Black Hat USA 2010 //speakers

Caesars Palace Las Vegas, NV • July 24-29

//speaker bios

Jeremy Allen

Intrepidus Group

Colin Ames

Colin Ames is a security researcher with Attack Research LLC where he consults for both the private and public sectors. He's currently focused on Pen testing, Exploit Development, Reverse Engineering, and Malware Analysis.

Quynh Nguyen Anh

Quynh Nguyen Anh is a researcher at The National Institute of Advanced Industrial Science and Technology (AIST), Japan. He interests include operating system, virtualization, digital forensic, intrusion detection, malware analysis and vulnerability. He published a lot of academic papers in those fields, and loves to get around the world to present his research results in various hacking conferences. Quynh obtained his PhD degree in computer science from Keio university, Japan. He is also a member of Vnsecurity, a pioneer security research group in Vietnam.

James Arlen

Push The Stack Consulting

James Arlen, CISA, is a security consultant most recently engaged as the CISO of a mid-market publicly traded financial institution. He has been involved with implementing a practical level of information security in Fortune 500, TSE 100, and major public-sector corporations for more than a decade. James has a recurring column on Liquidmatrix Security Digest. His areas of interest include organizational change, social engineering, blinky lights and shiny things.

Agustin Azubel

Agustin Azubel has been working in the computer security industry since the late nineties. He works as an independent consultant doing reverse engineering, performing traditional software development, writing full featured exploits and delivering in-depth vulnerability analysis. He also worked for almost a decade at core security technologies where he was involved in most of the key projects of that company. He is also a member of the ampliasecurity team.

olle B

Toolcrypt.org

olle B has been working in the IT-security industry for vendors, service providers, boutique consultancies and government agencies since the late 90's. He enjoys tinkering with software and building security related tools under the banner of the Toolcrypt group (www.toolcrypt.org). In his spare time he self-medicates with beer and trains hamsters.

Don Bailey

iSEC Partners, Inc.

Don Bailey is a security consultant with iSEC Partners, Inc. Don has found and exploited unknown vulnerabilities in both userland and kernel code on many popular computing platforms including Mac OSX, Linux, FreeBSD, and OpenBSD. He also has a strong background in network protocol analysis and root-kit design and detection. Don's prior work includes threat assessment for a wide range of clients, including the financial sector, government sector, and Fortune 500 companies. Mr. Bailey has previously spoken at several national and international security conferences on various topics such as zero-day development, root-kit design, NULL pointer dereferences, and DECT security.

Andrew Becherer

iSEC Partners, Inc.

Andrew Becherer is a Senior Security Consultant with iSEC Partners, a strategic digital security organization. His focus is web application and mobile application security. Prior to joining iSEC Partners, he was a Senior Consultant with Booz Allen Hamilton. Mr. Becherer spent several years as a Risk and Credit Analyst in the financial services industry. His experience in the software security field -consulting financial, non-profit and defense sectors -has provided him experience with a wide range of technologies.

Mr. Becherer has lectured on a number of topics including emerging cloud computing threat models, virtualization, network security tools and embedded Linux development. At the Black Hat Briefings USA 2009, Andrew, along with researchers Alex Stamos and Nathan Wilcox, presented on the topic "Cloud Computing Models and Vulnerabilities:Raining on the Trendy New Parade." Andrew's research on this topic focused on the effect of elasticity and virtualization on the Linux pseudorandom number generator (PRNG). At Black Hat USA 2008, he was a Microsoft Defend the Flag (DTF) instructor and, he is a recurring speaker at the Linuxfest Northwest conference. In addition to his educational outreach work with user groups, he is a member of several nationally recognized organizations. These organizations include the Association of Computing Machinery (ACM), FBI InfraGard and Open Web Application Security Project (OWASP).

Mr. Becherer received a B.S. in Computing and Software Systems from the University of Washington, Tacoma, and holds a B.A. in Sociology from the University of Kentucky.

Rod Beckstrom

ICANN

Rod Beckstrom is a highly successful entrepreneur, founder and CEO of a publicly-traded company, a best-selling author, avowed environmentalist, public diplomacy leader and, most recently, the head of a top-level federal government agency entrusted with protecting the nation’s communication networks against cyber attack. Throughout 2008, Rod served as the Director of the National Cybersecurity Center (NCSC) at the U.S. Department of Homeland Security, where he reported to the Secretary of DHS, and was charged with cooperating directly with the Attorney General, National Security Council, Secretary of Defense, and the Director of National Intelligence (DNI). Prior to joining DHS, he served on the DNI’s Senior Advisory Group. Rod is unique in having experienced the inner workings of two, highly-charged, often competing, federal security agencies created in the wake of the September 11th attacks, an event that he says, “changed my life.”

Rod is widely regarded as a pre-eminent thinker and speaker on issues of cybersecurity and related global issues, as well as on organizational strategy and leadership. He is also an expert on how carbon markets and “green” issues affect business. While Director of the NCSC, Rod developed an effective working group of leaders from the nation's top six cybersecurity centers across the civilian, military and intelligence communities. His work led to his development of a new economic theory that provides an explicit model for valuing any network, answering a decades-old problem in economics. Rod co-authored four books including The Starfish and the Spider: The Unstoppable Power of Leaderless Organizations, a best-selling model for analyzing organizations, leadership styles, and competitive strategy. The Starfish and the Spider has been translated into 16 foreign editions and is broadly quoted.

At age 24, Rod started his first company in a garage apartment and, subsequently, grew it into a global enterprise with offices in New York, London, Tokyo, Geneva, Sydney, Palo Alto, Los Angeles, and Hong Kong. CATS Software Inc., went public and later sold. Nobel Laureates Myron Scholes and William F. Sharpe served on the company's boards of directors and advisors. While at CATS Rod helped advance the financial theory of “value at risk,” now used globally for all key banking risk management. Rod co-edited the first book to introduce “value at risk.” Rod also co-founded Mergent Systems, a pioneer in inferential database engines, which Commerce One later acquired for $200 million. He has co-launched other collaborations, software, and internet service businesses, as well. From 1999 to 2001, he served as Chairman of Privada, Inc, a leader in technology enabling private, anonymous, and secure credit card transactions over the internet.

In 2003, Rod co-founded a global peace network of CEO's which initiated Track II diplomatic efforts between India and Pakistan. The group’s symbolic actions opened the borders to people and trade, and contributed to ending the most recent Indo-Pak conflict. It's one of several non-profit groups and initiatives Rod has started. He now serves on the boards of the Environmental Defense Fund, which Fortune Magazine ranked as one of the seven most powerful boards in the world and Jamii Bora Trust an innovative micro-lending group in Africa with more than 200,000 members. He is a graduate of Stanford University with an MBA and a BA with Honors and Distinction. He served as Chairman of the Council of Presidents of the combined Stanford student body (ASSU) and was a Fulbright Scholar at the University of St. Gallen in Switzerland. Rod commenced as President and CEO of ICANN on 1 July 2009.

Christiaan Beek

TenICT

Christiaan Beek has been working in the security field for several years. Working for national and international companies, he gained knowledge of hacking techniques, forensic analysis and incident response. Currently he is working as a security consultant/ethical hacker & trainer for a Dutch company, TenICT. He developed and lectured an internet forensics training and a digital evidence training for attorneys. As a SME he acted for the Duth News Agency on prime-time news about the TJX hack. Christiaan was invited to speak on BlackhatEU, IT Underground and Swiss Cyberstorm III. His free time is spent with security research & playing with synthesizers. He keeps his own blog: http://securitybananas.com

Damiano Bolzoni

Damiano Bolzoni holds a PhD in Computer Security from the University of Twente. He was a member of the IPID project, where he dealt with technical aspects of Intrusion Detection Systems to support high-level policies. Before joining the University of Twente, he has been working for the Italian branch of KPMG, in the Information Risk Management group. The main activities carried out by Bolzoni while in KPMG were security risk/vulnerability assessments, (security-oriented) software developing and digital forensics analysis.

Bill Boni

CISO, T-Mobile

William C. Boni has spent his entire professional career as an information protection specialist and has assisted major organization’s in both the public and private sectors. For 30 years, beginning as a Special Agent in U.S. Army Counter-intelligence, Bill has helped a variety of organizations design and implement cost-effective programs to protect both tangible and intangible assets. In a wide range of assignments Bill has assisted clients in safeguarding their digital assets, especially their key intellectual property, against the many threats arising from the global Internet. In addition, he has pioneered the innovative application of technologies including computer forensics, intrusion detection and others, to deal with incidents directed against electronic business systems.

Bill has served as a consultant in several professional service organizations and now works as the Vice President and Corporate Information Security Officer of T-Mobile. He is responsible for the company's overall program to protect the company's networks, computer systems and electronic information.

Bill has been quoted by leading print publications such as the Wall Street Journal, US News & World Report the Financial Times, LA Times, and CIO Magazine. He has also appeared on many network broadcasts including Prime Time Live, CNN and CNN/fn discussing espionage and cyber crimes directed against American high technology corporations. Other assignments in his distinguished career include work as a U.S. Army counter-intelligence officer; Federal agent and investigator; investigator and security consultant; Vice President of Information Security for First Interstate Bank; and project security officer for “Star Wars” programs and other defense work with Hughes Aircraft Company and Rockwell.

Kenton Born

Honeywell

Kenton Born is a software engineer with Honeywell Federal Manufacturing and Technology. He has a master's degree in software engineering from Kansas State University, and is currently pursuing a PhD in Computer Science. His areas of interest include computer security, artificial intelligence, and software architecture.

Sergey Bratus

Sergey Bratus is a Research Assistant Professor at Dartmouth College, affiliated with Dartmouth's Institute for Security, Technology, and Society. His research interests include designing new operating system and hardware-based features to support more expressive and developer-friendly debugging, secure programming and reverse engineering primitives; Linux kernel security (kernel exploits, LKM rootkits, and hardening patches); data organization and other AI techniques for better log and traffic analysis; and various kinds of wired and wireless network hacking.

Before coming to Dartmouth, he worked on statistical learning methods for natural text processing and information extraction at BBN Technologies. He has a Ph.D. in Mathematics from Northeastern University.

Francis Brown

Francis Brown, CISA, CISSP, MCSE, is a Managing Partner at Stach & Liu, a security consulting firm providing IT security services to the Fortune 500 and global financial institutions as well as U.S. and foreign governments. Before joining Stach & Liu, Francis served as an IT Security Specialist with the Global Risk Assessment team of Honeywell International where he performed network and application penetration testing, product security evaluations, incident response, and risk assessments of critical infrastructure. Prior to that, Francis was a consultant with the Ernst & Young Advanced Security Centers and conducted network, application, wireless, and remote access penetration tests for Fortune 500 clients. Francis holds a Bachelor of Science and Engineering from the University of Pennsylvania with a major in Computer Science and Engineering and a minor in Psychology.

Grant Bugher

Stanford University

Grant Bugher leads the security advisory team for Online Services Security & Compliance at Microsoft, and is a member of Microsoft’s Security Development Lifecycle team. Grant works with Microsoft’s online services teams to help them write and deploy secure software, and to develop and refine the software standards used throughout Microsoft. Prior to leading this team, his experience included being Enterprise Security Architect for a Fortune 500 corporation, a Program Manager on Windows Firewall, and a software engineer on the .NET Framework and Visual Studio .NET. Grant holds the CISSP and CSSLP certifications, and also writes a security blog at perimetergrid.com.

Elie Bursztein

Stanford University

Elie Bursztein is a researcher at the Stanford Computer Security Lab. He holds a PhD in computer science and an Engineering degree in computer systems, networks and security.

His research focus is offensive technologies, mobile and web security. He enjoys applying game theory, machine learning and data mining techniques to security.

David Byrne

Trustwave

David Byrne is a Senior Security Consultant within the Application Security practice at Trustwave's SpiderLabs. SpiderLabs is the advanced security team responsible for Penetration Testing, Application Security, and Incident Response for Trustwave's clients.

David has been involved with information security for a decade. Before Trustwave, he was the Security Architect at Dish Network. In 2008, he released Grendel (grendel-scan.com), an open source web application security scanner. David frequently presents at security events including DEFCON, Black Hat, Toorcon, SANS, and OWASP AppSec.

Cesar Cerrudo

Argeniss

Cesar Cerrudo is the founder and CEO of Argeniss (www.argeniss.com), a security consultancy firm based in Argentina. He is a security researcher and consultant specializing in application security. Regarded as a leading application security researcher, Cesar is credited with discovering and helping to eliminate dozens of vulnerabilities in leading applications including Microsoft SQL Server, Oracle database server, IBM DB2, Microsoft BizTalk Server, Microsoft Commerce Server, Microsoft Windows, Yahoo! Messenger, etc. Cesar has authored several white papers on database, application security, attacks and exploitation techniques and he has been invited to present at a variety of companies and conferences including Microsoft, Black Hat, Bellua, CanSecWest, EuSecWest, WebSec. HITB, Microsoft BlueHat, EkoParty, etc. Cesar collaborates with and is regulary quoted in print and online publications including eWeek, ComputerWorld, and other leading journals.

Gyan Chawdhary

IRM Plc

Gyan Chawdhary: I specialize in circumventing controls within investment banking, hedge funds and broker dealer platforms. I also do PCI/ISO270001 audits and manage large security engagements with *real* budgets and *real* deadlines when things get too geeky.

Jason Cheatham

US Air Force Research Laboratory

Jason Cheatham has been involved in the computer security field for the past 5 years. During that time he has analyzed a number of commercial and government developed software systems, contributed to some novel attack modeling research, and become an accomplished lurker at technical conferences. Jason has also worked on the development side, creating and encryption tool that is officially certified for use on Air Force desktop systems, and a stealthy kernel debugger that is used by the DoD. Jason is employed by the US Air Force Research Laboratory as a reverse engineer and software developer.

Jim Christy

SA (Ret) Jim Christy, DC3 is a retired special agent that specialized in cyber crime investigations and digital evidence for over 23 years and 38 years of federal service. Jim returned to the federal government as an IPA and is currently the Director of Futures Exploration (FX) for the Defense Cyber Crime Center (DC3). FX is responsible for intelligence analysis, outreach/marketing, and strategic relationships with other government organizations, private sector, and academia for DC3. Jim was profiled in Wired Magazine in January 2007.

From Nov 03 – Nov 06, Supervisory Special Agent Jim Christy, was the Director of the Defense Cyber Crime Institute (DCCI), DC3. The DCCI is responsible for the research & development and test & evaluation of forensic and investigative tools for the DoD Law Enforcement and Counterintelligence organizations. The Institute is also charged with intelligence analysis, outreach, and policy for DC3. Jim is a retired Air Force Office of Special Investigations, Computer Crime Investigator.

Jim consulted with David Marconi (writer of Enemy of the State, Mission Impossible 2 & Live Free or Die Hard) and contributed technical advice on critical infrastructure attacks used in the movie Live Free or Die Hard.

