Speaker Feature: Colin Estep

Colin Estep is currently a threat researcher at Netskope focused on developing user and entity behavior analytics for cloud environments. Colin was previously the CSO at Sift Security (acquired by Netskope), where he helped create a product to do breach detection for IaaS environments. He was a senior engineer on the security teams at Netflix and Apple before joining Sift.
Prior to Apple, he was an FBI Agent specializing in Cyber crime. As an Agent, he spent a fair amount of time coordinating with other countries to locate and arrest malware authors and botnet operators.

Twitter: @colinestep

Insiders packing their bags with your data

What if your organization could discover which of your employees are exfiltrating data prior to leaving? We analyzed the behavior of more than 3 million users, and will present the insights found for employees preparing to leave, the nature and quantity of the data they target, and the services they use.

Come see Colin at RVAsec 12!

RVAsec 2023


Speaker Feature: Fletcher Davis

Fletcher is currently a Senior Red Team Consultant at CrowdStrike, specializing in Adversary Simulation operations and Offensive Security research.

Twitter: @gymR4T

Context Matters: Tailoring Tradecraft to the Operational Environment

With the advancements in defensive capabilities, from endpoint protection to user behavior analytics, operating within mature environments has become more difficult than ever. However, with each of these capabilities comes constraints that Red Teamers can abuse to shift the operational asymmetries and increase their strategic advantage. This talk will discuss how Red Teamers can shift their current operational mental models to abuse these constraints to blend-in more naturally within environments as they seek to complete target objectives.

Come see Fletcher at RVAsec 12!

RVAsec 2023


Speaker Feature: Mark Arnold

Mark Arnold has a 20+ cybersecurity career, serving 8 of those years in leadership roles. As a transformational leader, Mark has built security teams and programs, authored maturity model blueprints, and implemented security domain practices at large enterprises and service providers. Mark’s areas of interest include cloud security, threat intelligence, and vulnerability research, nation-state attack methods and related activities (e.g. information operations and disinformation campaigns), and their collective impact on nations and society. He holds industry certifications and degrees from Stanford, Princeton Seminary, and Harvard University. He is a former competitive gymnast and an ordained minister but, most importantly, a husband and dad.

Twitter: @lotusebhat

TOP 5 CISO FINDINGS OF 2022

Throughout 2022, the Lares® Advisory Services team has tracked emerging trends while assisting organizations of various sizes and maturity with Virtual CISO, IT/OT Risk Assessments, Offensive Assessments, and Security Program Management engagements. TOP 5 CISO Findings (most frequently observed not necessarily the most severe) resulted from our tracking. This presentation unveils the findings, discussing them in the context of current and emerging threats. I also incorporate an MIT Sloan cybersecurity use case and the Verizon DBIR to expound on the findings.

We close out the talk by listing remedies for the Top 5 Findings. A sampling of remedies includes the selection of a framework, threat modeling, and tactical assessments to help organizations discover and avoid the risks associated with the Top 5 Findings.

Come see Mark at RVAsec 12!

RVAsec 2023


Speaker Feature: Rick Lull

Rick Lull:
Lifelong geek turned security consultant after stops as a desktop tech, server bubba, and network jockey. Rick is a healthcare IT survivor, and is now playing Horatio on the bridge for hire with a local technology consulting company, advising clients on security strategy and operations. He currently holds CISSP, CCNP-Security, NSE7 and NSE4 certifications and previously held CEH and CNA certifications. He has promised to not make fun of any manufacturers during his talk.

Network 201: A Tour Through Network Security

Taking the Network 101 presentation in 2019 a bit further, this talk will dive into network security aka technical security controls that should be considered with respect to risk management in common environment, including private/public cloud and the recent industry buzz words around ZTNA – Zero Trust Network Access.
If you have ever wondered how you might use a VRF to segment authenticated user traffic, this is a talk for you. If you are trying to cut through buzzwords that a sales guy is throwing your way about how to protect your remote workers, this is a talk for you.

Come see Rick at RVAsec 12!

RVAsec 2023


Speaker Feature: Andrea Matwyshyn

Andrea MatwyshynDr. Andrea Matwyshyn is a full professor in the law school and engineering school at Penn State, the Associate Dean of Innovation at Penn State Law, and the founding faculty director of both the Penn State PILOT Lab (Policy Innovation Lab of Tomorrow), an interdisciplinary technology policy lab, and the Manglona Lab for Gender and Economic Equity, a technology equity lab and clinic.

She has also worked in both the private and public sector, most recently in 2023 as a Senior Special Advisor on Information Security and Data Privacy to the U.S. Consumer Financial Protection Bureau’s Office of Enforcement and a Senior Special Advisor on Law, Technology, and the Digital Economy to the U.S. Federal Trade Commission’s Bureau of Consumer Protection. Her first hackercon talk was at BlackHat USA in 2003, and she has previously served as a specialty reviewer on the DEF CON CFP Review team.

Twitter: @amatwyshyn

Cybernation: The FUD, Facts, and Future of Software Liability and Security

When the 2023 National Cybersecurity Strategy called for “shifting liability to promote secure development practices,” the response from the security (and legal) community often overstated the novelty of the proposal. We have already been living with (various forms of) software liability for confidentiality, integrity, and availability failures for over two decades. This talk clarifies the legal landscape of both what already exists and the likely paths for the future. Cautioning against various security dystopias including Hannah Arendt’s “cybernation,” this talk offers suggestions on buildouts to existing threat modeling frameworks to explicitly consider factors used by courts and regulators to determine liability. These buildouts can better align the security team and in-house counsel in a joint defensive enterprise. But, two scaling issues will remain: the need for a technology regulator of last resort (a “TRoLR”) and a security community-driven model of professionalism.

