Instructor: Pete Herzog

Get a grip on the risk caused by your vendors, cloud, software
providers, partners, and other third parties you need to work with.
Manage it in an orderly way that doesn’t overwhelm you or become the
paperwork that sucks the life out of your job. Master it so you can
make sure the people in charge of those relationships can also help
you manage the security of those 3rd parties. This provides you with
the means and the toolkit you need to do it in a practical,
responsible, and secure method.

The class is divided in 2 parts. The morning will cover how Vendor
Risk Management works:

Part 1
What makes up Vendor Risk Management?
Decision-making for Vendors, Products, Cloud, and more
Techniques for Risk, Trust, and Security Analysis
Managing compliance, the four-letter-word with too many letters

Part 2
Working with the toolkit (web or iphone app).
Hands on- risk management techniques for:
– software
– vendors
– cloud
How to address new tech or new vendor types.
The finale: making your choice from solid facts.

Attendees will take home new, exclusive software tools and checklists
that will let them do amazing things in risk analysis.

About The Instructor

Pete (@peteherzog) is an expert at security tactics orchestrating
operations to fit strategy. As such he is able to solve very complex
security problems across many technologies and then teach and enable
his clients to do the same. He is best known as the creator of the
OSSTMM and Hacker Highschool. He is the co-founder and Managing
Director of ISECOM, a security research non-profit focused on
innovation. You can read about his background:
http://en.wikipedia.org/wiki/Pete_Herzog

His full profile can be found here: www.linkedin.com/in/isecom/.

Here are details about his work in Trust and Neuro-hacking:
http://en.wikipedia.org/wiki/Social_engineering_(security)#Pete_Herzog

Title: Vendor Risk Management and Trust Analysis
Instructor: Pete Herzog
Date: 6/3/2015, 9AM-5PM
Cost: $350
Class Size: 25 seats are available total

Prerequisites: None.

Class Requirements: None.

Register for this Class

Instructor: Schuyler Towne

Get comfortable with basic lockpicks, open some security pinned locks (and possibly high security), and have an understanding of Pin Tumbler, Wafer and Disc Detainer locks.  Learn the baseline knowledge to plan your own facility security, and get a number of excellent references to help continue your study.

The focus will be on Pin Tumbler locks, as they are what a North American audience will encounter most often. You will begin picking these locks early and get plenty of practice with access to the instructor’s lock library, including various specially prepared mid- and high-security locks. From there you will branch out to other locking concepts, and gain an understanding of a wide range of lock types, from safes to magnetics, with particular attention to Wafer and Disc Detainer locks as they are also quite common in the US. The basics of facility security, including what to look for in modern digital locks, will also be covered.

About The Instructor

Schuyler Towne is obsessed with locks. While he got his start picking locks competitively, his interest has since exploded into every aspect of their history, design and manipulation. He’s taught hackers, authors, cops and even toy designers. There is nothing Schuyler loves more than to talk locks with anyone who will listen. His interests in the history of physical security and design of locks provides a passionate background to his lectures and workshops on lockpicking. Currently he is writing an Almanac of Locksport for O’Reilly and studying media portrayals of lockpicking.

Title: Hands-On Lock Picking

Instructor: Schuyler Towne
Date: 6/3/2015, 9AM-5PM
Cost: $250.00
Class Size: 20 seats are available total

Register for this Class

Praise for Schuyler Towne’s Class

“I attended Schuyler Towne’s lock picking class at RVAsec a few years ago, and it was bloody amazing. Literally…. it drew blood. This was hands-down and in cuffs one of the best classes I’ve ever attended. Schuyler is very passionate about what he does and incredibly skilled at not only picking locks (though he still has to successfully pick the Ruko locks I gave him), but also passing on his knowledge in an exciting and entertaining manner. Whether you’ve never picked a lock in your life (just like I hadn’t) or quite skilled at it, you will definitely learn something from this class. Challenges are tailored to each attendee’s skillset, and there are both simple locks, advanced locks, digital locks, handcuffs, and combination locks to play with. I definitely recommend this class.”

– Carsten E

“I think the classes [lock picking] are fascinating and valuable whether you’re a hobbyist, or if physical security testing is in (or you want it to be) your job description. Schuyler’s passion for research, and his presentation style really make the whole experience a joy.”