Jim is also a retired college hockey referee. He has worked as a professional referee at the minor league level and was the USA Hockey Supervisor of Officials for the Mid-Atlantic States. Additionally he worked for the National Hockey League as an Off-ice Official for the Washington Capitals for eight years and officiated on-ice their pre-season, exhibition and training camp games.

Col Sebastian M. Convertino

Us Air Force

Colonel Sebastian M. Convertino II, AF: Commander, 318th Information Operations Group 688th Information Operations Wing. The 318th Information Operations Group conducts cyberwarfare & IO training, testing, tactics development, network integrity assessment and electronic warfare support for AF and joint warfighters.

Claudio Criscione

Claudio Criscione managed to score his first hack at the age of 10, to download more contents from the local BBS bypassing ratio restrictions. After that he hacked his way to graduation at Milano TU and started his PhD while working as the principal consultant at Secure Network. He's been involved in web application security and anomaly detection, and then moved into virtualization security to find a new toy. He presented in various conferences, including BlackHat EU, CONFidence and Syscan, and he's an editor at virtualization.info.

Tom Cross

IBM X-Force

Tom Cross is the manager of IBM Internet Security System's X-Force Advanced Research team. Tom's team is engaged in a daily effort to identify, analyze, and mitigate computer security vulnerabilities. Tom has a six year history with ISS, during which he has served as a vulnerability researcher and software developer. He is credited with discovering a number of critical security vulnerabilities in enterprise class software and he also wrote one of the first academic papers suggesting the use of trust metrics in Wikipedia. Tom frequently speaks on computer security issues at conferences around the world. He holds a Bachelor's degree in Computer Engineering from Georgia Tech.

Andrew Cushman

Microsoft

Andrew Cushman: As Sr. Director of Strategy in the Trustworthy Computing Group at Microsoft Corp. Cushman's primary focus is on End to End Trust - Microsoft's initiative for a safer, more trusted Internet, which aims to bring the trustworthiness of the physical world to the cyber world. Cushman is responsible for End to End Trust Outreach and works with teams across Microsoft and the broader security ecosystem.

Cushman previously managed the Microsoft Security Response Center (MSRC). The MSRC leads emergency response to security threats, defines and enforces response policies, and monitors monthly update quality and timeliness. Cushman expanded the MSRC's outreach programs to cover security researchers as well as mainstream security organizations, companies and computer emergency response teams.

Cushman joined the TwC Security team in 2004 as a member of the Security Engineering Group executive leadership team that made security processes an integral part of Microsoft’s engineering culture. Since then he has been a driving force behind the company’s security researcher outreach strategy and execution efforts, formulating the Responsible Disclosure Initiative strategy and initiating the BlueHat security conference franchise.

Since joining Microsoft in January 1990, Cushman has held positions on the Microsoft International Product Group, the Microsoft Money team and the Internet Information Services (IIS) team. He led the IIS product team during the development of IIS 6.0 in Windows Server® 2003. IIS 6.0 was one of the first Microsoft products to fully adopt the security engineering processes that are today embodied in the SDL and remains a “poster child” of Microsoft’s commitment to security engineering and Trustworthy Computing.

Cushman earned a bachelor’s degree in international studies from the University of Washington and a master of international business degree from Seattle University. Away from work, he is an avid skier.

Arshan Dabirsiaghi

Aspect Security

Arshan Dabirsiaghiis the Director of Research at Aspect Security, a company that specializes in a range of application security services. He's found vulnerabilities in big, popular software, discovered new attack techniques, spoken at big conferences, and blah, blah, blah.

Really, he just left PR hack on AOL yesterday and spends most of his research time finding bugs that Sami Koivu found months or years ago.

Dino Dai Zovi

Trail of Bits

Dino Dai Zovi, currently an independent security consultant and researcher, has been working in information security for over 9 years with experience in red teaming, penetration testing, and software security assessments at Sandia National Laboratories, @stake, and Matasano Security. Mr. Dai Zovi is also a regular speaker at information security conferences including presentations of his research on MacOS X security, hardware virtualization assisted rootkits using Intel VT-x, 802.11 wireless client security, and offensive security techniques at BlackHat USA, Microsoft BlueHat, CanSecWest, the USENIX Workshop on Offensive Technology, and DEFCON. He is a co-author of "The Mac Hacker's Handbook" (Wiley 2008) and "The Art of Software Security Testing" (Addison-Wesley Professional 2006). He is perhaps best known in the information security and Mac communities for discovering the vulnerability and writing the exploit to win the first PWN2OWN contest at CanSecWest 2007.

Neil Daswani

Dasient, Inc.

Neil Daswani is a co-founder of Dasient, Inc., a security company backed by some of the most influential investors in Silicon Valley and New York. In the past, Neil has served in a variety of research, development, teaching, and managerial roles at Google, Stanford University, DoCoMo USA Labs, Yodlee, and Bellcore (now Telcordia Technologies). While at Stanford, Neil co-founded the Stanford Center Professional Development (SCPD) Security Certification Program (http://proed.stanford.edu/?security). He has published extensively, frequently gives talks at industry and academic conferences, and has been granted several U.S. patents. He received a Ph.D. and a master's in computer science from Stanford University, and earned a bachelor's in computer science with honors with distinction from Columbia University. Neil is also the lead author of "Foundations of Security:What Every Programmer Needs To Know" (published by Apress; ISBN 1590597842; http://tinyurl.com/33xs6g.

More information about Neil is available at www.neildaswani.com

Michael Davis

Savid Technologies, Inc.

Nick DePetrillo

Nick DePetrillo is an independent security researcher with a focus on critical infrastructure. Most recently, Nick was a senior security consultant with Industrial Defender performing physical and electronic security assessments for utility companies and power plants. Nick also researched Smart Grid/AMI hardware and software security issues while at Industrial Defender. Previously, he worked as a research and development engineer for Aruba Networks, concentrating on wireless security threats and prototyping new products. Mr. DePetrillo has also consulted for U.S. government agencies, Fortune 500 companies, and worked as a network security engineer for an Internet2 giga-pop. Nick has presented new security threats and mitigation techniques at both national and international conferences.

Stephen de Vries

Corsaire

Stephen de Vries: Principal Consultant in Corsaire’s Security Assessment team. Stephen as worked in IT Security since 1998 and has spent the last nine years focused on Security Assessment and Penetration Testing at Corsaire, KPMG and Internet Security Systems. He was a founding leader of the OWASP Java project and regularly presents talks on secure programming and security testing. His areas of interest include secure web development, Java web development and integrating security into the SDLC.

Mariano Nuñez Di Croce

ONAPSIS

Mariano Nuñez Di Croce is the Director of Research and Development at ONAPSIS. Mariano has a long experience as a Senior Security Consultant, mainly involved in security assessments and vulnerability research. He has discovered critical vulnerabilities in SAP, Microsoft, Oracle and IBM applications.

Mariano leads the SAP Security Team at Onapsis, where he works hardening and assessing the security of critical SAP implementations in world-wide organizations. He is the author and developer of the first open-source SAP Penetration Testing Framework and has discovered more than 40 vulnerabilities in SAP applications. Mariano is also the lead author of the "SAP Security In-Depth" publication.

Mariano has been invited to hold presentations and trainings in many international security conferences such as Blackhat USA/EU, DeepSec, Sec-T, Hack.lu, Seacure.it, Ekoparty, CIBSI as well as to host private trainings for Fortune-100 companies and defense contractors. Mariano has a degree in Computer Science Engineering from the UTN.

Whit Diffie

ICANN

Whit Diffie Globally recognized as a leader in public-key cryptography, encryption and network security, Diffie has a long and distinguished career as a leading force for innovative thought. He brings extensive experience in the design, development and implementation of security methods for networks.

With Stanford University electrical engineering professor Martin Hellman, Diffie produced the 1976 paper New Directions in Cryptography that laid the groundwork for solving one of the fundamental problems of cryptography - key distribution, a process to increase security through use of a secret key that is exchanged between parties prior to encryption.

Prior to coming to ICANN, Diffie served as Vice President, Fellow, and Chief Security Officer with Sun Microsystems, at which he had worked from 1991 to 2009. At Sun, Diffie focused on the most fundamental security problems facing modern communications and computing with emphasis on public policy as well as technology. Prior to joining Sun, Diffie was Manager of Secure Systems Research for Northern Telecom, where he played a key role in the design of Northern's first packet security product and in developing the group that was later to become Entrust.

Diffie received a Bachelor of Science degree in mathematics from the Massachusetts Institute of Technology in 1965 and a Doctorate in Technical Sciences from the Swiss Federal Institute of Technology in Zurich in 1992.

Diffie has received many awards throughout his career and was awarded a Degree of Doctor of Science (Honoris Causa) in 2008 by Royal Holloway College of the University of London. He received the Louis E. Levy Medal in 1997 from the Franklin Institute in Philadelphia and the National Computer Systems Security Award, given jointly by NIST and NSA, in 1996. In 2000 he became a fellow of the Marconi Foundation.

With Susan Landau, he is the author of the 1998 book Privacy on the Line: the Politics of Wiretapping and Encryption.

Jerry Dixon

Team Cymru

Jerry Dixon currently serves as Director of Analysis for Team Cymru and was the former Director of the National Cyber Security Division (NCSD) & US-CERT, of the Department of Homeland Security. He continues to advise partners on national cyber-security threats, aides organizations in preparing for cyber-attacks, and assists with the development of cyber-security policies for organizations.

Steven M. Elefant

Steven M. Elefant provides strategic focus for new opportunities and enhancement of existing products and services. Also provides technology vision and leadership for developing and delivering the company's solutions as well as interfacing with intelligence, law enforcement and industry leaders to strategically identify threats.

Steve joined Heartland in November 2008 as a consultant, helping Heartland bring its Software as a Service (SaaS) applications to its merchant base. In January 2009, he became the executive director of end-to-end encryption focusing on developing point-of-sale products and executing Heartland’s E3™ security platform that encrypts cardholder data from the point of swipe/entry at a merchant location through the payments processing network and to the card brands. He was named chief information officer in August 2009. Steve was the founder of several successful Silicon Valley startup and venture capital firms. He is co-founder and former chief executive officer of ICVerify, Inc., a leader in payments processing integration of PC-based POS software. The company merged with CyberCash, Inc. in 1998 to form an Internet and physical service provider for electronic payments software. Steve has been an active member of the US Secret Service Electronic Crimes Task Force for more than six years, as well as the Federal Bureau of Investigation’s Infragard Electronic Crimes Task Force for the past five years.

Tim Elrod

Tim Elrod is an Independent Security Researcher based out of Oklahoma, tagged by some as the most interesting security researcher in the world. In fact, the police often question him simply because they find him so enthralling. His blood smells of cologne... and 0day. If he were to give you directions you would never get lost and always arrive 5 minutes early. Truly, truly, Tim has a passion for security and post exploitation research and enjoys discovering creative and interesting techniques for exploitation.

Chris Eng

Chris Eng, Senior Director of Research at Veracode, helps define and implement the security analysis capabilities of Veracode's service offerings. He is a regular speaker at information security conferences such as BlackHat, OWASP, and ISSA, and is often cited as a subject matter expert by media outlets. He has addressed enterprise and government audiences on a diverse set of topics ranging from attacking crypto to building an SDLC.

Chris' professional experience includes stints at Symantec, @stake, and the US Department of Defense, where he specialized in software security assessments, penetration testing, and vulnerability research. Along with experts from more than 30 US and international cyber security organizations, he helped develop the CWE/SANS Top 25 Most Dangerous Programming Errors.

Patrick Engebretson

Dr. Patrick Engebretson obtained his Doctor of Science degree with a specialization in Information Security from Dakota State University. He currently serves as an Assistant Professor of Information Security and also works as a Senior Penetration Tester for security firm in the Midwest. His research interests include penetration testing, intrusion detection, exploitation, honey pots, and malware. In the past 3 years he has published 11 peer reviewed journal and conference papers in these areas. Dr. Engebretson was recently invited by the Department of Homeland Security to share his research at the Software Assurance Forum in Washington, DC. He regularly attends advanced exploitation and penetration testing trainings from industry recognized professionals and holds several certifications. He teaches graduate and undergraduate courses in penetration testing, wireless security, and intrusion detection.

Rachel Engel

iSEC Partners

Rachel Engel has been writing networked server applications, protocol-layer code, and scalability systems for eight years and has recently been focusing on penetration testing and computer security analysis. She thinks that computers are wonderful devices for automating labor intensive processes and that as such, a great deal more of penetration testing can be automated than is at present. She's doing her best to build the big red button.

Stefan Esser

SektionEins GmbH

Stefan Esser is best known in the security community as the PHP security guy. Since he became a PHP core developer in 2002 he devoted a lot of time to PHP and PHP application vulnerability research. However in his early days he released lots of advisories about vulnerabilities in software like CVS, Samba, OpenBSD or Internet Explorer. In 2003 he was the first to boot linux directly from the harddisk of an unmodified XBOX through a buffer overflow in the XBOX font loader. In 2004 he founded the Hardened-PHP Project to develop a more secure version of PHP, known as Hardened-PHP, which evolved into the Suhosin PHP Security System in 2006. Since 2007 he works as head of research and development for the german web application company SektionEins GmbH that he co-founded.

Esteban Martínez Fayó

Argeniss

Esteban Martínez Fayó is a security researcher; he has discovered and helped to fix multiple security vulnerabilities in major vendor software products. He specializes in application security and is recognized as the discoverer of most of the vulnerabilities in Oracle server software. Esteban has developed and presented novel database attack techniques at international conferences such as Black Hat and WebSec. Esteban currently works for Argeniss doing information security research and developing security related software solutions.

Ben Feinstein

SecureWorks Counter Threat Unit

Ben Feinstein is Director of Research with the SecureWorks Counter Threat Unit(SM). He first became involved in information security in 2000, working on a DARPA / US Air Force contract. Ben is the author of RFC 4765 and RFC 4767. He has over a decade of experience designing and implementing security-related information systems. Ben's major areas of expertise include IDS/IPS, digital forensics and incident response, and secure messaging. In the past, he has presented at Black Hat USA, DEFCON, ToorCon, DeepSec, ACSAC, IETF meetings and others.

Carole Fennelly

Tenable Network Security

Carole Fennelly is an information security professional with over 25 years of hands-on experience in the computing technology field. She is the author of numerous articles for IT World, SunWorld and Information Security Magazine. A frequent speaker at security conferences, such as the Black Hat Briefings, her technical background includes in-depth security and administration knowledge of UNIX operating systems. Ms. Fennelly is presently the Director of Content and Documentation for Tenable Network Security.

David Fifield

Nmap Project

has been working on the Nmap security scanner and its associated tools for several years. He wrote the Ndiff scan comparison utility and has been active in the maintenance and enhancement of the Ncat network tool and the Zenmap GUI, as well as certain subsystems of Nmap such as the scripting engine. Much of his time has been spent improving Nmap's performance and accuracy. He has spoken previously about Nmap at the FOSDEM and LinuxTag conferences.

