews started her Homeland Security career more than 15 years ago while serving as an Intelligence Analyst and Weapons and Tactics Instructor for the United States Marine Corps. After the Marine Corps, Mrs. Andrews completed her MBA and Cybersecurity Management Certificate from Georgetown University.

After her time in the Marine Corps, Mrs. Andrews, continued honing in her analytical tradecraft in both the public and private sector. Her work portfolio has focused primarily on finding complex solutions to challenging Government problems as a strategic management, analytic, and cyber policy advisor in support of multiple government agencies both in and out of the Intelligence Community.

Today Mrs. Andrews is proud to be the Deputy Secretary of Homeland Security for the Commonwealth of Virginia. She continues to serve her community as a member and volunteer on multiple PTOs, disadvantaged children’s groups, church ministry groups, youth sports leagues, and mentors transitioning Veterans. Deputy Secretary Andrews resides in Aldie, Virginia with her Husband and three children.

Fletcher Davis

• Video: RVAsec 2023: Fletcher Davis – Context Matters: Tailoring Tradecraft to the Operational Environment
• Slides: https://rvasec.com/slides/2023/Davis_Fletcher-Context_Matters_Tailoring_Tradecraft_to_the_Operational_Environment.pdf
• Twitter: @gymR4T

With the advancements in defensive capabilities, from endpoint protection to user behavior analytics, operating within mature environments has become more difficult than ever. However, with each of these capabilities comes constraints that Red Teamers can abuse to shift the operational asymmetries and increase their strategic advantage. This talk will discuss how Red Teamers can shift their current operational mental models to abuse these constraints to blend-in more naturally within environments as they seek to complete target objectives.

About Fletcher – Fletcher is currently a Senior Red Team Consultant at CrowdStrike, specializing in Adversary Simulation operations and Offensive Security research.

David Girvin

• Video: RVAsec 2023: David Girvin – Hacking your Job? Trying to cheat at life with ChatGPT
• Slides: https://rvasec.com/slides/2023/Girvin_David-HackGPT.pdf

AI, it’s all the buzz. We have seen marketing fraudsters at Black Hat called out. Heard sales people use every buzzword they can to try and close. So is it all smoke and mirrors? Or maybe there is pragmatic use for this upcoming technology. I have taken ChatGPT and treated it like an offensive security lab. I trialed many different approaches to using it. In this talk I will show where it can add value in a technical, business and sales role. I will also show how it can fail miserably, it’s security concerns and how its influenced. Will this take your job or add to it? Find out in my talk.

About David – Hacker, BJJ enthusiast, world traveler and surfer. I am a giant weirdo who somehow found my niche in offensive security. I have been blessed getting to build AppSec programs for companies like 1Password and Red Canary. I have an extremely diverse background and hope I can relate and or add value to everyones experience,

Josh Cigna

• Video: RVAsec 2023: Josh Cigna – Everything you never knew you wanted to know about Passkeys
• Slides: https://rvasec.com/slides/2023/Cigna_Josh-Everything_You_Never_Knew_You_Wanted_to_Know_About_Passkeys.pdf
• Twitter: @Sporksan

Passwords have long been the bane of user, IT support staff & security professional. Compromised passwords are the leading source of account takeover and system breach, attackers are simply logging in and no longer breaking in! Solutions in the past have always come with caveats, but with the inclusion of Passkeys into most major operating systems and platforms a true light may be at the end of the tunnel. Join this panel to learn about the sorted history of passwords, current and developing trends with passwordless authentication, and what the best practice for Passkeys looks like!

About Josh – Josh Cigna is a solutions architect at Yubico focused on supporting enterprises on the impacts of regulations, requirements, and the latest authentication technologies. He is passionate about evangelizing user focused security solutions—advising organizations that user experience should be a key consideration alongside risk mitigation and meeting compliance mandates. Joshua’s experience includes the definition, design and implementation of IAM processes and programs. Prior to Yubico, he held technical positions at Thomson Reuters and Capital One and holds a CISSP certification.

