Richmond, VA

June 5th - 6th, 2014

After Party Sponsored By Rapid7, LogRhythm and FishNet Security!

We are pleased to announce that Rapid7, LogRhythm and FishNet Security have all come together to sponsor the RVAsec after party!

The after party will be held at Postbellum on Thursday, June 5th at 6:30pm!

The event takes place shortly after day one of the conference ends–and it is a quick walk over so you can head right from VCU for some cocktails and food!

If you plan to attend, please register to ensure we have enough staff & space reserved!

Event Details:

Thursday June 5th 6:30pm-8:30PM (maybe longer!)
1323 West Main Street Richmond, VA 23220
(804) 353-7678

Google Maps Link

Thanks again to our sponsors for making sure RVAsec attendees will be well taken care of this year!



fishnet security

Gene Fishel, Chief Of The Computer Crime Section In Virginia Attorney General’s Office To Keynote!

Gene FishelGene Fishel currently serves as Senior Assistant Attorney General and Chief of the Computer Crime Section in Virginia Attorney General Mark Herring’s Office. In this capacity he directs prosecutions of computer fraud, identity theft, and child exploitation cases in state courts across Virginia, and serves as a Special Assistant United States Attorney in both the Eastern and Western Districts of Virginia where he prosecutes computer crime cases in federal court. He additionally oversees the office’s recently established Computer Forensics Unit which conducts investigations and computer forensic analyses for criminal cases across the Commonwealth. He also monitors organizations’ compliance with Virginia’s database breach notification laws, drafts legislation for the Virginia General AGene Fishelssembly, trains law enforcement and prosecutors statewide, and educates the public on issues involving computer crimes.

During his eleven-year tenure at the Attorney General’s Office, Gene has helped to draft and enact sweeping reforms to computer crime and child exploitation laws in Virginia, and has been involved in numerous novel and complex federal and state prosecutions, including the nation’s first, felony prosecution for illicit spamming in 2004. He has served on numerous boards and committees including the Board of Governors for the Criminal Law Section of the Virginia State Bar, the National White Collar Crime Center’s Cybercrime Advisory Board, the Virginia General Assembly’s Joint Committee on Technology and Science Advisory Committee, and the Governor’s Office of Substance Abuse Advisory Committee. He has also lectured and presented on data breach issues and computer crimes to various agencies, organizations, and conferences across the country including the Federal Trade Commission, the Central Intelligence Agency, the United States Capitol Staff, and United States Attorney conferences. In 2007, Gene was appointed as Senior Assistant Attorney General. Prior to his time at the Attorney General’s Office, Gene served as law clerk for the Second Judicial Circuit in Virginia Beach, VA. He received his JD from Wake Forest University and his BA, magna cum laude, from James Madison University.

RVAs3c Capture The Flag Update and Prizes Announced!

RVAs3c Capture The Flag:
The RVAsec Capture The Flag (CTF) is getting close! Below are details that are meant to ensure participants are prepared for the event. We’re excited to invite anyone and everyone who is interested in learning and exploring using different tools and techniques with hands on practical exercises to join us.

The team has worked hard to keep the “every man or woman” feel of the CTF from last year in effect. There are challenges of different varieties that should satisfy every skill level.

This year we are again going for the wireless competition, which allows a little bit of freedom as far as cables go. There will be a dedicated space setup in the vendor area, with some seating on first come basis. Please confirm in advance with the survey you will receive from the RVAs3c organizers soon to help us make sure we have enough space and can better guarantee you’ll be counted when that space is divided up.

We plan to have staff walking around to assist folks in case of any major issues, as well as to answer questions, within reason. We can’t give you the answers of course, unless you happen to have some massive dogecoin wallets laying around (kidding!).

When: Friday, 06/06/2014 – Start time will be near 10am EST, and end time will be at or prior to 4pm EST; announcements will be made onsite. Also, note that we have CTF prep time on Day 1 if you have questions or need helping getting setup. The first 10 people that show up to the prep session will get a custom SecuraBit USB case. The RVAsec schedule also reflects this:
Where: Same location as the con itself ( in the main vendor room.
Who: Living humanoid-ish… seriously, this is for everyone from hobbyists, sys/net admins, infosec pro’s, tinkerers, makers, fixers and breakers… come out and play. We’ll all teach, learn and grow together!
What: …to do. See below:
DO bring a wireless network enabled laptop. This will be primarily wireless access so make sure you have that capability.
DO have the ability to run Backtrack 5r3 (, Pentoo ( or Kali Linux ( either as a virtual machine, from bootable media (CD/DVD flash drive), or installed as your OS. Most of the scenarios in the CTF can be completed with the tools within these security-centric Linux distributions. Not a requirement per se, but a BIG suggestion.
DO understand that the CTF network is a closed private network, and will not have Internet access. CTF Participants will have the ability to connect to a separate guest wireless network with internet access for research, tool downloads, etc. during the event, but will have to disconnect from the CTF network to do so. Do not rely on this entirely though, if that wireless goes down it may be beneficial to bring your own hotspot.
DO listen to and respect any instructions and guidance provided at the event. We want to provide an environment that is conducive to learning, tinkering, exploring and having a good time.
What: …NOT to do. See below:
DON’T use words or phrases like “irregardless”, “all of the sudden” or “cybergeddon”.
DON’T feed or pet any of the conference organizers or volunteers.
DON’T attack any other CTF participants (logically or physically).
Pre-Register: If you plan to participate in the CTF we ask that you check the CTF option when registering for RVAsec or if you’re unsure if you did already, email us and we’ll make sure you’re accounted for.
************  What you can win? *******************

There are some awesome prizes lined up.

