Andrew has over a decade of cybersecurity experience leading teams tackling hard challenges. His technical expertise involves automating a wide range of problems, including cyber attribution, malware analysis, and vulnerability research.

Twitter: @zelkathak

Software Bills of Behaviors: Why SBOMs aren’t enough

Most software supply chain-related tools fall into a few categories: SBOM generation, vulnerability analysis, build policies, and source-code analysis. These do not address the problem exemplified by the SolarWinds supply-chain malware insertion attack. Software Bills of Behaviors provide an understanding of what the software is doing and how it has changed providing a defense against Solarwinds-style attacks.

Come see Andrew at RVAsec 12!

Scott Small is a security & intelligence practitioner and expert in cyber threat intelligence & threat modeling, open source research & investigations, and data analysis & automation. He currently serves as Director of Cyber Threat Intelligence at Tidal Cyber. Scott has advised enterprise and public sector security teams across maturity levels on technical and strategic applications of intelligence and on using technology to help identify and mitigate organizational risk. Throughout his career, he has briefed and trained large and small audiences and has presented original content at major security conferences, including DEFCON, FIRSTCON, MITRE ATT&CKcon, & BSides, and ISAC & other industry events.

Scott is an active member of the professional security & intelligence communities and a proponent of open-source information for upskilling and strengthening our collective security. In addition to contributing to community projects, he has published independent projects that aggregate and streamline publicly accessible security resources, as well as his own original tools & resources.

Twitter: @IntelScott

Adversary TTP Evolution & the Value of TTP Intelligence

Awareness of the benefits of behavior-focused defense is growing, and more intelligence around adversary tactics, techniques, and procedures (“”TTPs””) is available now than ever. However, as major adversaries increasingly modify their TTPs, teams struggle to track and manage the rising volume of TTP intel. We’ll review recent examples of adversary TTP evolution, including ransomware and commodity loader case studies, a summary of the TTP intelligence landscape, and guidance on effective intelligence collection, processing, and application for defenders.

Come see Scott at RVAsec 12!

Kate Collins has over 28 years of leadership experience from front-line supervisor to CHRO, is a PCC executive coach, HR consultant, and leadership development expert. For the last 10 years, Kate has served as a leadership coach to Cyber, IT, Healthcare, Government, Academic, Insurance, Retail, and Finance professionals and has created custom leadership development programs for clients including a cyber-specific program Guidepoint Security. Other coaching client organizations include: Snowflake Inc., Guidepoint Security, DoD, Navy Federal Credit Union, Inova Health, Children’s National Hospital, StubHub, UFCW, and eOffices, Inc.
Additionally, Kate partners with a neuroscientist to support Healthcare and Cyber organizations in recovering from and preventing burnout. Kate travels nationally, and lives in Richmond, Virginia with her husband (a Cyber-professional), daughter, and 4 (yes, 4) dogs.

This is the Way: A New Leadership Creed for Info-Sec professionals

With fun and powerful examples from Disney’s The Mandalorian, InfoSec professionals will explore the new and different leadership skills required after the immense changes in the past few years. Global events including the pandemic, inflation, supply chain problems, digital transformation, and political turmoil, have caused new pressures, new threats, and changes moving faster than an N1-starfighter in hyperspace!

Explore the latest research and trends in leadership, discuss the impacts on the InfoSec industry, and refresh your leadership creed. People leaders, technical experts and InfoSec professionals at all levels will be challenged to assess their current leadership strengths and discover new ways to stretch and develop skills to meet the intense demands in Cyber leadership today and beyond. This is the Way!

Come see Kate at RVAsec 12!

Kevin Massey:
I am a security analyst who does independent security research. I focus on vulnerabilities, binary exploitation, and network protocols.

Twitter: @Scratchadams118

Heap Exploitation from First Principles

In this talk I will discuss the process of building a userland heap allocator, identify the inherent vulnerabilities that exist in heap allocation, and demonstrate methods to exploit these vulnerabilities.

Come see Kevin at RVAsec 12!

Dan is the Chief Information Security Officer for VCU. He has over 20 years of experience working in IT and information security.

Twitter: @sensubeans

Beyond the pandemic: How the pandemic shaped organizations and their security architecture

How did the pandemic affect your organization and how it operates? Does you current security model still work with your organization? This talk explores how an organization transformed its security architecture throughout and after the pandemic.

Come see Dan at RVAsec 12!

Jason Wonn is a results-focused information security leader with 30+ years of combined national intelligence, information assurance, and cyber threat intelligence expertise throughout the civilian and military sectors. Jason is a “Richmonder” but works for Navy Federal Credit Union in Vienna, VA. He currently serves as a Cyber Action Officer, delivering table-top exercises and serving as a trusted incident response advisor to leadership during cyber crises. Prior to this position, Jason led the development of a cyber threat intelligence capability at both Navy Federal and The Walt Disney Company. He also served in various threat intelligence roles as a government contractor with MITRE, Lockheed Martin, and CGI Federal in support of the FBI and 1st IO Command, US Army. He holds a B.S. in Computer Science from Tarleton State University in Texas, and the CISSP and PMP industry certifications.