Andy Fried

Internet Systems Consortium

Andy Fried is currently a security researcher with Internet Systems Consortium (ISC), a nonprofit 501(c)(3) public benefit corporation dedicated to supporting the Internet community with software and professional services essential to its infrastructure. Mr. Fried is also the CEO of Deteque, a consulting and solutions provider for mitigating online threats. In 2008, Mr Fried retired from the United States Department of the Treasury, where he had been a Senior Special Agent for twenty years. Throughout his career with Treasury, he was involved in computer and network security.

FX

Recurity Labs

Felix "FX" Lindner runs Recurity Labs, a security consulting and research company in Berlin, Germany. FX has over 11 years experience in the computer industry, nine of them in consulting for large enterprise and telecommunication customers. He possesses a vast knowledge of computer sciences, telecommunications and software development. His background includes managing and participating in a variety of projects with a special emphasis on security planning, implementation, operation and testing using advanced methods in diverse technical environments. FX is well known in the computer security community and has presented his and Phenoelit's security research on Black Hat Briefings, CanSecWest, PacSec, DEFCON, Chaos Communication Congress, MEITSEC and numerous other events. His research topics included Cisco IOS, HP printers, SAP and RIM BlackBerry. Felix holds a title as State-Certified Technical Assistant for Informatics and Information Technology as well as Certified Information Systems Security Professional.

Fyodor

Insecure.Org

Fyodor (known to his family as Gordon Lyon) authored the open source Nmap Security Scanner in 1997 and continues to coordinate its development. He also maintains the Insecure.Org, Nmap.Org, SecLists.Org, and SecTools.Org security resource sites and has authored seminal papers on remote operating system detection and stealth port scanning. He is a founding member of the Honeynet project, former president of Computer Professionals for Social Responsibility (CPSR), and author or co-author of the books "Nmap Network Scanning", "Know Your Enemy:Honeynets" and "Stealing the Network: How to Own a Continent."

John Garris

NASA

John D. Garris is the Special Agent-in-Charge of the Computer Crimes Division (CCD), Office of Investigations, NASA Office of Inspector General. SAC Garris supervises all computer crimes investigations, as well as all computer forensic support operations, for the NASA OIG. NASA OIG's Computer Crimes Division (CCD) has had a number of successes with regard to investigating intrusions into NASA computer networks. CCD successes include joint investigations with U.S. and foreign counterparts that resulted in arrests, indictments and convictions of hackers located in Venezuela, Italy, Turkey, England, Portugal, Nigeria, Slovenia and Romania.

During 2004, then Lieutenant Colonel Garris, was the Chief of the Law Enforcement and Counterintelligence Center for the Department of Defense’s (DoD) Joint Task Force for Global Network Operations, Arlington, VA. He was the senior DoD law enforcement agent responsible for coordinating the computer intrusion investigations of all five DoD criminal and counterintelligence investigative agencies.

From 2001 to 2004, he was the director, Special Operations Division, Head Quarters, Air Force Office of Special Investigations (AFOSI), Andrews AFB, MD. He was the U.S. Air Force’s single manager for computer crimes investigations, technical services countermeasures, polygraph, and counterintelligence support to Information Operations. While deployed in support of Operation Iraqi Freedom during this time period, he served both as the Squadron Commander for AFOSI personnel stationed in Turkey, and as the Counterintelligence Coordination Authority for Task Force – North, U.S. Central Command.

Baptiste Gourdin

Stanford Computer Security Lab

Baptiste Gourdin is a student at the Stanford Computer Security Lab. He holds an Engineering degree in computer systems, networks and security. His research focuses on web and mobile devices security.

Lurene Grenier

Lurene Grenier manages the analyst/research team for the Sourcefire VRT, and is an active developer on the Metasploit Framework team. Her primary research revolves around the automation of exploit development when paired with intelligent fuzzing frameworks. She is an expert in reverse engineering, and has taught numerous well known professional security teams the skill. She was also responsible for the disassembly and patching of the high-profile Adobe Acrobat Reader JBIG2 0-day vulnerability.

Jeremiah Grossman

WhiteHat Security, Inc.

Jeremiah Grossman is the founder and CTO of WhiteHat Security. He is considered a world-renowned expert in Web security, is a co-founder of the Web Application Security Consortium, and was named to InfoWorld's Top 25 CTOs for 2007. Grossman is a frequent speaker at industry events including the Black Hat Briefings, RSA, CSI, HiTB, OWASP, ISSA, and a number of large universities. He has authored dozens of articles and white papers; is credited with the discovery of many cutting-edge attack and defensive techniques and is a co-author of XSS Attacks. Grossman is often quoted in the the business and technical press. Prior to WhiteHat, Grossman was an information security officer at Yahoo!

The Grugq

The Grugq is a pioneering information security researcher with over a decade of professional experience. He has worked extensively with digital forensic analysis, binary reverse engineering, rootkits, Voice over IP, telecommunications and financial security. The Grugq’s professional career has included Fortune 100 companies, leading information security firms and innovative start-ups. Currently living in Thailand, the Grugq works as a senior security researcher for Coseinc. While not on engagements, the Grugq continues his research on security, forensics and beer.

Claims to fame:

pioneered anti-forensics
developed “userland exec”
released voip attack software
decade of experience in info sec
long term liaison w/ digital underground
described as “extremely handsome” [by his mom]
1992 sussex County 3-legged race, 2nd place

The Grugq has spoken at dozens of conferences over the last 7 years; provided expert training courses to .gov, .mil, police and businesses; domain expertise on forensics, voip, telecommunications and financial systems.

Barry Grundy

US Treasury Dept

Barry J. Grundy serves as the Assistant Special Agent in Charge (ASAC) of the Treasury Inspector General for Tax Administration (TIGTA), Computer Investigative Support (CIS) Program. TIGTA CIS is responsible for conducting digital evidence collection and forensic analysis in support of investigations related to IRS assets, programs and tax administration. Prior to joining the Treasury Department, Grundy worked for the NASA Office of Inspector General, Computer Crimes Division as the Resident Agent in Charge of the Computer Crimes Division's East Region, responsible for the supervision of criminal investigations related to cyber events at all NASA Centers and facilities east of the Mississippi river. Prior to his federal career, Grundy was employed as a Special Agent for the Ohio Attorney General's Office, Health Care Fraud Unit, where he was responsible for the computer seizure and forensic media analysis support in addition to maintaining a normal health care fraud case load.

Throughout his career, ASAC Grundy has acted as an instructor for a number of federal, state, and local law enforcement training courses, including the Seized Computer Evidence Recovery Specialist (SCERS) course at the Federal Law Enforcement Training Center (FLETC) in Glynco, Georgia, Linux Forensics courses at NASA, and various courses at the Ohio Peace Officers Training Academy in London, Ohio. He has also been a guest speaker at numerous national and international conferences related to computer forensics, digital evidence collection and analysis, and network intrusion investigations. ASAC Grundy is the author of the Law Enforcement and Forensic Examiner’s Introduction to Linux, a Practitioner’s Guide, a document distributed by many computer forensic training organizations and academic institutions around the world.

Prior to his federal civilian service, ASAC Grundy spent five years as a Forensic Scientist at the Ohio BCI&I providing support to federal, state and local law enforcement agencies. Additionally, he served for six years in the United States Marine Corps in Reconnaissance Battalions as a Team Leader and Scout/Sniper.

Nathan Hamiel

FishNet Security

Nathan Hamiel is a Principal Consultant for FishNet Security’s Application Security Practice. He is also an Associate Professor of Software Engineering at the University of Advancing Technology. Nathan is an Information Assurance faculty member that is part of the university’s Center of Academic Excellence sponsored by the NSA and DHS. He spends most of his time focusing in the areas of application, Web 2.0, and enterprise security. Throughout his career Nathan has provided security guidance to everyone from Fortune 100 companies to government agencies. Nathan has been a speaker at security events around the world including:Black Hat, DefCon, ShmooCon, ToorCon, SecTor, and many others. Recently his talks have covered attacking everything from user-generated content to application programming interfaces.

Robert "RSnake" Hansen

SecTheory

Nick Harbour

MANDIANT

Nick Harbour is a Principal Consultant with Mandiant. He specializes in Malware Analysis and Incident Response as well as both offensive and defensive research and development. He also teaches malware analysis and reverse engineering. Nick's ten year history in the security industry began as a researcher and forensic examiner at the DoD Computer Forensics Lab (DCFL) where he helped pioneer the field of computer forensics. Nick is a developer of both free software including most notably dcfldd, the popular forensic disk imaging tool, tcpxtract, a tool for carving files out of network traffic and Mandiant Red Curtain and FindEvil, tools for identifying malicious binaries. He is also an expert in anti-reverse engineering technologies and has developed binary hardening tools such as PE-Scrambler. Nick is also a trained chef!

Melissa Hathaway

Harvard

Melissa Hathaway is President of Hathaway Global Strategies, LLC and a Senior Advisor at Harvard Kennedy School’s Belfer Center. Having served in two Presidential administrations, Ms. Hathaway brings a multi-disciplinary and multi-institutional perspective to strategic consulting and strategy formulation for public and private sector clients. She is raising public awareness by writing and speaking publicly about current real-world problems and is building information and research bridges among academic, industrial and government stakeholders.

From February 2009 to August 2009, Ms. Hathaway served in the Obama Administration as Acting Senior Director for Cyberspace in the National Security Council. In that capacity she assembled a team of experienced government cyber experts to conduct the 60-Day Cyberspace Policy Review. In May 2009, the President presented the elegant blueprint of the Cyberspace Policy Review, announced cybersecurity as one of his Administration’s priorities, and recognized Ms. Hathaway’s leadership in conducting the review. In the ensuing months, Ms. Hathaway stood-up the Cybersecurity Office within the National Security Staff to commence the work called for in that blueprint.

During the last two years of administration of President George W. Bush, Ms Hathaway served as Cyber Coordination Executive and Director of the Joint Interagency Cyber Task Force in the Office of the Director of National Intelligence. She built a broad coalition from within the Executive Branch and established an unprecedented partnership with Congress to obtain bipartisan support for addressing cybersecurity priorities. She developed and created a unified cross-agency budget submission for FY 2008 and for 2009-13, assembling disparate funding sources into a coherent, integrated program. One of the single largest intelligence programs of the Bush administration, the Comprehensive National Cybersecurity Initiative has been carried forward by the Obama administration. At the conclusion of her government service she received the National Intelligence Reform Medal in recognition of her achievements.

Previously, Ms. Hathaway was a Principal with Booz Allen & Hamilton, Inc., where she led two primary business units: information operations and long range strategy and policy support, supporting key offices within the Department of Defense and Intelligence Community. Earlier in her career she worked with Evidence Based Research, Inc. and the American Foreign Service Association.

Ms. Hathaway is frequent keynote speaker on cybersecurity matters, and regularly publishes papers and commentary in this field.

Gen Michael Hayden

General Michael Hayden served as director of the CIA and deputy director of National Intelligence at a time when the course of world events was changing at a rapidly accelerating rate. As the director of the country's keystone intelligence-gathering agency, he was on the frontline of geopolitical strife and the war on terrorism at a time when communication was being revolutionized. He understands the dangers, risks, and potential rewards in the political, economic, and security situations facing the planet.

Exclusively represented by Leading Authorities, General Hayden dissects the political situations in the hot spots in every corner of the world, analyzing the tumultuous global environment and what it all means for the American people and America's interests.

At the Center of Central Intelligence. After nearly forty years in the U.S. Air Force, General Hayden became director of the CIA in May of 2006, capping a career in service to the United States. Originally appointed by President Bill Clinton to the post of director of the National Security Agency (NSA), General Hayden became the longest-tenured NSA director, serving from 1999-2005. In that time, he worked to put a human face on the famously secretive agency. Sensing that the world of information was changing rapidly and that the Agency would also have to change to keep up with this new atmosphere, General Hayden directed an effort to explain to the American people the role of the NSA and also to make more visible on the national scene.

Strategic Command in Dangerous Times. From April of 2005 to May of 2006, General Hayden was the number one military intelligence officer in the country, serving as deputy director of National Intelligence. In this capacity, he oversaw the entire intelligence community, including the CIA, NSA, the National Geospatial-Intelligence Agency, and the National Reconnaissance Office. He directed all four agencies to make them work as a unit while maintaining the specialties and unique qualities that made them successful.

General Hayden entered active duty in the U.S.A.F. in 1969 after earning a bachelor's degree in history and a master's degree in modern American history, both from Duquesne University. In his military career, General Hayden served as commander of the Air Intelligence Agency and director of the Joint Command and Control Warfare Center. He has also served in senior staff positions at the Pentagon, at the headquarters of the U.S. European Command, at the National Security Council, and the U.S. Embassy in Bulgaria. The general has also served as deputy chief of staff for the United Nations Command and U.S. Forces in South Korea.

Craig Heffner

Seismic LLC

Craig Heffner's experience in IT security includes system analysis, network analysis, wireless / networking security and vulnerability discovery, and he is currently employed as a Senior Security Engineer for Seismic LLC. He frequently publishes various tools, papers and vulnerability reports, and has a special fondness for embedded devices, particularly any whose descriptions include the words "wireless" or "Web based administrative interface."

Charles Henderson

Trustwave

Charles Henderson is the Director of Application Security Services at Trustwave's SpiderLabs. He has been in the information security industry for over fifteen years. His team specializes in application security including application penetration testing, code review, and training in secure development techniques. The team's clients range from the largest of the Fortune lists to small and midsized companies interested in improving their application security posture. Charles routinely speaks at various conferences around the world on various subject matters relating to application security. Charles's team of deviants can be found at most Black Hat events where alcohol is served.

John Hering

Lookout

John Hering, co-founder of Lookout Mobile Security, specializes in mobile security research and development with a focus on intelligence and emerging threats. Past projects include the "BlueSniper" project, which resulted in a world-record-setting attack of a Bluetooth-enabled mobile device from a distance of over 1.12 miles. John has presented at leading security conferences such as Black Hat and DEFCON and his research has been featured in major publications such as The New York Times, Wired Magazine, and The Wall Street Journal. John studied Policy, Planning, and Development at the University of Southern California and has extensive experience with information security, policy, and wireless communications technologies.

Brad Hill

iSEC Partners

Brad Hill is a Principal Consultant and Director of SDL Services at iSEC Partners. Building on a background as a developer and architect in the financial services industry, he has spent much of the last three years assisting clients with the execution and planning of development lifecycle security activities. He also performs penetration testing, serves as an Invited Expert with the W3C XML Security Working Group and has been a speaker and trainer at numerous conferences.

Christofer Hoff

Cisco Systems

Christofer Hoff has over 19 years of experience in high-profile global roles in network and information security architecture, engineering, operations, product management and marketing with a passion for virtualization and all things Cloud.

Hoff is currently Director of Cloud and Virtualization Solutions of the Security Technology Business Unit at Cisco Systems. Prior to Cisco,he was Unisys Corporation’s Systems & Technology Division’s Chief Security Architect. Additionally, he served as Crossbeam Systems'’ Chief Security Strategist, was the Chief Information Security Officer for a $25 billion financial services company, and was founder/Chief Technology Officer of a national security consultancy. Hoff regularly speaks at high profile conferences, interviewed regularly by the media, is a featured guest on numerous podcasts and blogs at http://www.rationalsurvivability.com/blog. Hoff is a CISSP, CISA, CISM and NSA IAM. He was twice nominated as the Information Security Executive of the Year and won the Security 7 award in Financial Services in 2005.