First place is a HackRF Pre-order, which is a really great way to learn about wireless beyond the standard 2.4 and 5GHz most are used to from mainstream access points.

Second place is a Pineapple courtesy of Hak5, for all your pwning needs.

Third place is the Android Hacker’s Handbook, to assist you in understanding all sorts of wonderfully evil things you can do to your phone or tablet, or anything else running Android!

If you have any questions please let us know!



Speaker feature: Steve Werby

Steve Werby

@stevewerby /
Befriend / [OBFUSCATED]

Steve Werby is an independent security consultant and researcher at Befriend and a security architect at a Fortune 2^8 company. He’s held consultant, architect, and CISO roles in the information security field over the last 15 years.


Bad Advice, Unintended Consequences, and Broken Paradigms – Think & Act Different!

20 years ago information security was a low corporate priority that was the realm of technical geeks. Factors such as the rapidly-evolving threat environment and increased corporate impact have elevated it to a multidisciplinary risk management discipline…which sometimes has a seat at the table. This talk explores what we’re doing wrong, why it’s ineffective (or worse), and better ways of thinking and doing. You will learn to question the status quo, rethink existing paradigms, and leverage better approaches from information security and other disciplines. Think different! Act different!

Get Your Hotel Room by 5/14!

Just a reminder that if you need a hotel room for RVAsec, you should book it before our block at the Crowne Plaza ends on 5/14.

We have reserved a block of rooms at the Crowne Plaza for out of town guests. The rate is $114/night (which includes parking).

You can either book online or call the hotel.

When you call (800-2CROWNE) the hotel please tell mention the block “RVAsec” to get the special rate. If you have any issues, please ask to speak with Christina Norton, Sales Manager.

Crowne Plaza Richmond Downtown
555 East Canal Street, Richmond VA 23219

If for any reason you are unable to get the RVAsec rate or the block of rooms has been filled, please let us know so we can contact the hotel!

Once the block is full or expires we are not able to have it extended.

Make sure you check out information on getting to the conference.

Speaker feature: Schuyler Towne

Schuyler Towne


Schuyler Towne is obsessed with locks. While he got his start picking locks competitively, his interest has since exploded into every aspect of their history, design and manipulation. He’s taught hackers, authors, cops and even toy designers. There is nothing Schuyler loves more than to talk locks with anyone who will listen. His interests in the history of physical security and design of locks provides a passionate background to his lectures and workshops on lockpicking. Currently he is attempting to recover lock patents lost in the 1836 patent office fire.

How to Make a Lock

Locks were one of the earliest complex mechanical devices. They are ubiquitous, yet remain very regional in concept. In this talk we’ll explore the process of inventing a lock. We’ll cover examples from around the world, some that persist to this day, some that failed before coming to market, and some that were , until recently, lost to history.

Ticket Transfers & Cancellations

Did you know you can transfer an RVAsec ticket to a co-worker or friend directly in Eventbrite?

Log in to your account and go to My Tickets (you may need to create an account using the email address you registered).

Then you can view your Current Orders (select RVAsec), and “Edit details” for the ticket. Changing the “Contact Information” will update the name of the person registered to check in at the conference. You can also change the questions asked at registration, which will help us plan for parking, catering and other items.

Also, please note that no refunds will be issued after May 16th when registration closes.

Speaker feature: Ben Tomhave

Ben Tomhave

@falconsview /

Ben Tomhave is a Research Director with Gartner for Technical Professionals. He holds a Master of Science in Engineering Management (Information Security Management concentration) from The George Washington University. He is a Certified Information Systems Security Professional (CISSP), co-chair of the American Bar Association Information Security Committee within the Section of Science & Technology, former board member at large for SIRA (, and a member of ISSA (NoVA chapter). He is a published author and an experienced public speaker, including recent speaking engagements with RSA USA, the ISSA International Conference, Secure360, RVAsec and RMISC.

How to Achieve Success with Cyber Risk Assessment and Analysis

Technical professionals are frequently asked to lead or participate in risk assessments or risk analysis, as well as to provide recommendations for the best approach an enterprise should adopt. Unfortunately, there has been little guidance (outside of expensive consultants) on how exactly to achieve success in this area. Until now. On the basis of recent Gartner research, this session provides guidance for achieving success with cyber risk assessment and analysis.