– Nick P

Instructor: Gregory Bell

Over the last decade, the number of crimes that involve computers has grown, spurring an increase in companies and products that aim to assist law enforcement in using computer-based evidence to determine the who, what, where, when, and how for crimes. As a result, computer and network forensics has evolved to assure proper presentation of computer crime evidentiary data into court.

Digital forensic techniques can be used for many purposes, such as investigating crimes and internal policy violations, reconstructing computer security incidents, troubleshooting operational problems, and recovering from accidental system damage. Practically every organization needs to have the capability to perform digital forensics.  However, organizations current incident response policies and procedures do not contain clear statements addressing all major forensic considerations, such as contacting law enforcement, performing monitoring, and conducting regular reviews of forensic policies and procedures.

An accepted definition of “Incident Response” is:

Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs. An incident response plan includes a policy that defines, in specific terms, what constitutes an incident and provides a step-by-step process that should be followed when an incident occurs.

An acceptable definition of “Computer Forensics” is:

Computer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law.

This class will show attendees the basic phases of the forensic process and incident response considerations, how to better integrate Computer (Digital) Forensics into their current Incident Response plan and Information System life cycle, and the tools and skill sets used to support computer forensics.  For instance, when employees are terminated does Human Resource notify Information Security to preserve the terminated employee’s hard drive in the event litigation occurs at a later date?

About The Instructor

Currently, I am the ISO for the Department of Behavioral Health and Development Services.  In addition, I teach Information Security courses at several colleges as an Adjunct (VCU, University of California, South University, University of Phoenix, Stratford University).  As a Computer Forensic expert, I have handled several high profile cases in the Central Virginia area and provided testimony as an Expert Witness in those cases.

Title: Integrating Computer Forensics with Incident Response
Instructor: Gregory Bell
Date: 6/3/2015, 9AM-5PM
Cost: $300.00
Class Size: 25 seats are available total

Prerequisites: Working knowledge of incident response and some knowledge of computer forensics are helpful.

Class Requirements: None.

Register for this Class

Instructor: Kizz Myanthia

This course will introduce the attendees to the concepts of Information Security, the security issues that plague all applications today, learn how to create an attack strategy, and execute against the problem. This course will encompass both common and easily exploitable vulnerabilities and the more advanced or custom exploits and techniques that attackers use in the real world. We will discuss what motivates an attacker, what the types of mindsets are, and what tools they will most likely use. “The White Whale” will give the attendee an opportunity to learn the fundamentals of Information and Application security through hands on training and QA Lecture. We will work to understand both application and host vulnerabilities and exploits. This class will not only guide a novice tester or admin into the mindset of an attacker, but will give the advanced tester a deeper understanding of IS and application security issues and how to detect, attack, and defend against them.

All students will leave with an in-depth understanding of not only why and how these vulnerabilities are found, but also all of the tools and techniques needed to execute them.

Host/Server

• Protocol Issues
• Platform or Host Vulnerabilities (Services and Ports)

Web Applications

• OWASP Top 10 Vulnerabilities (Understanding and Exploitation)Attack the User
• MITM (Session Hijacking, Snooping, Sniffing)
• Leveraging the information gained to impersonate an authorized user- Phishing Attacks (How to clone and impersonate a site, Click-jacking, Custom Java code embedding and execution

About The Instructor

Infosec specialist whose qualifications include an indepth understanding of security principals and practices; C|EH, MCSE+Security designations; and detailed knowledge of security tools, technologies and development. Seven years of security experience in the creation and deployment of solutions protecting networks, systems and information assets for diverse companies and organizations, with over 10 years overall in the industry.

Title: Hunting The White Whale – Offensive Application Pentesting
Instructor: Kizz Myanthia
Date: 6/3/2015, 9AM-5PM
Cost: $300.00
Class Size: 20 seats are available total (register early!)

Prerequisites: This course is most useful for anyone that wants to learn how the “Hacker” mindset works, the Information Security administrator, Pentester, or anyone else that wants to gain the knowledge of how a malicious Hacker executes successful attacks. This class is focused on real-world issues and will focus on having the student use the techniques to understand each step.

Class Requirements: Your own laptop with a Virtual Instance of Kali Linux (the instructor can’t provide tech support) and a moderate understanding of PenTesting vocabulary.

Register for this Class