Kevin J. Ripa

Despite advances in technology, organizations continue to struggle with effective digital forensics and incident response (DFIR). This presentation will explore common mistakes, such as inadequate data acquisition and poor analysis techniques. By shifting the mindset towards a more proactive and thorough approach, we can enhance our ability to identify and mitigate threats. Attendees will learn about innovative strategies to improve current practices and ensure more accurate and efficient investigations. With over 25 years of experience in digital investigations and incident response, Kevin J. Ripa will share real-world examples and expert insights to help attendees understand and overcome these challenges.

Data breaches remain a significant challenge, with incidents of ransomware and data theft occurring daily. This session will delve into the top three reasons why these breaches persist, which often defy conventional wisdom. By understanding these root causes, participants will discover practical, immediately applicable solutions to enhance their security measures. The presentation aims to equip attendees with “quick wins” that can be implemented as soon as they return to work, helping to fortify their defenses and become part of the solution. Kevin J. Ripa, a seasoned expert in cyber-forensics and hacking response investigations, will provide actionable advice and proven strategies to help organizations stop getting “pwned.”

Microsoft 365 hacks are increasingly popular among cybercriminals, leading to frequent blame on Microsoft for insecure systems. This presentation will examine a real-world case of financial fraud, where parties involved blame each other for the loss. Through a detailed walkthrough of the investigation, participants will establish the building blocks of determining responsibility, identifying the actual perpetrator, and protecting against such attacks in the future. The session emphasizes thinking outside the box and understanding the nuances of digital evidence to uncover the truth. Leveraging his extensive experience as a sought-after expert witness and SANS Senior instructor, Kevin J. Ripa will guide attendees through the intricacies of identifying and mitigating phishing attacks.

Encryption is a fundamental yet often misunderstood concept in information security. This presentation will demystify encryption by explaining symmetric encryption, asymmetric encryption, and hashing in a clear and accessible manner. Participants will learn where and how each type is used, including non-repudiation. The session will feature a hands-on exercise with the Diffie-Hellman key exchange, demonstrating that encryption is not as intimidating as it seems. Attendees will leave with a solid understanding of encryption principles and their practical applications. Kevin J. Ripa, with his numerous industry certifications and extensive teaching experience, will ensure that participants grasp these critical concepts through engaging and practical instruction. Can you answer the question, 4+3=? Then you will understand encryption at the end of this lecture!

Ransomware is very much a part of the infosec landscape today. It can be delivered with virtually zero risk, and the ROI is incredibly high. Almost everyone knows someone, or has heard a story about someone, that has been affected by ransomware. Sadly, we don’t seem to realize how important data is until we have lost data that has taken years to create. But what do we really know about ransomware? This lecture will discuss some types, as well as walk the attendee through delivery methods, as well as how ransomware performs. There is far more to it than simple encryption of files. We will cover protection, remediation, and the age-old question, “Should I pay the ransom?” Kevin J. Ripa, with his extensive experience in digital investigations and incident response, will provide deep insights into the anatomy of ransomware attacks and effective countermeasures.

Think Again… Many security professionals think they cannot be victims of a phishing email. A security professional’s hubris may be their downfall. Anyone can be phished by a motivated threat actor with the proper resources, time, and patience. In this talk, we will relate a phishing example in story form from an actual compromise. The “how” will shock you. The “fix”? In many cases, surprisingly simple. Drawing on his extensive background in digital forensics and hacking response investigations, Kevin J. Ripa will highlight real-world phishing scenarios and provide practical tips to avoid falling victim to such attacks. Additionally, he will demonstrate, live, a credential stealing hack in real time, showing both the attacker and victim computers during the compromise.

The Digital Forensics and Incident Response world. An incredibly broad sphere. We have people trying to get into this world. We have people that have just entered this world. We have people that work day-to-day in this world. We have people that excel in niche areas of this world. Each group thinks they are unique in this world, but one commonality that pervades everyone and everywhere in this world is that we have questions about, “How do I?”.

How do I get into DFIR? How do I get better at DFIR? How do I specialize? How do I decide what to specialize in next? How do I get to be like ‘that’ person?

Besides these questions, there are more practical questions. What training do I take? What tools do I use? Who should I follow? How can I find a mentor? Why would anyone want to give up their time to help me?

Things are changing faster in DFIR than ever before. Questions are everywhere. Let’s walk through the world of DFIR from beginning to end together. Where did you come from? Where do you go? How can you know what is in between? We don’t profess to know all the answers, but I can assure you we all feel the same way, and we are all on this crazy ride together. So, let’s get to know each other and the playing field. The theme? You be you and be comfortable in your skin. It is going to be a fun hour and a half!

This presentation focuses on how a criminal or civil forensics case is approached from the defense aspect. This is typically a frowned upon area of computer forensics, but it shouldn’t be. Unlike many “expert” fields, a computer forensics expert analysis cannot be “bought”. The data doesn’t lie. We merely interpret and report what exists. I will be bringing several stories to the presentation outlining how absolutely, innocent people were spared from many years wrongfully convicted. I will also bring a couple stories about people who were guilty, but thought they were smarter than everyone else!