Twitter: @Wonnmeister

Corporate Dungeon Master: How to Lead Cyber Games at Work

Military organizations have long known the value of “training as you fight”, but commercial entities only realized its importance in the last few years. Consequently, the Cyber Action Officer role recently became a priority for the average company. Are you a security-geek like Jason Wonn who loves role-playing games (RPGs) and want the opportunity to lead a party through incident response to the most prevalent cyber threats? In this original talk, discover how to lead games (table-top exercises) at work as a “Corporate Dungeon Master” (Cyber Action Officer), narrating the story (facilitation), controlling the monsters (cyber threats), and creating an adventure that will have your players leveling-up (process improvement).

Come see Jason at RVAsec 12!

Colin Estep is currently a threat researcher at Netskope focused on developing user and entity behavior analytics for cloud environments. Colin was previously the CSO at Sift Security (acquired by Netskope), where he helped create a product to do breach detection for IaaS environments. He was a senior engineer on the security teams at Netflix and Apple before joining Sift.
Prior to Apple, he was an FBI Agent specializing in Cyber crime. As an Agent, he spent a fair amount of time coordinating with other countries to locate and arrest malware authors and botnet operators.

Twitter: @colinestep

Insiders packing their bags with your data

What if your organization could discover which of your employees are exfiltrating data prior to leaving? We analyzed the behavior of more than 3 million users, and will present the insights found for employees preparing to leave, the nature and quantity of the data they target, and the services they use.

Come see Colin at RVAsec 12!

Fletcher is currently a Senior Red Team Consultant at CrowdStrike, specializing in Adversary Simulation operations and Offensive Security research.

Twitter: @gymR4T

Context Matters: Tailoring Tradecraft to the Operational Environment

With the advancements in defensive capabilities, from endpoint protection to user behavior analytics, operating within mature environments has become more difficult than ever. However, with each of these capabilities comes constraints that Red Teamers can abuse to shift the operational asymmetries and increase their strategic advantage. This talk will discuss how Red Teamers can shift their current operational mental models to abuse these constraints to blend-in more naturally within environments as they seek to complete target objectives.

Come see Fletcher at RVAsec 12!

Mark Arnold has a 20+ cybersecurity career, serving 8 of those years in leadership roles. As a transformational leader, Mark has built security teams and programs, authored maturity model blueprints, and implemented security domain practices at large enterprises and service providers. Mark’s areas of interest include cloud security, threat intelligence, and vulnerability research, nation-state attack methods and related activities (e.g. information operations and disinformation campaigns), and their collective impact on nations and society. He holds industry certifications and degrees from Stanford, Princeton Seminary, and Harvard University. He is a former competitive gymnast and an ordained minister but, most importantly, a husband and dad.

Twitter: @lotusebhat

TOP 5 CISO FINDINGS OF 2022

Throughout 2022, the Lares® Advisory Services team has tracked emerging trends while assisting organizations of various sizes and maturity with Virtual CISO, IT/OT Risk Assessments, Offensive Assessments, and Security Program Management engagements. TOP 5 CISO Findings (most frequently observed not necessarily the most severe) resulted from our tracking. This presentation unveils the findings, discussing them in the context of current and emerging threats. I also incorporate an MIT Sloan cybersecurity use case and the Verizon DBIR to expound on the findings.

We close out the talk by listing remedies for the Top 5 Findings. A sampling of remedies includes the selection of a framework, threat modeling, and tactical assessments to help organizations discover and avoid the risks associated with the Top 5 Findings.

Come see Mark at RVAsec 12!

Rick Lull:
Lifelong geek turned security consultant after stops as a desktop tech, server bubba, and network jockey. Rick is a healthcare IT survivor, and is now playing Horatio on the bridge for hire with a local technology consulting company, advising clients on security strategy and operations. He currently holds CISSP, CCNP-Security, NSE7 and NSE4 certifications and previously held CEH and CNA certifications. He has promised to not make fun of any manufacturers during his talk.

Network 201: A Tour Through Network Security

Taking the Network 101 presentation in 2019 a bit further, this talk will dive into network security aka technical security controls that should be considered with respect to risk management in common environment, including private/public cloud and the recent industry buzz words around ZTNA – Zero Trust Network Access.
If you have ever wondered how you might use a VRF to segment authenticated user traffic, this is a talk for you. If you are trying to cut through buzzwords that a sales guy is throwing your way about how to protect your remote workers, this is a talk for you.

Come see Rick at RVAsec 12!