Denis Mandich

• Video: RVAsec 2023: Denis Mandich – Quantum Cybersecurity
• Slides: https://rvasec.com/slides/2023/Mandich_Denis-Quantum_Impact.pdf

The advent of quantum computers promises to have profound economic impact because they solve lucrative industry problems that are otherwise impossible. The dark side is the consequences to global cybersecurity and the encryption systems fundamental to almost every aspect of our digital lives, including the cyber tools needed to protect them. Although 1970s-era PKI infrastructure has served us well for decades, it provides no assurance against the threat of “harvest now, decrypt later”. The transition to post quantum cryptography standards must be accompanied by more advanced techniques to ensure durable privacy, which is now a national economic security imperative. Fortunately, new redundant hardware and software solutions eliminate the single point of attack and failure in our business critical systems.

About Denis- CTO and Co-founder of Qrypt
Founding member of the Quantum Economic Development Consortium (QED-C)
Founding member of the Mid-Atlantic Quantum Alliance (MQA)
ANSI Accredited Standards Committee X9
ITU Telecommunications Standardization Sector (ITU-T)
Forbes Technology Council
Quside board member
20-year USIC veteran
Physicist

Qasim Ijaz

• Video: RVAsec 2023: Qasim Ijaz – Feature or a Vulnerability? Tale of an Active Directory Pentest
• Slides: https://rvasec.com/slides/2023/Ijaz_Qasim-Feature-or-Vulnerability_rvasec_12.pdf
• Twitter: @hashtaginfosec

This talk is a summation of stories from my recent penetration tests inside Active Directory networks. I will use this time to discuss common methods I have used to obtain initial access inside Active Directory environments, the features that paved the way to lateral movement, and vulnerabilities that escalated me to Domain Admin. This talk is laid out in a way that benefits both entry-level and experienced penetration testers. The content is for both blue and red teamers looking to better understand common Active Directory configurations that can lead to compromise. It has everything from memes to kerberoasting, with a pinch of humor (no dad jokes, I promise).

About Qasim – Qasim “”Q”” Ijaz is a Director of Offensive Security at Blue Bastion Security and specializes in healthcare security and penetration testing. He has conducted hundreds of penetration tests in small to large environments with a focus on networks and web applications testing. His areas of interest include healthcare security, Active Directory, cybersecurity policy, and the “”dry”” business side of hacking. Qasim is a penetration test lead during the day and a teacher in the after-hours. Qasim has presented and taught at cybersecurity conferences including BSides and Blackhat on offensive security topics. He currently teaches a bootcamp on Offensive Security Certified Professional (OSCP) certification.

Andrew Skatoff

• Video: RVAsec 2023: Andrew Skatoff – Maturing your Threat Hunting Operations
• Slides: https://rvasec.com/slides/2023/Skatoff_Andrew-Maturing-Hunt-Ops.pdf
• Twitter: @dfir_tnt

This talk will present a roadmap for designing a mature threat hunting service. A maturity model will be shared, along with prerequisites and incremental steps along the way.

Having built the Threat Hunting service at the Federal Reserve, I will share our journey, recommend approaches and resources, and provide a path for listeners to follow to do the same.

About Andrew – Andrew has been securing and protecting critical infrastructure networks since 2002.

Raised by a Topgun Marine fighter pilot and a middle school special education teacher, Andrew was always driven to find meaningful work, solve interesting problems and help others do the same in an effort to make the world a better and safer place.

His love for computers started in college and after spending several years providing tech support in the energy and financial sectors, he achieved his MCSE certification. This led to his first information security job supporting a migration to active directory. Andrew then went on to champion, design and implement an automated compliance and vulnerability management program.

Andrew has been developing and leading incident response, malware analysis, threat hunting and digital forensics services for the past 18 years in critical infrastructure financial organizations.

He currently holds GREM, GCFA, GDAT, GNFA and CISSP certifications and serves as an Cybersecurity Senior Manager at a large financial organization.