Greg Hoglund

HBGary, Inc.

Greg Hoglund has been a pioneer in the area of software security. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding www.rootkit.com (rootkit.com) in the process. Greg went on to co-found Cenzic, Inc. (cenzic.com) through which he orchestrated numerous innovations in the area of software fault injection. He holds two patents. Greg is a frequent speaker at Black Hat, RSA and other security conferences. He is co-author of Exploiting Online Games (Addison Wesley 2007) and Rootkits: Subverting the Windows Kernel (Addison Wesley 2005) and Exploiting Software: How to Break Code (Addison Wesley 2004).

Robert Hopper

NW3C

Robert Hopper is Manager of NW3C Computer Crime Section is responsible for all aspects of management within the section including staff assigned throughout the country. Mr. Hopper retired with thirty years service with the Arizona Department of Public Safety and thirty-seven years in Law Enforcement. Mr. Hopper’s Law Enforcement career included assignments in Narcotics, Air Smuggling, White Collar Crime, Organized Crime and Advanced Officer Training. Mr. Hopper developed and managed the Arizona Department of Public Safety Regional Computer Forensics Lab.

Wayne Huang

Wayne Huang has extensive experience in the security industry and is a frequent speaker at security conferences including RSA (07, 10), SyScan (08, 09), OWASP (08, 09), Hacks in Taiwan (06, 07), WWW (03, 04), PHP (07) and DSN (04). He is the first author to achieve consecutive best paper nominations at the prestigious World Wide Web (WWW) Conferences (2003, 2004), and has a co-authored the Web Application Security chapter of “Computer Security in the 21st Century” (Springer US, 2005). Wayne is a PhD candidate at the EE, NTU, and has received his BS and MS in CS from NCTU.

Alexander Hutton

Verizon Business

Alexander Hutton is a Principal in Research & Risk Intelligence with Verizon Business. Over the past 15 years he's served a number of different roles (from grunt to executive) for various security companies.

He is a co-author of the Verizon Data Breach Investigation (2009), writes regularly for the Verizon Security Blog (http://securityblog.verizonbusiness.com). He's also a co-founder of The Society of Information Risk Analysts, and an author at the New School of Information Security blog (http://www.newschoolsecurity.com). Alex also contributes to the Cloud Security Alliance, ISM3 security management standard, the CIS metrics project and the Open Group Security Forum.

Mikko Hypponen

F-Secure

Mikko Hypponen is the Chief Research Officer for F-Secure Corporation. Mikko is based in Finland, yet he is a regular guest on CNN. He has been working with malware analysis for almost 20 years. Mikko does his own stunts.

Jon Iadonisi

Jon Iadonisi is the founder of White Canvas Group – a company that specializes in cultivating alternative and disruptive strategies. His depth of experience, diversified expertise, and unique operational background has provided a perspective that has enabled him to contribute to solving national security problems. He has spent the past fifteen years using innovative computing technologies coupled with cutting edge scholarship to solve complex problems, some of which later became implemented as new strategies and capabilities for the U.S. Government. He is regularly sought by the Department of Defense, various Intelligence agencies, and members of the US Congress to provide expert opinion and briefings on information age unconventional warfare. Prior to joining the private sector, Jon served as a Navy SEAL, where he designed, planned and led various combat operations that integrated innovative technologies and tactics into the operating environment, ultimately creating new capabilities for the Special Operations Community and Central Intelligence Agency. He is a combat-wounded and decorated veteran who earned a B.S. in Computer Science from the US Naval Academy, and M.S. in Homeland Security from San Diego State University. He is a member of the Council on Foreign Relations and guest lectures at San Diego State University and Georgetown Law School. He is an academic and athletic all American who participated in the 2000 Olympic Rifle team trials. He enjoys fine wine, good books, music, and outdoor activities.

Jibran Ilyas

Trustwave

Jibran Ilyas, is a Senior Forensic Investigator at Trustwave's SpiderLabs. He is a member of Trustwave's SpiderLabs -the advanced security team focused on penetration testing, incident response, and application security. He has investigated some of nations largest data breaches and is a regular contributor for published security alerts through his research. He has 7 years experience and has done security research in the area of computer memory artifacts. Jibran has presented talks at security conferences (DEFCON, SecTor) in the area of Computer Forensics and Cyber Crime. Jibran is also a regular guest lecturer at DePaul and Northwestern University. Prior to joining SpiderLabs, Jibran was part of Trustwave's SOC where he helped Fortune 500 clients with their Security Architectures and deployments. Jibran holds a Bachelors of Science degree from Depaul University and Masters degree in Information Technology Management from Northwestern University.

Vincenzo Iozzo

Zynamics

Vincenzo Iozzo is a student at the Politecnico di Milano where he does some research regarding malware and IDS. He is involved in a number of open source projects, including FreeBSD due to Google Summer of Code. He works as a reverse engineer for Zynamics GmbH.

Barnaby Jack

IOActive Labs

Barnaby Jack is the Director of Research at IOActive Labs, where he focuses on exploring new and emerging threats, and recommending areas in which to concentrate IOActive's research efforts.

Jack has over 10 years experience in the security research space and previously held research positions at Juniper Networks, eEye digital Security, and FoundStone. Over the course of his career, Jack has targeted everything from low-level Windows drivers to the exploitation of Automated Teller Machines. He has subsequently been credited with the discovery of numerous vulnerabilities, and has published multiple papers on new exploitation methods and techniques.

Jeff Jarmoc

SecureWorks

Jeff Jarmoc has over 10 years experience as a network and security infrastructure engineer for major financial services and healthcare companies. This background gives him a unique operational focus to security research and a holistic real world understanding of the challenges we as an industry face. In his role as a Security Engineer at SecureWorks, he's responsible for acting as subject matter expert on all operational aspects of infrastructure and network security. He's been credited with discovery of several vulnerabilities and bugs in major security appliances.

Noah Johnson

University of California, Berkeley

Noah Johnson is currently pursuing his Ph.D. in Computer Science at UC Berkeley. As a member of Professor Dawn Song's BitBlaze group, his research includes investigation and development of automated binary analysis techniques for analyzing malicious code and building effective defenses against malware. More information about BitBlaze is at http://bitblaze.cs.berkeley.edu.

Dan Kaminsky

Recursion Ventures

Dan Kaminsky: chief scientist, Recursion Ventures

Samy Kamkar

Samy Kamkar is best known for the Samy worm, the first XSS worm, infecting over one million users on MySpace in less than 24 hours. A co-founder of Fonality, Inc., an IP PBX company, Samy previously led the development of all top-level domain name server software and systems for Global Domains International (.ws).

In the past 10 years, Samy has focused on evolutionary and genetic algorithmic software development, Voice over IP software development, automated security and vulnerability research in network security, reverse engineering, and network gaming. When not strapped behind the Matrix, Samy can be found stunt driving, getting involved in local community service projects, and continuing his focus on staying out of jail.

David Kane-Parry

Leviathan Security Group

David Kane-Parry has over eight years of professional experience in security research and engineering for a wide variety of Fortune 500 companies. David is currently a Principal Security Consultant for Leviathan Security Group.

Rami Kawach

Qualys

Rami Kawach is a Software Architect at Qualys, responsible for the development of web based malware detection services. He specializes in highly scalable client server architectures, self-learning expert systems, as well as automated exploit detection and analysis. Prior to Qualys, he spent ten years at Microsoft where he most recently headed up Microsoft's botnet monitoring and mitigation efforts. Rami holds a Bachelor's of Engineering from Carleton University and has extensive experience in performance tuning mission critical systems. He has been responsible for projects ranging from MSN's ad serving, personalization and behavioral targeting platform to Microsoft‚Äôs enterprise antivirus offering, Forefront Client Security.

Joshua Kelley

Nathan Keltner

FishNet Security

Nathan Keltner, is a consultant on FishNet Security's Assessment team, breaking into (and out of) corporate networks for a living. In between post exploitation activities, he's frequently breaking Smart Grid infrastructure and arguing why Oklahoma might well be the greatest state in the Union.

David Kennedy

David Kennedy (ReL1K) is a security ninja that likes to write code, break things, and develop exploits when he has spare time. Heavily involved with BackTrack and the Social-Engineer Framework, David continues (and strives) to contribute to a variety of open-source projects. David had the privilege in speaking at some of the nations largest conferences including Defcon and Shmoocon. David is the creator of the Social-Engineer Toolkit (SET), Fast-Track, modules/attacks for Metasploit, and has (responsibly) released a number of public exploits, including attacks that affect some of the largest software vendors in the world. David heavily co-authored the Metasploit Unleashed course available online and has a number of security related white-papers in the field of exploitation.

Currently David is a Director and Regional Security for an international multi-billion dollar Fortune 1000 organization and is in charge of ensuring that security is maintained in over 60 different countries. He has a team of highly skilled security professionals that ensure the organizations systems are protected against attack.

Prior to his current responsibilities at his current employer, David was a Partner and Vice President of a large information security consulting firm where he led a team of highly skilled and trained security professionals and performed thousands of penetration tests and security assessments across the world for a number of large Fortune 100, 500, and 1000 organizations. Lastly, David served as a United States Marine working directly for the intelligence community and deployed twice to Iraq in support of Operation Iraqi Freedom where he was the youngest Marine to receive multiple awards for recognition for going above and beyond in his battalion. David also developed a number of highly technical and cutting edge systems for the Marine Corps that were utilized on missions across the world. Towards the end of his military career, David was an instructor for the intelligence community on security related programs.

Dan King

SecureWorks

Dan King is a penetration tester with SecureWorks, where he is responsible for penetration, web application, and PCI compliance testing for both Fortune 500 and small-to-medium size businesses that operate in compliance sensitive industries. In addition, he performs vulnerability research, currently focusing on vulnerability discovery using fuzzing techniques, with several public disclosures to his credit. He enjoys exposing flaws in client-side document formats and likes nothing better than to break security products to expose threats. In previous roles, he served in a market leading Security Operations Center to provide IDS analysis and incident response services to a global base of monitored clients.

Tim Kornau

Zynamics

Tim Kornau is a developer and researcher at the zynamics GmbH. He has studied at the Ruhr-University in Bochum Germany and has a master in IT-Security. He has held lectures at the Ruhr-University Bochum mostly about offensive computer security and Malware research.

Lee Kushner

LJ Kushner and Associates, LLC

is the President of LJ Kushner and Associates, LLC, an Executive Search firm dedicated exclusively to the Information Security industry and its professionals. For the past thirteen years, he has successfully represented Fortune 2000 companies, information security software companies, information security services organizations and large technology firms in enabling them to locate, attract, hire, and retain top level information security talent. Throughout his career, he has provided career management and career coaching to information security professionals at various stages of their professional development. He is a regular speaker and industry contributor on topics that include career planning, interview preparation, and employee recruitment and retention. His thoughts on Information Security career management can be found at www.infosecleaders.com

Anthony Lai

Anthony Lai has worked on code audit, penetration test, crime investigation and threat analysis and acted as security consultant in various MNCs. After attending to Blackhat and Defcon since 2007, Anthony is inspired and has set up a research group, lining up various hackers in Hong Kong and studying exploit, reverse engineering, analyse threat and join CTFs. After dissecting a content censorship software called Green Dam made by China, it would be good for him boost this China-made security wind in malware analysis and advanced persistent threat areas.

Nate Lawson

Root Labs

Nate Lawson, founder of Root Labs, assists companies with the design of embedded security and cryptography. At Cryptography Research, Nate co-developed the Blu-ray content protection layer known as BD+. He is also the original developer of IBM/ISS RealSecure. Previous talks include common developer crypto mistakes and security flaws in the Fastrak RFID toll system.

Long Le

Long Le, CISA, is a security manager at one of the largest software outsourcing companies in Vietnam. He has been actively involved in computer security for more than 10 years since he and his friends founded the pioneer Vietnamese security research group VNSECURITY (http://vnsecurity.net). Described as neither a researcher nor a hacker, he loves playing wargames and Capture-The-Flag with the CLGT team in his spare time. In 2007 he was an organizing and technical committee member of VNSECON -the first international security conference in VN.

Anthony Lineberry

Anthony Lineberry is a security researcher from Los Angeles who has been active in the security community for many years, specializing in reverse engineering code, researching vulnerabilities, and advanced exploitation development. He has written an open source kernel from scratch, helped with the first iPhone jailbreak, and feels uncomfortable speaking in the 3rd person. Professionally his experience includes working as a security researcher for McAfee, NeuralIQ, and currently with Lookout. He has spoken previously at SCaLE and BlackHat EU/US.

David Litchfield

v3rity

David Litchfield is recognized as one of the world's leading authorities on database security. He is the author of the Oracle Hacker's Handbook, the Database Hacker's Handbook and SQL Server Security and is the co-author of the Shellcoder's Handbook. He is a regular speaker at a number of computer security conferences and has delivered lectures to the National Security Agency, the UK's Security Service, GCHQ and the Bundesamt für Sicherheit in der Informationstechnik in Germany.

In 2010, David was listed by CRN as a "Security Superstar" and in 2003 he was voted as the "Best Bug Hunter" by Information Security Magazine. In the same year he discovered and developed two methods to bypass the exploit prevention mechanisms built into Microsoft's Windows 2003 Server and consequently worked with Microsoft to improve them. He has found and helped to fix 24 security flaws in SQL Server, including the vulnerability that was exploited by Slammer, 17 in IBM's DB2, 22 in Informix and, somewhere in the hundreds, has lost count of the number in Oracle. In February 2008 David discovered a new class of vulnerability in Oracle that can lead to "Lateral SQL Injection" and, in the November of 2006, another new class of vulnerability in the same RDBMS that can lead to "cursor snarfing" attacks. Both are general programming flaws, that can lead to data compromise. David pioneered major advancements in Oracle forensics and has authored 7 technical papers since March 2007 on the topic.

David recently founded V3rity, a new venture, that will develop new tools for use in breach investigations. Until February 2010, David was Chief Research Scientist at NGSSoftware, a UK computer security services and software company he founded in 2001. NGSSoftware was acquired by NCC Group in November 2008. In 2007 NGSSoftware was awarded the Queen's Award for Enterprise, and was listed as one of the UK's fasted growing tech companies by both Deloitte and the Sunday Times. NGSSoftware was winner in the Best Security Company category in the 2008 European SC Magazine Awards and runner up in 2007. Previously David was Director of Research at @stake after his first company, Cerberus Information Security, was acquired in July 2000.

In May 2008, David was named the "Entrepreneur of the Year" at the South London Business Awards 2008.

Prior to starting a career in computer security David competed as a track and field athlete for Scotland. He was the Scottish Under 20 Champion for both the long jump and decathlon and is the holder of the Scottish Schools Indoor record for long jump.

