Kevin J. Ripa

Data breaches remain a significant challenge, with incidents of ransomware and data theft occurring daily. This session will delve into the top three reasons why these breaches persist, which often defy conventional wisdom. By understanding these root causes, participants will discover practical, immediately applicable solutions to enhance their security measures. The presentation aims to equip attendees with “quick wins” that can be implemented as soon as they return to work, helping to fortify their defenses and become part of the solution. Kevin J. Ripa, a seasoned expert in cyber-forensics and hacking response investigations, will provide actionable advice and proven strategies to help organizations stop getting “pwned.”

Microsoft 365 hacks are increasingly popular among cybercriminals, leading to frequent blame on Microsoft for insecure systems. This presentation will examine a real-world case of financial fraud, where parties involved blame each other for the loss. Through a detailed walkthrough of the investigation, participants will establish the building blocks of determining responsibility, identifying the actual perpetrator, and protecting against such attacks in the future. The session emphasizes thinking outside the box and understanding the nuances of digital evidence to uncover the truth. Leveraging his extensive experience as a sought-after expert witness and SANS Senior instructor, Kevin J. Ripa will guide attendees through the intricacies of identifying and mitigating phishing attacks.

Encryption is a fundamental yet often misunderstood concept in information security. This presentation will demystify encryption by explaining symmetric encryption, asymmetric encryption, and hashing in a clear and accessible manner. Participants will learn where and how each type is used, including non-repudiation. The session will feature a hands-on exercise with the Diffie-Hellman key exchange, demonstrating that encryption is not as intimidating as it seems. Attendees will leave with a solid understanding of encryption principles and their practical applications. Kevin J. Ripa, with his numerous industry certifications and extensive teaching experience, will ensure that participants grasp these critical concepts through engaging and practical instruction. Can you answer the question, 4+3=? Then you will understand encryption at the end of this lecture!

Living in the Limelight: Bodyguards and information security.  When security is working properly, it should seem unnecessary. This applies both in physical security as well as cyber security. It is also true that you don’t know if your security apparatus is adequate or qualified until something goes bad. Come and listen to a former bodyguard to rock stars, executives, and heads of state talk about the comparisons between the two. It is often said that cyber security is difficult because you can’t see the adversary coming. Why is that different than physical security? You never know what an adversary is planning or doing until it is attempted (or successful). The key (ideally) is proper planning, prevention, and recognition of an unfolding situation. Barring that, timely detection and timely (as well as proper) response are critical. Kevin J. Ripa will draw the parallels between real world and cyber, and show that security is security, no matter what the application. The number one takeaway? Stop making it so complicated. Understand the threat. Recognize the threat. Neutralize the threat. With Kevin’s unique background as both a former bodyguard and a cyber security expert, this session promises to be both enlightening and engaging.

Ransomware is very much a part of the infosec landscape today. It can be delivered with virtually zero risk, and the ROI is incredibly high. Almost everyone knows someone, or has heard a story about someone, that has been affected by ransomware. Sadly, we don’t seem to realize how important data is until we have lost data that has taken years to create. But what do we really know about ransomware? This lecture will discuss some types, as well as walk the attendee through delivery methods, as well as how ransomware performs. There is far more to it than simple encryption of files. We will cover protection, remediation, and the age-old question, “Should I pay the ransom?” Kevin J. Ripa, with his extensive experience in digital investigations and incident response, will provide deep insights into the anatomy of ransomware attacks and effective countermeasures.

Think Again… Many security professionals think they cannot be victims of a phishing email. A security professional’s hubris may be their downfall. Anyone can be phished by a motivated threat actor with the proper resources, time, and patience. In this talk, we will relate a phishing example in story form from an actual compromise. The “how” will shock you. The “fix”? In many cases, surprisingly simple. Drawing on his extensive background in digital forensics and hacking response investigations, Kevin J. Ripa will highlight real-world phishing scenarios and provide practical tips to avoid falling victim to such attacks. Additionally, he will demonstrate, live, a credential stealing hack in real time, showing both the attacker and victim computers during the compromise.

The Digital Forensics and Incident Response world. An incredibly broad sphere. We have people trying to get into this world. We have people that have just entered this world. We have people that work day-to-day in this world. We have people that excel in niche areas of this world. Each group thinks they are unique in this world, but one commonality that pervades everyone and everywhere in this world is that we have questions about, “How do I?”.

How do I get into DFIR? How do I get better at DFIR? How do I specialize? How do I decide what to specialize in next? How do I get to be like ‘that’ person?

Besides these questions, there are more practical questions. What training do I take? What tools do I use? Who should I follow? How can I find a mentor? Why would anyone want to give up their time to help me?

Things are changing faster in DFIR than ever before. Questions are everywhere. Let’s walk through the world of DFIR from beginning to end together. Where did you come from? Where do you go? How can you know what is in between? We don’t profess to know all the answers, but I can assure you we all feel the same way, and we are all on this crazy ride together. So, let’s get to know each other and the playing field. The theme? You be you and be comfortable in your skin. It is going to be a fun hour and a half!

This presentation focuses on how a criminal or civil forensics case is approached from the defense aspect. This is typically a frowned upon area of computer forensics, but it shouldn’t be. Unlike many “expert” fields, a computer forensics expert analysis cannot be “bought”. The data doesn’t lie. We merely interpret and report what exists. I will be bringing several stories to the presentation outlining how absolutely, innocent people were spared from many years wrongfully convicted. I will also bring a couple stories about people who were guilty, but thought they were smarter than everyone else!