Dwayne McDaniel

• Video: RVAsec 2023: Dwayne McDaniel – Who Goes There? Actively Detecting Intruders With Cyber Deception Tools
• Slides: https://rvasec.com/slides/2023/McDaniel_Dwayne-Who_Goes_There_Actively_Detecting_Intruders_With_Cyber_Deception_Tools.pdf
• Twitter: @mcdwayne

Ever wish you could set traps for intruders in your environment? While you can’t rig explosions or rolling boulders when someone attacks your servers, you can set up false credentials that trigger alarms you can act against. That is the whole idea behind honeytokens!

Come to this session to learn how honeytokens work

About Dwayne – Dwayne has been working as a Developer Relations professional since 2015 and has been involved in tech communities since 2005. He loves sharing his knowledge, and he has done so by giving talks at over a hundred events worldwide. Dwayne currently lives in Chicago. Outside of tech, he loves karaoke, live music, and performing improv.

Andrea Matwyshyn

• Video: RVAsec 2023: Andrea Matwyshyn – Cybernation: The FUD, Facts, and Future of Software Liability and Security
• Slides:
• Twitter: @amatwyshyn

When the 2023 National Cybersecurity Strategy called for “shifting liability to promote secure development practices,” the response from the security (and legal) community often overstated the novelty of the proposal. We have already been living with (various forms of) software liability for confidentiality, integrity, and availability failures for over two decades. This talk clarifies the legal landscape of both what already exists and the likely paths for the future. Cautioning against various security dystopias including Hannah Arendt’s “cybernation,” this talk offers suggestions on buildouts to existing threat modeling frameworks to explicitly consider factors used by courts and regulators to determine liability. These buildouts can better align the security team and in-house counsel in a joint defensive enterprise. But, two scaling issues will remain: the need for a technology regulator of last resort (a “TRoLR”) and a security community-driven model of professionalism.

About Andrea – Dr. Andrea Matwyshyn is a full professor in the law school and engineering school at Penn State, the Associate Dean of Innovation at Penn State Law, and the founding faculty director of both the Penn State PILOT Lab (Policy Innovation Lab of Tomorrow), an interdisciplinary technology policy lab, and the Manglona Lab for Gender and Economic Equity, a technology equity lab and clinic.

She has also worked in both the private and public sector, most recently in 2023 as a Senior Special Advisor on Information Security and Data Privacy to the U.S. Consumer Financial Protection Bureau’s Office of Enforcement and a Senior Special Advisor on Law, Technology, and the Digital Economy to the U.S. Federal Trade Commission’s Bureau of Consumer Protection. Her first hackercon talk was at BlackHat USA in 2003, and she has previously served as a specialty reviewer on the DEF CON CFP Review team.

Luke McOmie

• Video: RVAsec 2023: Luke McOmie – “”A programmatic approach to enterprise security”” OR “”How to not waste your security budget on sh!7 that doesn’t matter!””
• Slides: https://rvasec.com/slides/2023/McOmie_Luke-Programmatic_Approach_to_Enterprise_Security.pdf
• Twitter: @lmcomie

This fast paced, poking fun at ourselves presentation, tells a story through examples of how a majority of companies are fixated on old industry “”worst practices””. As we wander though the twisted road of things that we do THAT WE SHOULDN’T, the audenice will likely find themselves thinking differently about how the approach enterprise security programs, have a chance to laugh at how human we all are, and walk away with a new perspective.

About Luke – Mr. McOmie started in offensive security in 1994 and is a trusted advisor, security leader and mentor. With a career focus in offensive security and a strong technical background, he is recognized for his excellence in developing and executing enterprise security strategies and leading technical and tactical programs. He has founded and contributed to several industry leading organizations over his career including start ups, fortune 100 enterprises, and federal agencies. As an extrovert, he passionately supports the information security community, is a featured speaker at various conferences, a published author, and an industry liaison for many businesses and organizations.

Specialties: Security Leadership & Program Development, Security Service Practice & Team Direction, Red Teaming, Ethical Hacking, Penetration Testing, Social Engineering, Physical Security, Assessments, Incident Response, Compliance. By leveraging these talents and his experience, Mr. McOmie guides companies and executive leaders to understand the importance of, communicating the need for, and addressing the challenges that it takes to create and maintain a strong security posture.