Kevin Mahaffey

Lookout

Kevin Mahaffey is the CTO of Lookout, which he co-founded in 2007. He started programming when he was 8 years old and it has been a love affair ever since. When not at the office, Kevin can be found hacking in various coffee shops around San Francisco. Kevin is a frequent speaker on security, mobile, and other topics, having recently spoken at Blackhat, Defcon, Yahoo Security Week, and Microsoft's Bluehat Conference. Kevin studied Electrical Engineering at the University of Southern California and enjoys photography, snowboarding, unit tests, clean code, and building things that make people happy.

Kevin Manson

Kevin Manson: Secure Online Community Architect.

1970's State Prosecutor and Magistrate.

1980's - Coined the term "Cybercop", Staff counsel on US Senate Judiciary Committee.

1990's - Co-founded Cybercop Portal, a Department of Homeland Security endorsed, secure online information sharing community with a DARPA pedigree serving over 14,000 law enforcement and industry users as well as 4,000 INFRAGARD members. Cybercop was founded to strengthen our nation's "CyberCivil Defense" in support of Presidential Decision Directive 63 (URL: http://www.cybercopportal.com)

At the Federal Law Enforcement Training Center (FLETC), pioneered Internet investigations training and in the early 90's developed the Cybercop BBS, (Wildcat), the first online community for federal law enforcement agents. Designed, developed and deployed new training initiatives for "Digital Officer Safety", Data Mining and Internet Investigations for federal agents at the FLETC. (URL: www.fletc.gov)

2000's - Co-Keynoted at Black Hat 2001 with FBI UNABOM'er profiler William Tafoya ("The elite are not those who destroy or cause havoc in cyberspace, but rather [those who work] to protect the Net," URL: http://archives.cnn.com/2001/TECH/internet/07/16/black.hat.conference.idg/ ). "Meet the Fed" panelist. Member of the US Secret Service New York Electronic Crimes Task Force. Collaborating with field experimentation teams at the Naval Postgraduate School regarding Secure Trusted Proxy networks, UAV and Robotics technologies (Cooperative Operations and Applied Science and Technology Studies). Member of International Association of Chiefs of Police Cyber Crime and Digital Evidence WorkGroup and Chairs the Ethics Committee for the Digital Forensics Certification Board http://ncfs.ucf.edu/dfcb/ Kevin is regularly involved in building hastily formed technology accelerations teams for national security and public safety in support of those who serve behind the "thin digital blue line" with his group of "Usual Suspects" Now recruiting world-class cybercops for his new Cybercop Training Team and serving as liaison-at-large and recruiter for the all volunteer attack attribution "Project Vigilant" www.jugiterviglio.us

Moxie Marlinspike

Institute For Disruptive Studies

Moxie Marlinspike does research with the Institute For Disruptive Studies. He also holds a 50 Ton Master Mariner's license.

Richard H.L. Marshall, Esq.

DHS

Richard H.L. Marshall, Esq., a member of the Senior Cryptologic Executive Service (SES) and the Defense Intelligence Senior Executive Service (DISES), is the Director of Global Cyber Security Management at DHS by special arrangement between the DIRNSA and the Secretary of Homeland Security. He is responsible for the direction of the following programs: Software Assurance; Standards and Best Practices; Supply Chain Risk Management; and Cyber Training and Education.

He was previously the Senior Information Assurance (IA) Representative, Office of Legislative Affairs at the National Security Agency (NSA). NSA’s Legislative Affairs Office is the Agency’s point of contact for all NSA matters concerning Congress and is committed to maintaining a relationship with Congress built on trust, candor, completeness, correctness, consistency, and corporateness.

As an additional duty, Mr. Marshall also represented NSA in the National Centers of Academic Excellence in Information Assurance Program in Boston, Massachusetts and the Detroit, Michigan areas where he led the effort to establish an International Consortium on Information Assurance. His successes were noted and praised by the Director, NSA.

Mr. Marshall is a sophisticated senior executive level leader recognized and appreciated for his political savoir-faire and common sense coupled with a polished ability to build meaningful relationships and achieve positive results. Highly respected by White House (National Security Council) and Congressional staffers, Department of Defense, Department of Homeland Security, Department of the Treasury and private sector leaders – particularly the financial services sector – for his subject matter expertise and skills in policy formulation and ardent advocacy, Mr. Marshall commands a deep understanding and appreciation for the full range of Information Assurance-related legal, legislative and policy issues.

He is highly sought after as a keynote speaker, panelist and moderator at information technology, legal and policy symposia and conferences both here and abroad. He is a nationally recognized, respected and articulate advocate of the need for the private and public sectors to work together to improve information assurance and business continuity practices, policies and technology. He has addressed various international, Department of Defense, Army, Navy and Air Force legal conferences on information operations, information assurance and critical infrastructure assurance, twice sharing the podium with the Secretary of the Air Force and once with the former Vice-President of the United States.

He has testified before numerous Congressional subcommittees and has distinguished himself as a guest lecturer at the National Defense University (NDU), the Industrial College of the Armed Forces, Stanford University, George Mason University, George Washington School of Law, Boston University, Duke University, the University of Virginia, University of Detroit-Mercy, The Harvard Club, and numerous graduate and law schools on a myriad of legal issues related to national security and information assurance.

He was recently recognized by CS Magazine, the world’s most influential IT publication as one the nation’s most influential cyber security professionals who have helped shape the information security industry.

Mr. Marshall successfully represented the United States in two high profile cases in the United Kingdom: a civil matter for the USAF with an amount in controversy of almost a billion dollars and a criminal matter for GCHQ and NSA where he appeared before the High Court of Justice in London as the lead US Counsel. In each case, in large measure through his efforts, the United States prevailed.

Doug Maughan

DHS

Dr. Doug Maughan is a Program Manager in Homeland Security Advanced Research Projects Agency (HSARPA) within the Science and Technology (S&T) Directorate of the Department of Homeland Security (DHS). Doug is directing the Cyber Security Research and Development activities at HSARPA. Prior to his appointment at DHS, Doug was a Program Manager in the Advanced Technology Office (ATO) of the Defense Advanced Research Projects Agency (DARPA) in Arlington, Virginia. His research interests and related programs were in the areas of networking and information assurance. Prior to his appointment at DARPA, Doug worked for the National Security Agency (NSA) as a senior computer scientist and led several research teams performing network security research. Doug received bachelors degrees in Computer Science and Applied Statistics from Utah State University, a master’s degree in Computer Science from Johns Hopkins University, and a PhD in Computer Science from the University of Maryland, Baltimore County (UMBC).

Haroon Meer

thinkst

Haroon Meer is a lead researcher at thinkst, an applied research company with a deep focus on Information Security. Haroon has contributed to several books on Penetration Testing and Security and is a regular speaker at both academic and industry conferences around the world. He still doesn't drink Tea or smoke Camels...

Leandro Meiners

Core Security Technology

Leandro Meiners works at CORE Security Technologies as a senior security consultant, and has been in the security industry working as a consultant for the past six years (the last three at CORE Security Technologies), focusing on penetration testing, both at the network (wired and wireless) and application level, having performed engagements for top-grade private and public international organizations.

Allison Miller

Paypal

Allison Miller manages PayPal's Account & Identity Risk team, responsible for protecting PayPal customers from fraud. Allison has over 10 years of experience in risk management and security, and currently focuses on leveraging network graph data to improve fraud detection and designing risk controls for new accounts. Miller is active in the security community and presents research on fraud prevention and account security issues regularly to both industry and government audiences, including the ITWeb Security Summit, SOURCE Boston, and RSA. Prior to joining PayPal, Miller was Director of Product and Technology Risk at Visa International.

Charlie Miller

ISE

Charlie Miller is currently Principal Analyst at Independent Security Evaluators. He was the first with a public remote exploit for both the iPhone and the G1 Android phone. He won the CanSecWest Pwn2Own competition for the last three years. Popular Mechanics listed him as a Top 10 Hacker of 2008 and he is on the list of 2010 Security Superstars by Channel Web. He has authored two information security books and holds a PhD from the University of Notre Dame.

Chris Mitchell

RCMP

Chris Mitchell is a forensic software developer with the Royal Canadian Mounted Police's Technological Crime Branch. He holds a B.Sc. in Software Engineering from the University of Ottawa. His work over the past 6 years has involved Internet anonymity, file system forensics, and scalable content management.

John Mitchell

Stanford

John Mitchell is a Mary and Gordon Crary Family Professor, Professor of Computer Science and (by courtesy) Electrical Engineering, Stanford. Research Interests include: Computer security, access control, network protocols, privacy, software systems, and web security. Programming languages, type systems, object systems, and applications of mathematical logic to computer science. B.S. Stanford University; M.S., Ph.D. MIT.

Paul Mockapetris

Nominum

Paul Mockapetris is Chairman and chief Scientist at Nominum, a company which supplies DNS and DHCP software to carriers and others. Paul is the inventor of the DNS protocol, and was the first implementer of SMTP. He believes he put the "S" in SMTP, and that complexity is the enemy. He is the veteran of several Silicon Valley successes and disasters.

Christopher Mooney

Nominum

Christopher Mooney is a software engineer that works in the high performance and high availability problem space. He has a B.S. in Computer Science and a minor in Mathematics from the University of Southern Maine. He is currently one of the coders at craigslist (http://craigslist.org/), and is the acting executive director of Project DoD Inc. (http://home.dod.net/), a 501(c)(3) charitable technology nonprofit with a focus on censorship resistant services. He has always been interested in computer security, and has focused a good deal of time on cryptology and computer security research. For more information about Christopher Mooney you can visit his web page at: https://chris.dod.net/.

Shawn Moyer

FishNet Security

Shawn Moyer spent four years at the Cleveland School of Metaphysics, where he met with such great success in his ontology research that the school, provably, no longer exists.

Following that, Shawn studied business writing with Dr. Lazlo Toth, producing a groundbreaking work linking colon frequency in email correspondence in the plastics industry to a rise in factory floor accidents.

Today, Shawn works as a Principal Consultant with FishNet Security's assessment team, helping customers transform critical infrastructure vulnerabilities into PDF documents.

Mike Murray

MAD Security / The Hacker Academy

Mike Murray is an information security professional and co-founder of Information Security Leaders. Mike has a passion for the human side of the industry and career development. He co-founded Information Security Leaders with Lee Kushner as an outlet to assist the industry in developing more fulfilling and rewarding careers. As a life-long information security professional and entrepreneur, Mike has held diverse positions in the industry. He has run security research and development teams, served in corporate information security functions, and has helped guide a large number of information security professionals in their career. Mike is part of a wide-ranging set of projects including the Connected Career, his projects with Michael Murray and Associates and the company that he runs on a daily basis (MAD Security / The Hacker Academy).

Ben Nagy

COSEINC

Ben Nagy is a senior security researcher with COSEINC, and recently moved from Kuala Lumpur to hack with a view of the mountains in Kathmandu. For over a year he has been exploring ways to improve fuzzing scalability, especially against complex, closed source targets like Windows and Office. Previously working on liver destruction with eEye in Geneva and Bangkok, Ben has written whitepapers on a number of subjects and presented at conferences in Europe, Asia and Australia. Ben is probably that guy over there drinking beer and talking about Ruby.

Taylor Nelson

Karsten Nohl

Karsten Nohl unifies the worlds of scientific research, hacking laboratories, and corporate risk management in executing high impact security projects. His research focuses mainly on privacy protection in popular technologies such as RFIDs and phones. His hacking projects disclose and usually break proprietary cryptography. Through his consulting projects, Karsten designs 'secure enough' technologies in private and public applications.

Steve Ocepek

Trustwave

Steve Ocepek is the Director of Security Research at SpiderLabs, the advanced security team within Trustwave focused on forensics, ethical hacking, and application security testing for premier clients. Steve has been messing around with network security since 2001, when he unintentionally connected his new wireless card to an Oracle database cluster. From there, he started one of the first NAC companies, authored four patents, and got bought out twice. Steve holds a CISSP, and can be talked into almost anything that involves robots and PBR.

Hernan Ochoa

Hernan Ochoa is an Independent Security Consultant / Researcher with 14 years of experience.

Began professionally in 1996 with the creation of the Virus Sentinel antivirus software (file/memory/mbr/boot sector detection/removal, signature based with heuristics to detect polyformic viruses), virus database with detailed technical description and SWAN newsletter.

Joined Core Security Technologies in 1999 and worked there for 10 years; began as a security consultant and exploit writer, then moved to the design and development of several low-level/kernel components of a multi OS security system (win3.1/win95/winnt/novell/DOS) to be installed in a financial institution (later simplified and released publicly as CORE FORCE) also acting as the "technical lead" for anything related to the aforementioned OSes. Finally moved back to the consulting department as the Expert Security Consultant performing security assessments, developing methodologies, security tools and contributing to CORE IMPACT with new attack vectors,developing modules and shellcode.

Tools published include Universal Hooker (runtime instrumentation using dynamic handling routines using python) Pass-The-Hash Toolkit for Windows and WifiZoo among others.

Currently he works as an independent security consultant / researcher.

Jeongwook Oh

Jeongwook Oh started his career as a firewall developer back in mid 90s. After that he spent few years doing security audits and penetration testing. Finally, he moved to California and joined eEye crew and did some IPS stuff. It involved userland and kernel land hacking stuff. Now he's working for WebSense Inc where he's doing researches related to malware and exploit detection.

Gunter Ollmann

Gunter Ollmann has a long-held passion for threat research and currently serves as Vice President of Research at Damballa, where he is focused on inventing new crimeware mitigation technologies and the identification of criminal operators behind botnets and other advanced persistent threats. Prior to joining Damballa, he held the role of Chief Security Strategist at IBM, was responsible for predicting the evolution of future threats and helping guide IBM's overall security research and protection strategy, and was the key IBM spokesperson on evolving threats and mitigation techniques. Ollmann also served as the Director of X-Force at Internet Security Systems where he was responsible for the company's R&D advancements and the development of security technologies in the field of vulnerability scanning, intrusion prevention, web application protection, and malware detection.

Over the years, Ollmann has been responsible for leading the development of new security consulting and penetration testing methodologies. Leading specialist consulting teams throughout Europe, the Middle East, and Africa, he headed ISS' X-Force consulting services in EMEA and served as Director of Professional Services at NGS Software, a vulnerability research and attack-based consulting firm. Ollmann has been a contributor to multiple leading international IT and security-focused magazines and journals, and has authored and delivered a number of highly technical courses on Web application security and penetration testing. He is a well-known industry speaker worldwide and is frequently invited to present at international security conferences. Ollmann is also highly regarded in the press as an expert source on security threats and is a frequently quoted by the international media.

Chris Paget

Chris Paget has over a decade of experience as an information security consultant and technical trainer for a wide range of financial, online, and software companies. Chris' work is increasingly hardware-focused, recently covering technologies such as GSM and RFID at venues such as Defcon, Shmoocon, and CCC. With a wide range of experience encompassing software, networks, radio, cryptography and electronics, Chris enjoys looking at complex systems in unusual ways to find creative attacks and solutions.