Come see Andrea at RVAsec 12!

 


RVAsec 12 Speaker Announcements

We are pleased to announce the first batch of speakers for RVAsec 12!  Secure your ticket as prices increase on April 30.

While there are still more speakers to announce and the exact schedule is still coming, head over to https://rvasec2023.sched.com/directory/speakers to read more about each speaker and talk abstracts!

  • Andy Ellis – Keynote
  • Paul Asadoorian – Keynote
  • Adrian Amos – I <3 my password
  • Allen Jenkins – “Use your words” – to build an Information Security Program and fight Cyber Crime!
  • Amelia Szczuchniak – Why You Can’t Call the Police
  • Andrea Matwyshyn – Cybernation: The FUD, Facts, and Future of Software Liability and Security
  • Andrew Hendela – Software Bills of Behaviors: Why SBOMs aren’t enough
  • Andrew Skatoff – Maturing your Threat Hunting Operations
  • Brendan O’Leary – Shakespeare, Bacon, and the NSA
  • Colin Estep – Insiders packing their bags with your data
  • Dan Han – Beyond the pandemic: How the pandemic shaped organizations and their security architecture
  • David girvin – Hacking your Job? Trying to cheat at life with ChatGPT
  • Denis Mandich – Quantum Cybersecurity
  • Drew Schmitt – Ransomware Rebranding … So Hot Right Now!
  • Dwayne McDaniel – Who Goes There? Actively Detecting Intruders With Cyber Deception Tools
  • Fletcher Davis – Context Matters: Tailoring Tradecraft to the Operational Environment
  • Ian MacRae – The state of NIST/CMMC compliance today
  • Jason Wonn – Corporate Dungeon Master: How to Lead Cyber Games at Work
  • Josh Cigna – Everything you never knew you wanted to know about Passkeys
  • Kate Collins – This is the Way: A New Leadership Creed for Info-Sec professionals
  • Kenneth Broderick – Hunting for Evidence of Data Exfiltration: Dark Web, Digital Forensics, and Log Analysis
  • Mark Arnold – TOP 5 CISO FINDINGS OF 2022
  • Qasim Ijaz – Feature or a Vulnerability? Tale of an Active Directory Pentest
  • Rick Lull – Network 201: A Tour Through Network Security
  • Scott Small – Adversary TTP Evolution & the Value of TTP Intelligence
  • Luke McOmie – “A programmatic approach to enterprise security” OR “How to not waste your security budget on sh!7 that doesn’t matter!”
  • Kevin Massey – Heap Exploitation from First Principles

Stay tuned for some additional speaker announcements coming soon!

We have a new layout this year with multiple tracks. Given some space requirements the exact schedule and room assignment will be more in flux than prior years at RVAsec.  More details to come very soon!

And if you haven’t got your ticket yet, the time to do so is now!  Prices go up in 11 days!

You can get tickets here: https://www.eventbrite.com/e/rvasec-2023-security-conference-tickets-411449104347


Andy Ellis (@csoandy) Keynote and Book Signing at RVAsec 2023!

We are pleased to announce that Andy Ellis will be keynoting RVAsec 2023 and he will also be doing a book signing!  We are not sure how many total copies of the book we will have available, the sooner you register the better chance you will be able to get a free copy!

Andy is the author of 1% Leadership. He is the Advisory CISO at Orca Security and the Operating Partner at YL Ventures, and is an advisor to several cyber security startups, including VulcanUptycsGripPerygeeVendictValencePiiano, and Eureka. He is the founder and CEO of Duha, a leadership development consultancy that brings training to people earlier in their careers.

Andy Ellis is a seasoned technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. In his twenty-year tenure at Akamai, Andy led the information security organization from a single individual to a 90+ person team, over 40% of whom were women. Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs,

Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision-making. Andy has received a wide variety of accolades, including the CSO Compass Award, Air Force Commendation Medal, Spirit of Disneyland Award, Wine Spectator Award of Excellence (for The Arlington Inn), and was the winner of the Sherman Oaks Galleria Spelling Bee. He was inducted into the CSO Hall of Fame in 2021.

He currently serves on Harvard University’s Visiting Committee to IT. After receiving a degree in computer science from MIT, Andy served as an officer in the United States Air Force with the 609th Information Warfare Squadron and the Electronic Systems Center.




Paul Asadoorian To Keynote RVAsec 2023!

This may seem like Déjà vu but a silly pandemic won’t stop us!

We are pleased to announce once again that Paul Asadoorian will be keynoting RVAsec!  Paul is the Founder & CTO of Security Weekly as well as a Principal Security Evangelist at Eclypsium.

Paul spent time “in the trenches” implementing security programs for a lottery company and then a large university. Paul is offensive, having spent several years as a penetration tester. He is the founder of the Security Weekly podcast network, offering freely available shows on the topics of information security and hacking. As Product Evangelist for Tenable Network Security, Paul built a library of materials on the topic of vulnerability management. When not hacking together embedded systems (or just plain hacking them) or coding silly projects in Python, Paul can be found researching his next set of headphones.