Scott Small

• Video: RVAsec 2023: Scott Small – Adversary TTP Evolution & the Value of TTP Intelligence
• Slides: https://rvasec.com/slides/2023/Small_Scott-Adversary_TTP_Evolution.pdf
• Twitter: @IntelScott

Awareness of the benefits of behavior-focused defense is growing, and more intelligence around adversary tactics, techniques, and procedures (“”TTPs””) is available now than ever. However, as major adversaries increasingly modify their TTPs, teams struggle to track and manage the rising volume of TTP intel. We’ll review recent examples of adversary TTP evolution, including ransomware and commodity loader case studies, a summary of the TTP intelligence landscape, and guidance on effective intelligence collection, processing, and application for defenders.

About Scott – Scott Small is a security & intelligence practitioner and expert in cyber threat intelligence & threat modeling, open source research & investigations, and data analysis & automation. He currently serves as Director of Cyber Threat Intelligence at Tidal Cyber. Scott has advised enterprise and public sector security teams across maturity levels on technical and strategic applications of intelligence and on using technology to help identify and mitigate organizational risk. Throughout his career, he has briefed and trained large and small audiences and has presented original content at major security conferences, including DEFCON, FIRSTCON, MITRE ATT&CKcon, & BSides, and ISAC & other industry events.

Scott is an active member of the professional security & intelligence communities and a proponent of open-source information for upskilling and strengthening our collective security. In addition to contributing to community projects, he has published independent projects that aggregate and streamline publicly accessible security resources, as well as his own original tools & resources.

Dan Han

• Video: RVAsec 2023: Dan Han – Beyond the pandemic: How the pandemic shaped organizations and their security architecture
• Slides: https://rvasec.com/slides/2023/Han_Dan-Beyond_The_Pandemic.pdf
• Twitter: @sensubeans

How did the pandemic affect your organization and how it operates? Does you current security model still work with your organization? This talk explores how an organization transformed its security architecture throughout and after the pandemic.

About Dan – Dan is the Chief Information Security Officer for VCU. He has over 20 years of experience working in IT and information security.

Amelia Szczuchniak

• Video: RVAsec 2023: Amelia Szczuchniak – Why You Can’t Call the Police
• Slides: https://rvasec.com/slides/2023/Szczuchniak_Amelia-Why_You_Cant_Call_The_Police.pdf

Let me tell you a story about what it’s like as a lawfirm’s investigator to try to get justice for someone after they’ve been robbed online. The problem starts with finding the perpetrator. We will walk through the process of investigating crypto hot wallets and NFTs while we collect electronic evidence with proper chain of custody to prove a theft occurred. Then I’ll show you how we need to dox and hack our way through the web of forums and social networks to uncover an anonymous suspect. Again, keeping proper, court-admissable evidence. I’ll introduce you to the AI tools and automation we built to capture and search huge volumes of discussions and videos the moment they appear in many of the popular social networks and forums. Finally, I’ll end the tale with who we found and how we sent the police to their home to get justice. But it’s not a happy ending.

About Amelia – Amelia is a security analyst working for ISECOM. From the beginning of her path in the cybersecurity industry, she’s been working with and learning from acknowledged professionals. This gave her a strong foundation and a set of skills that she intends to greatly expand. On a daily basis, she works with electronic evidence, collecting and analyzing it while maintaining the chain of custody. She conducts cyber investigations. She is also a cybersecurity trainer for the military and the Hacker Highschool project.

Kate Collins

• Video: RVAsec 2023: Kate Collins – This is the Way: A New Leadership Creed for Info-Sec professionals
• Slides: https://rvasec.com/slides/2023/Collins_Kate-This_is_the_Way.pdf

With fun and powerful examples from Disney’s The Mandalorian, InfoSec professionals will explore the new and different leadership skills required after the immense changes in the past few years. Global events including the pandemic, inflation, supply chain problems, digital transformation, and political turmoil, have caused new pressures, new threats, and changes moving faster than an N1-starfighter in hyperspace!

Explore the latest research and trends in leadership, discuss the impacts on the InfoSec industry, and refresh your leadership creed. People leaders, technical experts and InfoSec professionals at all levels will be challenged to assess their current leadership strengths and discover new ways to stretch and develop skills to meet the intense demands in Cyber leadership today and beyond. This is the Way!