Tom Parker

Securicon

Tom Parker is the Director of Security Consulting Services at Securicon. Tom is a recognized throughout the security industry for his research in multiple areas including adversary profiling and software vulnerability research & analysis. Tom has published over four books on the topic of information security including Cyber Adversary Characterization -Auditing the Hacker Mind and a contributor to the popular Stealing the Network Series. Tom is a frequent speaker at conferences including a past speaker at Blackhat. Tom often lends his time to guest lecturing at Universities, involvement in community research initiatives, and is often called to provide his expert opinion to mass media organizations, including BBC News, CNN, and online/print outlets such as The Register, Reuters News, Wired and Business Week.

Meredith L. Patterson

Meredith L. Patterson is an independent researcher whose areas of expertise range from CS-related topics such as database design, data-mining algorithms, complexity theory, computational linguistics, information security, and privacy-enhancing technology systems; to synthetic biology, design of transgenic organisms using low-cost, build-it-yourself lab equipment, and human metabolic system studies; and speculative fiction as a published author of multiple short stories, mostly science fiction.

Meredith has a BA in Linguistics from the University of Houston and a MA in Linguistics from the University of Iowa. She is heavily involved with the DIYBio movement, and works on transgenic lactic acid bacteria. She co-founded the field of language-theoretic security research, which she used to successfully defeat such troublesome attacks as SQL injection with her "Dejector" library. Most recently, she presented the Biopunk Manifesto at a UCLA synthetic biology conference, and presented her work with Dan Kaminsky and Len Sassaman on breaking the Internet's certificate authority system (by creating usable, bogus certificates crafted to exploit ambiguity in X.509 parsing implementations using language-theoretic security analysis principles) at the Financial Cryptography 2010 conference.

Meredith lives in Leuven, Belgium. In her spare time, she knits, repairs cars, and hacks on open source software. This is her second Black Hat presentation.

Nicholas J. Percoco

Trustwave

Nicholas J. Percoco is the head of SpiderLabs at Trustwave -the advanced security team that has performed more than 750 cyber forensic investigations globally, thousands of penetration and application security tests for Trustwave clients. In addition, his team is responsible for the security research that feeds directly into Trustwave's products and services through real-time intelligence gathering. He has more than 15 years of information security experience. Nicholas acts as the lead security advisor to many of Trustwave's premier clients by assisting them in making strategic decisions around various security and compliance regimes. As a speaker, he has provided unique insight around security breaches and trends to public and private audiences throughout North America, South America, Europe, and Asia including security conferences such as Black Hat, DEFCON, SecTor and You Sh0t the Sheriff. Prior to Trustwave, Nicholas ran security consulting practices at both VeriSign and Internet Security Systems. Nicholas holds a Bachelor of Science in Computer Science from Illinois State University.

Tomislav Pericin

Founder, ReversingLabs

Tomislav Pericin has been analyzing and developing packing and protection methods for the last 7 years. He is the chief architect for TitanEngine, 400+ function open source platform for file analysis. In addition, he is author of "the Art of Unpacking" and founder of the commercial software protection project RLPack.

Jonathan Pollet

Red Tiger Security, LLC

Jonathan Pollet, Founder and Principal Consultant for Red Tiger Security, has over 10 years of experience researching vulnerabilities and conducting field security assessments of Industrial Process Control Systems, SCADA Systems, Automated Meter Reading systems, and Smart Grid technology. After graduating from the University of New Orleans with honors and receiving a B.S. degree in Electrical Engineering, he was hired by Chevron and worked in the SCADA and Automation Team for the Upstream Exploration & Production division. Pollet designed and implemented PLC and SCADA systems for several offshore and onshore facilities.

Realizing the potential security implications of the industry moving towards TCP/IP communications in the late 1990s, and seeing a trend to connect SCADA systems to Enterprise IT networks, Pollet started investigating SCADA, Process Control Systems, and embedded devices for cyber security vulnerabilities.

Throughout his career, he has been actively involved with the IEEE, ISA, ISSA, UTC, CSIA, and other professional societies. Pollet has been involved in over 110 vulnerability assessments of plant and process control systems. He has also delivered over 75 presentations and training sessions on SCADA Systems, Critical Infrastructure Protection, and SCADA Security to the FBI, Department of Homeland Security, and several private sector security conferences. He has spoken at many conferences and workshops for government and professional organizations around the world. Pollet has also authored over 25 white papers, all specifically on the security of SCADA and embedded control systems.

Ken Privette

USPS IG

Ken Privette serves as the Director, Computer Crimes Unit, a component of the United States Postal Service Office of Inspector General providing computer crime and digital forensics support to investigators from the United States Postal Service Office of Inspector General. He and his team of digital forensic examiners/agents have pioneered state-of-the- art initiatives such as remote forensics and the development of forensic tools such as eInvestigator – an online forensic collaboration tool for sharing, parsing and searching digital evidence.

Ken spent much of his professional life as a Special Agent with the Naval Criminal Investigative Service both overseas and state-side where he conducted investigations involving computer crime, terrorism, and counterintelligence matters. He has worked in assignments at the Department of Defense Computer Emergency Response Team and served as an instructor in the Computer Forensics, Investigation and Response course for the SANS Institute.

Lastly, Ken serves as Chairman for the Credentialing and Applications Committee on the National Institute of Justice sponsored Digital Forensics Certification Board (DFCB). The DFCB has created a digital forensics certification program open to both law enforcement and civilian professionals.

Jason Raber

Jason Raber has spent 9 years in the world of reverse engineering, preceded by 5 years working at Texas Instruments developing compiler tools for DSPs (code generators, assemblers, linkers, disassemblers, etc). Developing C compilers for 5 years prior to reverse engineering provided a good foundation for understanding machine language and hardware that is commonly utilized in reverse engineering tasks. Jason has significant experience in extracting intellectual property from a broad spectrum of software, including user applications, DLLs, drivers, OS kernels, and firmware, on a variety of platforms (Windows/Linux/Mac/embedded). He has also worked on identifying and analyzing malware to characterize it and/or neutralize it. Jason has also presented at 2 different Black Hat Cons, Recon 2008, and WCRE 2008. Jason currently serves as a team lead for a software assessment team in the United States Air Force Research Laboratory, providing the DoD with specialized software security support.

Tiffany Rad

Tiffany Strauchs Rad, MA, MBA, JD, is the President of ELCnetworks, LLC., a technology, law and business development firm with offices in Portland, Maine and Washington, D.C. Her consulting projects have included business and tech analysis for start-ups and security consulting for U.S. government agencies. She is also a part-time Adjunct Professor in the computer science department at the University of Southern Maine teaching computer law and ethics and information security. Her academic background includes study of international law and policy at Carnegie Mellon University, Oxford University, and Tsinghua University (Beijing, China). Tiffany also researches car computers, is President of the reverse engineering and development company, Q Labs, is the Director/Founder of Reverse Space, a hacker space in Northern Virginia, and is pro bono legal counsel for Project DoD, a non-profit hosting company.

Rob Ragan

Rob Ragan is a Security Associate at Stach & Liu, a security consulting firm providing IT security services to the Fortune 500 and global financial institutions as well as U.S. and foreign governments. Before joining Stach & Liu, Rob served as Software Engineer with the Application Security Center team of Hewlett-Packard (formerly SPI Dynamics) where he developed automated web application security testing tools, performed penetration tests, and researched vulnerability assessment and identification techniques. Rob has presented his research at leading conferences such as InfoSec World and has published several white papers and is a contributing author to the upcoming Hacking Exposed:Web Applications 3rd edition.

Enno Rey

Enno Rey is a long time network geek with extensive knowledge in the protocol and device security space. Some people like to play with model railways, some with toys from Cupertino... I just like to play with high end network equipment.

David Luke Richardson

Lookout Mobile Security

David Luke Richardson is a Senior Software Engineer at Lookout Mobile Security. He writes security software for mobile phones including Android, Windows Mobile, BlackBerry and iPhone. He was the President of the University of Southern California ACM in 2008-2009 and received an award for "Outstanding Service In Computer Science" -whatever that means. His interests are primarily in Application Development and User Experience. In his free time he enjoys not knowing how to ride a bicycle.

Ivan Ristic

Qualys

Ivan Ristic is a respected security expert and author, known especially for his contribution to the web application firewall field and the development of ModSecurity, the open source web application firewall. He is also the author of Apache Security, a comprehensive security guide for the Apache web server, and ModSecurity Handbook, the definitive guide to the popular open source web application firewall. He founded SSL Labs, a research effort focus on the analysis of the real-life usage of SSL and the related technologies. A frequent speaker at computer security conferences, Ivan is an active participant in the application security community, a member of the Open Web Application Security Project (OWASP), and an officer of the Web Application Security Consortium (WASC). He currently works for Qualys as Director of Engineering, Web Application Firewall and SSL Services.

Robert D. Rodriguez

SINET

Robert D. Rodriguez is the Chairman and Founder of the Security Innovation Network (SINET) www.security-innovation.org The mission of SINET is to enable innovation and collaboration between public and private entities to defeat global cyber security threats, promote small business growth, innovation and enhanced awareness of available technologies into the Federal Government and industry cyber security critical infrastructures. SINET is supported by the Department of Homeland Security - Science & Technology and corporate and public sponsorships. Mr. Rodriguez retired after twenty-two years as a Special Agent with the United States Secret Service. His executive protection experience spanned 11 years at the White House serving Presidents Ronald W. Reagan, George H. Bush, William J. Clinton, George W. Bush, Vice President Dan Quayle and numerous Heads of State.

For the last two and a half years of his career Mr. Rodriguez managed Secret Service operations for the Northern District of California and spearheaded the development of the Secret Service’s first public-private partnership cyber initiative in the Bay Area. Since 2005 he has been coordinating the public private partnership outreach for the DHS SRI International Cyber Security R & D Center and is an advisor to Stanford University CS Department and TRUST, a NSF trusted computing grant program that includes seven of our nation’s top universities. Mr. Rodriguez served on an Advisory Board that helped design a public private construct relative to cyber security for the United States Air Force.

As an advisor to these programs Mr. Rodriguez brings together representatives from disparate groups (academia, science, private industry, investment banking, government, system integrators, intelligence communities, entrepreneurs, policy makers, innovators, DoD, law enforcement and venture capital) to collaborate on IT security challenges and needs. He presently serves on the Board of Directors for the San Francisco Emerald Bowl and is a certified graduate of the Federal Government’s Senior Executive Service Program.

Thomas Ryan

Thomas Ryan: A 20-year security veteran, Thomas Ryan is the co-founder and Managing Partner of Cyber Operations and Threat Intelligence for Provide Security. The company was formed with the concept of the convergence of both physical and cyber techniques for Executive Protection, Advanced Red Teaming, Crisis Management, Threat Profiling, Threat Assessments and Penetration Testing. In his role, Mr. Ryan leads a team called Black Cell, a team of the most-highly trained and capable physical, threat and cyber security professionals in the world. Prior to founding Provide Security, Mr. Ryan had functioned as a security instructor for US Army INSCOM, USNORTHCOM, USSOUTHCOM and several other military and government agencies. His corporate experience has evolved from working at numerous security consulting companies. Mr. Ryan's passion for information security had him elected as the Chapter Vice President for OWASP NY in 2004, Board Member for NJ Chapter in 2005, then merging the two chapters in 2007 while still retaining his Board Member role in 2010. His contributions include participating as a co-author's of the OWASP Test Guide v2, and speaking at several industry events including the OWASP, INFRAGARD, ICCS, and ISSA.

Gustav Rydstedt

Stanford University Security Lab

Gustav Rydstedt is a masters student at Stanford University. He's a researcher with the Stanford Security Lab. His previous research includes web security and botnet/malware analysis.

Marcus Sachs

Marcus Sachs serves as Executive Director of Government Affairs for National Security Policy at Verizon in Washington, D.C. where he works closely with external government and business stakeholders in task forces, working groups, committees, and trade associations as part of the National Security/Emergency Preparedness (NS/EP) community in the Nation's Capital. Mr. Sachs holds a Master of Science in Computer Science from James Madison University, a Master of Science in Science and Technology Commercialization from the University of Texas, and a Bachelor of Civil Engineering from the Georgia Institute of Technology. He is currently pursuing a PhD in Public Policy at George Mason University. Mr. Sachs' professional experience includes a 20 year military career as an officer in the United States Army, two years of federal civilian service as a Presidential appointee at the White House and as an initial member of the U.S. Department of Homeland Security, and four years as a consultant and contractor to the federal government. Mr. Sachs volunteers as the director of the SANS Internet Storm Center, serves on several industry advisory boards, and is frequently quoted by the media as a cyber security expert.

Tony Sager

NSA

Tony Sager is the Chief of the Vulnerability Analysis and Operations (VAO) Group within the Information Assurance Directorate at the National Security Agency. VAO’s mission is to identify and analyze the vulnerability of information, technology, and operations for NSA customers, primarily within the Defense Department and the Intelligence Community. VAO is also very active in helping the broader national security community deal with these same problems through guidance and standards. VAO has received recognition from several private sector sources (including SC Magazine Editor’s Choice for 2007; and The National Information Security Leadership Award from Government Executive Magazine and the SANS Institute).

During his 30 year career at the NSA, Tony has held a number of technical and managerial positions in Computer/Network Security and software analysis. He holds a BA in Mathematics from Western Maryland College and an MS in Computer Science from the Johns Hopkins University. Tony is also a graduate of the US Army Signal Officer Basic Course (as a civilian), and the National Security Leadership Course. He is a frequent keynote speaker and panelist at national and international security events.

Len Sassaman

Katholieke Universiteit Leuven

Len Sassaman is a member of the Shmoo Group, as well as a researcher at COSIC, the COmputer Security and Industrial Cryptography laboratory at Katholieke Universiteit Leuven. He is currently pursuing his PhD in electrical engineering, advised by Bart Preneel and David Chaum. The focus of Len's past research has been privacy-preserving technologies, such as anonymity and confidentiality systems, which emphasize usability as a security parameter in privacy solutions subject to the limitations of today's communication systems. Len has over fifteen years of experience designing and deploying privacy enhancing technologies and evaluating protocol security. Len is the maintainer of the anonymous remailer software Mixmaster, a former Tor and Mixmaster server operator, and has written many papers on the topic of anonymous system design. Len has also consulted on policy issues regarding Internet privacy in today's society.

Len Sassaman also co-invented the field of language-theoretic security research, which is the topic of his talk. Prior to becoming an academic researcher, Len was an active cypherpunk and held such roles as Chief Architect at Anonymizer, Inc., Senior Security Architect at Known Safe, Inc., and a Lead Software Engineer at PGP Security, Inc. Last year at Black Hat, Len presented (with Dan Kaminsky) a series of fatal flaws in the Certificate Authority system, discovered using language-theoretic security analysis methods.

Len has spoken at many security conferences, co-founded the CodeCon and Biohack! conferences and the HotPETS workshop, and will be returning to Black Hat for his eighth talk at this conference.

