BSides Sacramento
Sacramento, Ca
October 2019
Presented on my Open Source Software PBDataRecon. This was a repeat of the DEFCON talk.
DEF CON 27
Las Vegas, Nv
August 2019
Presented and released the Open Source Software PBDataRecon. This is a tool that utilizes Pastebin’s API to identify pastes that are not indexed by PasteBin’s native search or Google. The algorithms released with the tool included logic to identify child exploitation along with links to the FBI’s anonymous reporting system. In addition, it included configurable parameters to allow uses to monitor for their names, their organizations names as well as RegEx templates. In the tool’s first two days running as a PoC it identified three child pornography sites as well as a large pirate TV network in Latin America (all reported to the FBI).
Telehealth Innovation Forum
Santa Barbara, Ca
July 2019
Innovation Zone Presenter
Provided risks and mitigations on connected medical and IoT devices to a think tank style conference on innovations in telehealth. The presentation highlighted some of the cyber and regulatory risk assessments done by my partners and I as well as recommended mitigations.
SecureWorld Expo
Santa Clara, Ca
August 2018
Keynote Speaker
Presented the lunchtime keynote at the Santa Clara Convention Center to an audience of C-level security professions titled “From Breach Fatigue to Action: How to Stay Focused to Learn”
Abstract: By looking backward, we can more securely move forward. With so many breaches being reported in the media Information Security professionals can develop “breach fatigue,” losing sight of the cause-and-effect of the controls that failed and not learning from those mistakes. This talk uses specially created technology to re-create some of the more famous and significant breaches, then walks participants through the actual hacks of the vulnerabilities that allowed the breach to occur, and then discusses how the failed controls could have been hardened to reduce or even eliminate the risk.
Cyber Security World
Denver, Co
June, 2017
Workshop Presenter
“Application Security Testing with Kali Linux.” Created and taught a one-day curriculum on web application security testing using Kali Linux as well as special testing tools I wrote for the class.
(ISC)2 World Congress
Austin, Texas
September 2017
Speaker
“Misplaced Trust: The Risks of Third-party Code in Web Applications and Mobile Apps.” Uncontrolled third-party web code has become an epidemic as a vector for such attacks as watering hole attacks, malvertising and ransomware. This talk provided live demonstrations of the attack, technical overviews and most importantly best-practices, cheat sheets and checklists.
Building Owners & Managers Association of Sacramento and the Central Valley (BOMA Sacramento)
Sacramento, Ca
June 2016
Co-presenter
“Emergency Preparedness: Cyber Attacks on Facilities.” This talk to the local members outlined the attack vectors for cyber-attacks against facilities and recommended mitigations.
Healthcare Cybersecurity Symposium
Sacramento, Ca
June 2016
Speaker
“Reverse Engineering Passage into your Organization”
InfoSec World
April 2016
Orlando, Florida
Presenter
“The Five Best Open Source Web Security Test Tools You’ve Never Heard of and How to Use Them.” Presented on five OSSW tools and how they can supplement your current testing portfolio
Sacramento County Sheriff’s Office
February 2016
Guest speaker
“Attack Vectors and Methodologies” Presented attack scenarios and vectors and offered mitigations
(ISC)2 World Congress
Orlando, Florida
September 2016
Speaker
“Ripped from the Headlines: Demonstrations of the Year’s Top Breaches” Demonstrated the control failures associated with some of the year’s major breaches and discussing mitigations.
Sacramento InfraGard 2015 Symposium
September 2015
Symposium Presenter
“Anatomy of a Data Theft Attack.” Presented attack scenarios supported by live demonstrations on current threats to cyber as well as facilities security
Sacramento ASIS Chapter Meeting
August 2015
Meeting Presenter
“Anatomy of a Data Theft Attack.” Presented attack scenarios supported by live demonstrations on current threats to cyber as well as facilities security
ISACA- Sacramento Chapter
August 2015
Meeting Presenter
“Cloudy with a Chance of Optimism: Everything Your CISO Wished You Knew about the Cloud Prior to Signing That Contract.” Presented a modified version of my Cloud Security World talk to the Sacramento ISACA chapter’s July meeting.
University of California IT Security Symposium
Davis, Ca
2015
Workshop Instructor
“After the Scan: Manual Security Assessment and Pen Testing of Your Web Application.” Wrote and taught a hands-on workshop on the validation of DAST results and penetration testing web applications.
Cloud Security World 2015
New Orleans, La
2015
Conference Presenter
“Cloudy with a Chance of Optimism: Everything Your CISO Wished You Knew about the Cloud Prior to Signing That Contract. Gave a one-hour talk on the key security considerations for an organization’s cloud transformation
SANS Healthcare Cyber Security Summit
San Francisco
2015
Panel Member
“Building and Measuring a Software Security Initiative in the Healthcare Domain”
Sat on an expert panel responding to questions on building and measuring security in a healthcare SDLC.
OWASP AppSec USA
Denver, Co
2014
Conference Presenter
“Application Security Testing with Golismero.” Presented a workshop style talk on automating security tests using the Golismero open source tool.
CactusCon 2014
Phoenix, Az
2014
Workshop Instructor
“Web Application Security Testing with Kali Linux.” Wrote and taught a workshop on assessing the security of web applications using the open source tools found in the Kali Linux distribution.
BSides Dallas Fort Worth
Dallas, Tx
2013
Conference Presenter
“Overcoming Objections to Security in Reluctant (and even hostile) Environments.” Spoke on program management strategies for implementing and improving information security programs.
BSides Washington DC
Washington, DC
2013
Conference Presenter
“Overcoming Objections to Security in Reluctant (and even hostile) Environments.” Spoke on program management strategies for implementing and improving information security programs.
BSides Las Vegas
Las Vegas, NV
2013
Workshop Instructor
“Introduction to Wireless Pen Testing and Assessment.” Wrote and taught a four-hour workshop on security testing wireless networks.
CactusCon 2013
Phoenix, AZ
2013
Workshop Instructor
“Testing SOHO Wireless Networks.” Wrote and taught a workshop on security testing wireless network with a focus on small office/home office devices.
BSides Puerto Rico
San Juan, PR
2013
Conference Presenter
“Overcoming Objections to Security in the SDLC.” Spoke on overcoming some of the common objections and obstacles to implementing a secure software development life cycle.