About Kate – Kate Collins has over 28 years of leadership experience from front-line supervisor to CHRO, is a PCC executive coach, HR consultant, and leadership development expert. For the last 10 years, Kate has served as a leadership coach to Cyber, IT, Healthcare, Government, Academic, Insurance, Retail, and Finance professionals and has created custom leadership development programs for clients including a cyber-specific program Guidepoint Security. Other coaching client organizations include: Snowflake Inc., Guidepoint Security, DoD, Navy Federal Credit Union, Inova Health, Children’s National Hospital, StubHub, UFCW, and eOffices, Inc.
Additionally, Kate partners with a neuroscientist to support Healthcare and Cyber organizations in recovering from and preventing burnout. Kate travels nationally, and lives in Richmond, Virginia with her husband (a Cyber-professional), daughter, and 4 (yes, 4) dogs.

Colin Estep

• Video: RVAsec 2023: Colin Estep – Insiders packing their bags with your data
• Slides: https://rvasec.com/slides/2023/Estep_Colin-Insider-Threats_rvasec_12.pdf
• Twitter: @colinestep

What if your organization could discover which of your employees are exfiltrating data prior to leaving? We analyzed the behavior of more than 3 million users, and will present the insights found for employees preparing to leave, the nature and quantity of the data they target, and the services they use.

About Colin – Colin Estep is currently a threat researcher at Netskope focused on developing user and entity behavior analytics for cloud environments. Colin was previously the CSO at Sift Security (acquired by Netskope), where he helped create a product to do breach detection for IaaS environments. He was a senior engineer on the security teams at Netflix and Apple before joining Sift.
Prior to Apple, he was an FBI Agent specializing in Cyber crime. As an Agent, he spent a fair amount of time coordinating with other countries to locate and arrest malware authors and botnet operators.

Kevin Massey

• Video: RVAsec 2023: Kevin Massey – Heap Exploitation from First Principles
• Slides: https://rvasec.com/slides/2023/Massey_Kevin-Heap_Exploitation_From_First_Principles.pdf
• Twitter: @Scratchadams118

In this talk I will discuss the process of building a userland heap allocator, identify the inherent vulnerabilities that exist in heap allocation, and demonstrate methods to exploit these vulnerabilities.

About Kevin – I am a security analyst who does independent security research. I focus on vulnerabilities, binary exploitation, and network protocols.

Jason Wonn

• Video: RVAsec 2023: Jason Wonn – Corporate Dungeon Master: How to Lead Cyber Games at Work
• Slides: https://rvasec.com/slides/2023/Wonn_Jason-Corporate_Dungeon_Master_Lead_Cyber_Games_at_Work.pdf
• Twitter: @wonnmeister

Military organizations have long known the value of “training as you fight”, but commercial entities only realized its importance in the last few years. Consequently, the Cyber Action Officer role recently became a priority for the average company. Are you a security-geek like Jason Wonn who loves role-playing games (RPGs) and want the opportunity to lead a party through incident response to the most prevalent cyber threats? In this original talk, discover how to lead games (table-top exercises) at work as a “Corporate Dungeon Master” (Cyber Action Officer), narrating the story (facilitation), controlling the monsters (cyber threats), and creating an adventure that will have your players leveling-up (process improvement).

About Jason – Jason Wonn is a results-focused information security leader with 30+ years of combined national intelligence, information assurance, and cyber threat intelligence expertise throughout the civilian and military sectors. Jason is a “Richmonder” but works for Navy Federal Credit Union in Vienna, VA. He currently serves as a Cyber Action Officer, delivering table-top exercises and serving as a trusted incident response advisor to leadership during cyber crises. Prior to this position, Jason led the development of a cyber threat intelligence capability at both Navy Federal and The Walt Disney Company. He also served in various threat intelligence roles as a government contractor with MITRE, Lockheed Martin, and CGI Federal in support of the FBI and 1st IO Command, US Army. He holds a B.S. in Computer Science from Tarleton State University in Texas, and the CISSP and PMP industry certifications.