Christiaan Schade

Christiaan Schade is a Mechanical Engineering (ME) Bachelor student at the University of Twente (Netherlands). After starting his ME studies he was asked to help out with a coding project:ever since writing 'int main()' he was hooked... He has been involved in Multiplayer gaming Anti-Cheat development for several years, this experience has lead him to reverse engineering and Windows driver development. Whilst becoming more interested in security and IT in general he decided to take a course on Operating System Concept at his university, this is where he came into contact with the Distributed and Embedded Security group and started working with them. Together with finishing his ME Bachelor next year he is going to enroll in a 'Computer Security' master.

Shreeraj Shah

Shreeraj Shah: (Founder and Director) Shreeraj Shah, B.E., MSCS, MBA, CSSLP is the founder of Blueinfy, a company that provides application security services. Prior to founding Blueinfy, he was founder and board member at Net Square. He also worked with Foundstone (McAfee), Chase Manhattan Bank and IBM in security space.

He is also the author of popular books Web 2.0 Security, like Hacking Web Services (Thomson 06) and Web Hacking:Attacks and Defense (Addison-Wesley 03). In addition, he has published several advisories, tools, and whitepapers, and has presented at numerous conferences including RSA, AusCERT, InfosecWorld (Misti), OWASP, HackInTheBox, Blackhat, OSCON, Bellua, Syscan, ISACA etc. His articles are regularly published on Securityfocus, InformIT, DevX, O'reilly, HNS. His work has been quoted on BBC, Dark Reading, Bank Technology, SC Magazine etc. as an expert.

Shreeraj was instrumental in product development, researching new methodologies and training designs. He has performed several security consulting assignments in the area of penetration testing, code reviews, web application assessments, security architecture reviews and managing projects.

Adam Shostack

Adam Shostack is a member of Microsoft's Security Development Lifecycle team, where he is responsible for security design analysis techniques, including the company's threat modeling tools and methodologies.

Shostack joined Microsoft in 2006 with an extensive background in software security. Before joining the company, he was involved in a number of successful start-up ventures involving vulnerability scanning, privacy and program analysis. Additionally, Shostack helped create the Common Vulnerabilities and Exposure (CVE) list, and now serves as the Emeritus Advisor of the group. He is also a founding member of both the International Financial Cryptography Association (IFCA) and the Privacy Enhancing Technologies Symposium, and has been a technical advisor to companies such as Counterpane Internet Security and Debix.

He has published articles in a variety of industry and academic venues, and is also co-author of the widely-acclaimed book, The New School of Information Security (Addison-Wesley, April 2008).

Sumit Siddharth

7Safe Limited

Sumit "sid" Siddharth works as a Principal Security Consultant (Penetration Tester) for 7Safe Limited in the UK. He specializes in the application and database security. He has been a speaker at many security conferences including Defcon, Troopers, OWASP Appsec, Sec-T etc. He also runs the popular IT security blog: www.notsosecure.com

Ken Silva

VeriSign

Ken Silva: As Chief Technology Officer, Ken Silva oversees VeriSign's mission critical Internet infrastructure that enables and protects billions of interactions every day across the world's voice and data networks. In this role, he oversees the network and information security for VeriSign's portfolio of digital infrastructure solutions that enable the world to securely communicate, conduct commerce and access the latest content. Mr. Silva's responsibilities include oversight of the technical and network security for a definitive database of millions of Web addresses in .com and .net - the world's most recognizable top-level domains. Responding to more than 30 billion DNS queries daily, the platform provide authoritative routing support for every Web address ending with .com or .net. Mr. Silva also oversees the management of two of the world's 13 Internet root servers, a.root-servers.net and j.root-servers.net, considered national IT assets by the U.S. Federal Government. Additionally, Mr. Silva coordinates the security oversight of the system that protects more than 750,000 Web servers with digital certificates, protecting the majority of secure Web sites on the Internet, including 93 percent of the Fortune 500 sites.

Mr. Silva serves on the board of directors for the Information Technology, Information Sharing and Analysis Center (IT-ISAC) and is the Chairman of the board of the Internet Security Alliance. He also advises and participates in a number of national and international committees for organizations, including the National Infrastructure Protection Center (NIPC), White House ISP Security Panel, the ICANN DNS Security Panel, the Network Reliability and Interoperability Council (NRIC), and the National Security Telecommunications Advisory Committee (NSTAC).

Mr. Silva previously served as VeriSign's first Chief Security Officer and vice president of technology strategy. He joined VeriSign with more than 20 years experience in the telecommunications and security industries. He came from the National Security Agency where he served 10 years most recently as executive technical director. Mr. Silva has served in various other leadership positions, taught courses at the national cryptologic school, and served 10 years in the United States Air Force.

Marco Slaviero

Marco Slaviero is employed by SensePost.

Rich Smith

Immunity

Rich Smith joined Immunity in 2008 as a researcher and has worked across a variety of areas encompassing attack tooling, framework design and exploit development in addition to consulting for a variety of industry sectors as an outside expert in a range of technical capacities. Prior to joining Immunity, Rich worked as a principal security researcher with HP Labs leading the Research In Offensive Technology and Threats based in the UK.

Rich has spoken at numerous international conferences, both public and private and has participated in industry, government and community sponsored infosec groups.

Ryan Smith

Val Smith

Attack Research

Val Smith has been involved in the computer security community and industry for over ten years. He currently works as a professional security researcher on a variety of problems in the security community. He specializes in penetration testing (over 40,000 machines assessed), reverse engineering and malware research. He works on the Metasploit Project development team as well as other vulnerability development efforts. Most recently Valsmith founded Attack Research which is devoted to deep understanding of the mechanics of computer attack. Previously Valsmith founded Offensive Computing, a public, open source malware research project.

Gordon M. Snow

FBI

Gordon M. Snow entered on duty as a special agent with the FBI on March 8, 1992. Upon completion of training at the FBI Academy in Quantico, Virginia, he was assigned to the Birmingham Division’s Huntsville Resident Agency. While there, he investigated violent crime, drug, civil rights, public corruption, and white-collar crime matters. In April 1996, he was assigned to the Critical Incident Response Group as a member of the Hostage Rescue Team. During that time, he took part in several sensitive rendition missions; conducted terrorism assessments overseas with the Department of State; and was assigned to assessment, protection, and investigative support missions after the bombing of the USS Cole in Aden, Yemen, and the embassy bombings in Nairobi, Kenya.

Mr. Snow was promoted to supervisory special agent in the Counterintelligence Division’s Middle East Unit in January 2001. Two years later, in January 2003, he was assigned to the Detroit Division, where he supervised the foreign counterintelligence program and served as the SWAT program coordinator. In April 2005, Mr. Snow was appointed chief of the Weapons of Mass Destruction and Acquisition of U.S. Nuclear & Missile Technology Unit at FBI Headquarters.

In May 2006, Mr. Snow was selected as the assistant special agent in charge of the San Francisco Division’s San Jose Resident Agency. In that role, he had operational responsibility for the counterterrorism, cyber, white-collar crime, and violent crime squads; the San Jose members of the Joint Terrorism Task Force; the High-Value Computer Crimes Task Force; the Silicon Valley Regional Computer Forensics Lab; and the Monterey Bay Resident Agency. He also served as the SWAT program manager.

Mr. Snow was assigned to the Afghanistan theatre of operations as the FBI's on-scene commander for the Counterterrorism Division in June 2007. Following his return to the U.S., he was appointed section chief in the Cyber Division in January 2008 and detailed to the Office of the Director of National Intelligence, National Counterintelligence Executive. During that assignment, he and his staff led the effort in drafting the government-wide Cyber Counterintelligence Plan under Homeland Security Presidential Directive-23/National Security Presidential Directive-54, the Comprehensive National Cyber Initiative. In January 2009, Mr. Snow was appointed as chief of the Cyber Division’s Cyber National Security Section and the director of the National Cyber Investigative Joint Task Force. In November 2009, he was named deputy assistant director of the Cyber Division.

Mr. Snow is a native of Detroit, Michigan. He graduated from the University of Michigan, Ann Arbor, with a B.A. in English. He received an M.B.A. with an emphasis in finance from Virginia Tech in 2001 and a J.D. from Catholic University’s Columbus School of Law in 2006. Prior to joining the FBI, Mr. Snow served in the United States Marine Corps for more than 10 years, as both an enlisted Marine and as an officer.

Josh Sokol

Josh Sokol graduated from the University of Texas at Austin with a BS in Computer Science in 2002. Since that time, he has worked for several large companies including AMD and BearingPoint, spent some time as a military contractor, and is currently employed as the Information Security Program Owner at National Instruments. In his current role, Josh manages all compliance, risk management, and vulnerability management activities for NI. Josh is a CISSP and also a frequent contributor on the Web Admin Blog.

Diego Sor

Core Security Technology

Diego Sor works at CORE Security Technologies as a senior security consultant and has been in the security industry for the past nine years, working first as a software developer and then as a consultant. Sor worked previously in the hardware industry with focus on communications security and holds a degree in Electronic engineering.

Alex Stamos

iSEC Partners

Alex Stamos: researcher and founder, iSEC Partners.

Roberta G. Stempfley

DHS

Roberta G. Stempfley is the director of the National Cybersecurity Division at DHS. As head of the National Cybersecurity Division, Mrs. Stempfley is responsible for spearheading collaboration between DHS and the private sector. This includes deploying a cyber risk management program and building a national response system.

Roberta G. Stempfley previously served as the CIO of the Defense Information Systems Agency as well as the Vice Director, Strategic Planning and Information, responsible for supporting the Director in decision making, strategy development and communicating that strategy both internally and externally, aligning DISA program execution with Department of Defense (DoD) strategy in planning, engineering, acquiring, fielding and supporting global-net-centric solutions, operating the Global Information Grid (GIG), information assurance and management of DISA information technology resources; as a support service unit, SPI supports DISA missions with cost-effective information tools and capabilities, and provides leadership and support in a wide range of Agency and DoD information management initiatives.

Prior to assuming this position, she was the Chief Technology Officer in the organization responsible for the operation and defense of the GIG. In this position she established the way ahead for US STRATCOM, DISA, and the Military Services in 3 broad areas: GIG Network Defense, Enterprise Systems, Network and Services Management, and GIG Content management.

Mrs. Stempfley has more than 10 years of experience in Department of Defense communications and information technology systems development, operations, information assurance, and management. Prior to her appointment as Technical Director for Joint Task Force – Global Network Operation (JTF-GNO) Mrs. Stempfley served as Chief Engineer and Deputy of the DISA Global Network Operations Command overseeing the direction, technology, policy, and operation for the DISA NetOps Centers who operate and defend the GIG. Mrs. Stempfley planned and applied engineering discipline to the acquisition, development and integration of sustainable, interoperable, net-centric joint war fighting mission capabilities and services providing end-to-end visibility of DISA provided services. The capabilities and services included security for the Global Information Grid, utilizing commercial-off-the shelf products and services to solve joint and coalition requirements, and the integration of Military SATCOM into the global picture.

Mrs. Stempfley attended the University of Arizona where she received her BS in Engineering Mathematics. Mrs. Stempfley graduated from James Madison University in 2001 where she received her Master of Science in Computer Science with a specialization in computer security. In 2002 she graduated from the Federal Executive Institute and the National Security Management Course.

Scott Stender

iSEC Partners

Scott Stender is a founding partner of iSEC Partners, a strategic digital security organization. Scott brings with him several years of experience in large-scale software development and security consulting, having worked at companies such as @stake and Microsoft. Scott is a noted researcher who focuses on secure software engineering and security analysis of core technologies. He holds a BS in Computer Engineering from the University of Notre Dame.

John N. Stewart

Cisco

John N. Stewart: Throughout his career spanning more than two decades, John Stewart has led or participated in security efforts ranging from elementary school IT design to national security programs. A heavily sought public and closed-door speaker, blogger to blogs.cisco.com/security, and 2010 Federal 100 Award recipient, Stewarts’ drive is simple: results.

As Vice President and Chief Security Officer for Cisco, Stewart leads the security operations, product security, and government security functions. His team focuses on global information security consulting and services, security evaluation, critical infrastructure assurance, source code security, identification management, and special programs that promote Cisco, Internet, national, and global security. He is also responsible for overseeing security for Cisco.com, the infrastructure supporting Cisco’s $36+ billion business, WebEX, the collaboration service providing 73 million online meetings per year, among other Cisco functions.

Stewart remains an active member in the security industry, having served on advisory boards for Akonix, Cloudshield, Finjan, Ingrian Networks, Riverhead, and TripWire. Currently, he sits on technical advisory boards for Core Security Technologies, Panorama Capital (formerly JPMorganPartners Venture), RedSeal Networks, and Signacert, is on the board of directors for KoolSpan, and a standing member of the CSIS Commission on Cyber Security.

Stewart holds a Master of Science degree in computer and information science with honors from Syracuse University, Syracuse, New York.

Matthieu Suiche

Matthieu Suiche is a security researcher who focuses on reverse code engineering and volatile memory analysis. His previous researches/utilities include Windows hibernation file, Windows physical memory acquisition (Win32dd/Win64dd) and Mac OS X Physical Memory Analysis.

Matthieu has been a speaker during various security conferences such as PacSec, BlackHat USA, EUROPOL High Tech Crime Meeting, Shakacon etc. Prior to starting in 2010 MoonSols, a computer security and kernel code consulting and software company based in France, Matthieu worked for companies such as E.A.D.S. (European Aeronautic Defence and Space Company) and the Netherlands Forensics Institute of the Dutch Ministry of Justice.

Bryan Sullivan

Bryan Sullivan is a Security Program Manager on the Security Development Lifecycle (SDL) team at Microsoft. He is a frequent speaker at industry events, including Black Hat, BlueHat, and RSA Conference. Bryan is also a published author on web application security topics. His first book, "Ajax Security" was published by Addison-Wesley in 2007.

Chris Sumner

Chris @TheSuggmeister Sumner has been directly involved in Corporate Information Security since 1999 and has maintained a passion for security since seeing Wargames when it first came out. After a lengthy stint as a Pivot Chart creating, PowerPoint wielding, Security Manager for a business division that alone would make the Fortune100, he has turned his attention to a more geeky pursuit and is currently focused on Security in the Development Lifecycle.

Outside the corporate world Chris is a data mining, analysis and visualization geek at heart and also enjoys hiding skateboards in the UK for Tony Hawks twitter hunts.

Kuniyasu Suzaki

Kuniyasu Suzaki is a senior researcher at RCIS (Research Center for Information Security) of AIST (National Institute of Advanced Industrial Science and Technology, Japan). His interests are security on virtual machine and trusted computing. He is a board member of Cloud Security Alliance Japan Chapter. Suzaki holds a PhD degree from University of Tokyo.

Tom Talleur

Tom Talleur is a Forensic Futurologist helping governments and companies understand and deal with the impact exploitations of present-day and novel technologies will have on man in the future. His combined public and private sector forensic experience spans 36 years embracing executive roles in federal law enforcement and major consulting firms. He is writing a book about 21st Century advanced technology crime, warfare and terrorism. This book will help nations, businesses, and individuals learn to create and carry out strategies to thwart or limit the adverse impacts future technology developments will pose in the hands of man.

PRIVATE SECTOR: Between 2003 and 2005, Tom was a Senior Vice President and global service leader creating and directing a Forensic Technology Services practice for the Forensic Accounting and Claims Service group at Marsh Risk Consulting. Between 2000 and 2002, he served as a managing director and Forensic Technology global practice leader in KPMG Forensic. In both firms, these groups provide cyber forensic advisory, investigative, prevention, electronic discovery and litigation support services to clients. As a member of the practice leadership teams he helped these firms devise, message, and manage the journey for achievement of a global forensic services strategies. He created special teams to address "Sarbanes-Oxley" financial statement frauds in major corporations in line with recent corporate scandals and global incident response teams to address exploitations of client technologies.

PUBLIC SECTOR: In December 1999 Tom completed a 31-year career as a US federal criminal investigator serving as the Advanced Technology Programs Executive in charge of the Network and Advanced Technology Crimes Division at the NASA Office of Inspector General. Receiving awards from the White House and the Attorney General for his work, he is a keynote speaker to many associations and training seminars around the world. He also serves as an analyst and consultant for television, radio and print media on topics related to computer crimes, the technology exploitation, and a various forensic matters involving the use of technologies. A graduate of the US Naval War College and the Federal Executive Institute, he is a Certified Information Security Manager, Certified Fraud Examiner, Unix and Network Security and Seized Computer Evidence Recovery Specialist. His law enforcement service spans NASA OIG, the Defense Criminal Investigative Service, the Naval (now Criminal) Investigative Service, and the US Postal Inspection Service.

Chris Tarnovsky

Flylogic Engineering, LLC

Chris Tarnovsky runs Flylogic Engineering, LLC and specializes in analysis of semiconductors from a security "how strong is it really" standpoint. Flylogic offers detailed reports on substrate attacks which define if a problem exists. If a problem is identified, we explain in a detailed report all aspects of how the attack was done, level of complexity and so on. This is something we believe is unique and allows the customer to then go back to the chip vendor armed with the knowledge to make them make it better (or possibly use a different part).

Trent R. Teyema

Cyber National Security Section, FBI

Agent Trent R. Teyema was responsible for establishing the FBI’s National Cyber Investigative Joint Task Force (NCI-JTF), and serves as its Deputy Director, charged with coordinating the most serious cyber threat investigations to the national and economic security of the United States. Agent Teyema is the Assistant Section Chief for the Cyber National Security Section and responsible for all cyber national security investigations for the FBI.

Agent Teyema has conducted and managed computer intrusion, information security, forensic, and cyber crime investigations for the FBI since 1996. During his tenure at the FBI, Agent Teyema founded two cyber squads for the Los Angeles Field Office, and one computer intrusion squad for the Washington, D.C. Field Office. He has instructed and lectured extensively on the subject of cyber investigations and security.

Agent Teyema is a certified instructor for the FBI, a Certified Information Security Manager, and has a Masters of Forensic Science from The George Washington University, in Washington, D.C.

Patrick Thomas

Qualys

Patrick Thomas is an information security researcher at Qualys. In addition to work in web-app and host-based vulnerability detection he spends time searching for 0-days and trying to help non-technologists understand the implications of information (in)security. Patrick holds a BS in Computer Science from Cal Poly, San Luis Obispo.

Julien Tinnes

Google Inc.

Julien Tinnes has been interested in computer security since the late ’90s. He enjoys both designing and breaking the security aspects of complex systems.

Before joining Google as an information security engineer, Julien was working for one of the biggest telecoms company as a security engineer and technical project manager. At that time, he was also a part-time teacher for various French “Grandes Ecoles.”

Raj Umadas

Intrepidus Group

Raj Umadas is a Consultant with the Intrepidus Group. Mr. Umadas graduated Summa Cum-Laude from The Polytechnic Institute of NYU with a BS in Computer Engineering. At NYU:Poly, Mr. Umadas pursued a highly expansive computer security curriculum. He is just as comfortable sniffing out a memory corruption bug as he is assessing the risk management decisions of large projects.

Coupled with Mr. Umadas' fresh academic outlook on security, he obtained a no-nonsense business sense of security while working in an Information Risk Management arm of a large investment bank. Corporate governance, segregation of duties, and SOX compliance were all daily concerns for Mr. Umadas.

Mr. Umadas is eager to establish his own niche in the security world where he will be the catalyst of some very major innovation. With his strong academics, proven real world experience, and never-say-no attitude; it is only a matter of time.

Varun Uppal

IRM Plc

Varun Uppal is a Senior Consultant at Information Risk Management Plc where he heads the Application Risk Assessment and Code Review Centers of Excellence. With an experience spanning over 5 years and a gamut of verticals, Varun has worked on a variety of commercial and non-commercial research engagements covering areas such as high speed messaging protocols, embedded devices and application risk modeling. Prior to IRM Plc, Varun designed and implemented the application security practice at Kanbay (Capgemini, Financial Services SBU), where he consulted to clients from the financial vertical.

Chris Valasek

IBM: X-Force

Chris Valasek is a security researcher on IBM X-Force’s Advance Research and Development team. He specializes in vulnerability analysis and exploitation, specifically in the area of the Windows heap. While not avoiding work, he continues to work on long term research projects in varying areas of computer security. He is also the current organizer/playboy of SummerCon (http://www.summercon.org), the nation’s oldest hacker conference.

Randy Vickers

National Cyber Security Division, DHS

Randy Vickers is the Director, United States Computer Emergency Readiness Team (US-CERT) within the Department of Homeland Security National Cyber Security Division where he oversees global incident correlation and strategic analysis capabilities to reduce the Federal, State, Local, Tribal governments and Private Sector organizations exposure to cyber threats and vulnerabilities. Works directly with law enforcement and intelligence agencies, which include the FBI, DIA, NSA, and CIA, on ongoing computer crime investigations, intelligence gathering, technical analysis, and potential prosecution of individuals or organizations involved in compromise of US Government assets.

Prior to joining the US-CERT, he was most recently the Chief of the Department of Defense Computer Emergency Response Team (DOD-CERT) at the Joint Task Force, Global Network Operations where he provided top-level technical leadership for team members' Net Defense-focused operational reviews of all enemy actions against DoD Networks, determined Information Operation Condition level assessments and identified appropriate and effective DOD-wide security countermeasures and strategies for implementing them. Engineered and directed the activation of network defense measures across DoD networks such as the blocking of risky social networking web sites. Randy was also primarily responsible for systems analysis and correlation of network incidents across the DoD Global Information Grid.

Paul Vixie

Paul Vixie holds the record for "most CERT advisories due to a single author" which came primarily from his years hacking on BIND4 and BIND8. Later on he cut off the oxygen supply to his brain by wearing a necktie for AboveNet, MFN, and PAIX. At the moment he is President at ISC where his primary duty is to sign paychecks for the people who bring you BIND9 and F.ROOT-SERVERS.NET. He is also an occasional critic of just about everything.

Mario Vuksan

ReversingLabs

Mario Vuksan, Founder, ReversingLabs, Mario Vuksan is co-founder of ReversingLabs. He was the Director of Research at a leading provider of application and device control solutions, where he has founded and built the world's largest collection of actionable intelligence about software. Recently he spoke at CEIC, Black Hat, RSA, Defcon, Caro Workshop, Virus Bulletin and AVAR Conferences. He is author of numerous blogs on security and has most recently authored "Protection in Untrusted Environments" chapter for the "Virtualization for Security" book.

Nico Waisman

Immunity

Nicolas Waisman joined Immunity in February 2004. Nicolas has experience in all areas of offense-related software security, from vulnerability analysis to exploit and trojan development. Nico is an internationally recognized heap expert and teaches Immunity's most advanced class, heap exploitation. Nico has taught governments and commercial sector students from all over the world in both private and public classroom settings.

Mark Weatherford

NERC

Mark Weatherford was appointed by Governor Arnold Schwarzenegger to his most recent position as Executive Officer of the California Office of Information Security and Privacy. In this role, he has broad authority over California’s cyber security activities and is responsible for state government information security program policy, standards, and procedures. He also oversees the first-in-the-nation Office of Privacy Protection, which provides information, education and privacy practice recommendations for consumers, business and other organizations on identity theft and other privacy issues.

Mr. Weatherford previously served as the Chief Information Security Officer for the State of Colorado where he was appointed by two successive governors to develop and lead the state information security program. A former U.S. Naval Cryptologic Officer, Weatherford led the U.S. Navy’s Computer Network Defense operations and the Naval Computer Incident Response Team and as a member of the Raytheon company, he successfully built and established the San Diego Navy/Marine Corps Intranet Security Operations Center (SOC).

Mr. Weatherford holds a BS from the University of Arizona and an MS from the Naval Postgraduate School. He is a member of the Multi-State Information Sharing and Analysis Center, the National Association of State Chief Information Officers, the Information Systems Security Association, and the Information Systems Audit and Control Association. He also holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications. Mr. Weatherford was recently awarded Information Security magazine’s prestigious “Security 7 Award” for 2008.

Ralf-Philipp Weinmann

University of Luxembourg

Ralf-Philipp Weinmann is a cryptologist at day, and a reverse-engineer at night. He has studied and obtained his Ph.D. at the Technical University of Darmstadt and is currently researching as a post-doc at the LACS laboratory of the University of Luxembourg.

Linton Wells II

NDU

Linton Wells II is the Director of the Center for Technology and National Security Policy (CTNSP) at National Defense University (NDU). He also is a Distinguished Research Professor and serves as the University’s Transformation Chair. Prior to coming to NDU he served in the Office of the Secretary of Defense (OSD) from 1991 to 2007, serving last as the Principal Deputy Assistant Secretary of Defense (Networks and Information Integration). In addition, he served as the Acting Assistant Secretary and DoD Chief Information Officer for nearly two years. His other OSD positions included Principal Deputy Assistant Secretary of Defense (Command, Control, Communications and Intelligence-C3I) and Deputy Under Secretary of Defense (Policy Support) in the Office of the Under Secretary of Defense (Policy).

In twenty-six years of naval service, Dr. Wells served in a variety of surface ships, including command of a destroyer squadron and guided missile destroyer. In addition, he acquired a wide range of experience in operations analysis; Pacific, Indian Ocean and Middle East affairs; and C3I. Recently he has been focusing on STAR-TIDES, a research project focusing on sustainable support to populations under stress and public-private interoperability (www.star-tides.net).

Dr. Wells was born in Luanda, Angola, in 1946. He was graduated from the United States Naval Academy in 1967 and holds a Bachelor of Science degree in physics and oceanography. He attended graduate school at The Johns Hopkins University, receiving a Master of Science in Engineering degree in mathematical sciences and a PhD in international relations. He is also a 1983 graduate of the Japanese National Institute for Defense Studies in Tokyo, the first U.S. naval officer to attend there.

Dr. Wells has written widely on security studies in English and Japanese journals. He co-authored Japanese Cruisers of the Pacific War, which was published in 1997. His hobbies include history, the relationship between policy and technology, and scuba diving. He has thrice been awarded the Department of Defense Medal for Distinguished Public Service.

Georg Wicherski

Georg Wicherski is a 20 years old German university student with experience in the fields of botnet tracking and mitigation, malware analysis and network engineering. He co-authored the Honeynet Project's paper "Know Your Enemy: Tracking Botnets" and two papers submitted to ESORICS and DFN-Cert Workshop. He also published his paper "Medium Interaction Honeypots" on the Internet. Additionally, he presented on Blackhat Asia 2006 and the 23C3. His fields of interest besides malware and botnets include robotics engineering and programming as well as wireless appliances. He is the author of the mwcollectd medium-interaction-honeypot and nepenthes developer. He founded and now leads the mwcollect Alliance, a non-proifit organization aiming at collecting malware with now over 150000 unique in-the-wild samples. For more info: www.pixel-house.net & www.mwcollect.org

Marcin Wielgoszewski

Gotham Digital Science

Marcin Wielgoszewski is a security engineer and consultant at Gotham Digital Science. He is a committee member for the OWASP NYNJMetro chapter and has previously spoken at ShmooCon and other OWASP events. His research primarily focuses on software security and assurance.

Tim Wyatt

Lookout Mobile Security

Tim Wyatt is a software engineer whose 16 year career has focused on development of security products and products with critical security requirements. Most recently, this has led him to focus on security in the mobile space at Lookout Mobile Security. Prior to Lookout, Tim was a lead engineer for the Symantec (formerly Vontu) Network Data Loss Prevention suite.

William Yerazunis

Mitsubishi Electric Research Laboratories

William Yerazunis is a Senior Principal Research Scientist and Team Lead at Mitsubishi Electric Research Laboratories in Cambridge, Massachusetts, USA. He received the B.S., M.Eng, and Ph.D degrees in Systems Engineering from Rensselaer Polytechnic Institute, in 1978, 1979, and 1987, respectively. Since then, he has worked in a number of fields including optics, machine vision, and signal processing (for General Electric's jet engine manufacturing); computer graphics (at Rensselaer's Center for Interactive Computer Graphics); artificial intelligence and parallel symbolic computation (at Rensselaer); radioastronomy and SETI ( at Harvard University), transplant immunology (for the American Red Cross), virtual and augmented reality, realtime physical and chemical sensing, and ubiquitous computing (for Mitsubishi Electric), and realtime statistical categorization of texts (the CRM114 Discriminator anti-spam system). He is also a Visiting Scientist at Dublin City University in Dublin, Ireland. He has appeared on numerous educational television shows, holds 35 U.S. patents, sports an Erdos number of three, a Kevin Bacon number of three, holds FCC ham radio Extra class and Commercial Broadcast/radar engineer licenses, and was voted one of the 50 most powerful people in networking by NetworkWorld magazine in 2006.

Amit Yoran

NetWitness

Amit Yoran serves as the Chief Executive Officer of NetWitness Corporation, a leading provider of network security analytic products. He is a Commissioner of the CSIS Commission on Cyber Security advising the 44th Presidency and serves on several industry and national advisory bodies. Prior to NetWitness Mr Yoran served Director of the National Cyber Security Division at the Department of Homeland Security, and as CEO and advisor to In-Q-Tel, the venture capital arm of the CIA. Formerly he served as the Vice President of Worldwide Managed Security Services at the Symantec Corporation. Mr. Yoran was the co-founder of Riptech, a market leading IT security company, and served as it’s CEO until the company was acquired by Symantec in 2002. He formerly served an officer in the United States Air Force in the Department of Defense's Computer Emergency Response Team.

Mr Yoran is an independent director on the boards of innovative security technology companies Boards, including Digital Sandbox and IronKey. He previously served on the board of Guardium until the company’s acquisition by IBM in 2009, Cyota until the company’s acquisition by RSA in 2006, Guidance Software (GUID) through the company’s successful IPO in 2007 and as an advisor to Intruvert Networks until the company’s acquisition by McAfee in 2003.

Mr. Yoran received a Master of Science degree from the George Washington University, a Bachelor of Science from the United States Military Academy at West Point and an Honorary Doctoral degree from the University of Advancing Technology.

home / archives / community / about / contact
2010 black hat ™