Presentations CRob has given over the years
- AppDev & SecArch - building a better future together - A presentation on how developers and security folks can work better together
- AppSec Panel of Power - PSL Edition - A panel we did with Chris Bush, Scott Geotte, and Dave Russo at the 2023 CLE-ISS
- Circles and Boxes - A presentation about Security Architecture as a disipline from Derbycon 2015 Video
- Cracks in the Foundation - A presentation about observed patterns many infosec programs follow and suggestions on how to avoid them at a CLE-ISS
- Culture Club - A presentation about how to cultivate a positive culture on an infosec team and with your stakeholders from a spring CLE-ISS
- Having a Career in InfoSec - Presentation we gave for newcomers interested in having a career in information security and the CISSP certification at a CLE-ISS
- Introducing the Cart to the Horse - A presentation telling the tale of how to assemble a high-performing infosec CSIRT team at IBM Interconnect 2015
- Little Red Riding CRob and the Big, Scary Log Journey - Circa 2007 hand-doodled presentation for a SplunkLive event
- Measuring and Reporting Risk - A presentation where CyberFace helps us understand different ways to measure, manage, and communicate risk to stakeholders at the 2021 CLE-ISS
- Mock Incident - Oh Pastebin, what have you done to me? - Mock incident run at a past CLE-ISS conference
- Mock Incident - all your networks are belong to us - Another mock incident we ran at CLE-ISS 2014
- Security, Compliance, and Quantum Entanglement - a 2023 CLE-ISS keynote I did with Kevin Baker about how Secuity and Compliance programs are "entangled" together
- Security Jeopardy - Application Security A game we ran at a conference around application security concepts at a CLE-ISS
- Security Jeopardy - CIS Controls - A game we ran at a conference around the CIS Controls
- CLE-ISS-2018 - Choose Your Own Disaster: The Curious Case of the Cloudy Conundrum - A Mock Disaster Dave Russo and I ran about Cloud-based companies having a bad day at the CLE-ISS 2018
- CLE-ISS-2019 - Choose Your Own Disaster: Zippy Spacedirt and the Spiders from the Web
- Why you need to care about the CRA - a presentation I gave explaining the CRA to non-OSS, non-PSIRT folks; given at April 2025 CMH OWASP & CLE ISC2 Meetings
- A Day in the Life of a TPC CVE - A presentation on how Third Party Component CVEs should be managed by a PSIRT
- Akrites: Building the Open-Source Defense Layer for the AI Vulnerability Era - A presentation I gave during the 2026 Blackhat conference at a co-hosted event through RSA. This talk speaks to the new Akrites OSS-SIRT team, it's role within the upstream ecosystem, and how we're hoping to prepare the ecosystem for the usage of LLMs and other AI-related tools. - Weathering the Storm: Cybersecurity in the AI Era (BH/DC week)- August 4, 2026
- CLE-ISS 2017 - Hitchhiker's Guide to Vulnerabilities - A presentations I did with Dave Russo reviewing common terms and practices used in Coordination Vulnerabiity Disclosure (CVD) at a CLE-ISS. Here is a delightful picture of Dave and I in our robes and a 2025-updated version of the talk as a video.
- CRA 4 CVE CYA - a presentation given to the CVE Program's Customer Working Group in Feb 2026 focused on the reporting obligations that CNAs need to be aware of for the EU CRA.
- CRA PSIRT TL/DR - A presentation given to PSIRTs about how they need to prepare for the EU's CRA legislation - VulnCon 2025
- Don't Be Elmer (FUD) - A presentation for the 2023 FIRST PSIRT TC providing advice on how the PSIRT should read security vulnerability reports, red flags to look for, and techniques to working more effectively with security researchers.
- I Found a Vulnerability, Now What? - A presentation Lisa Bradley and I gave at Derbycon 2018 about how security researchers and PSIRTs can more efficiently communicate. Video
- PSIRT Maturity - A presentation on how to measure and improve the maturity of your PSIRT at the FIRST PSIRT TC 2020
- Starting and Maturing a PSIRT - A presentation talking about key services a PSIRT should provide their stakeholders and how to improve the maturity of those capabilities
- AI Everywhere, Trust Nowhere? - a Session I gave about the 3 Problems with AI - LF All Hands 2026
- All your Base - A keynote that Eddie Knight and I gave at OSS-NA 2025 about the ORBIT working group and the OSPS Security Baseline
- Back to BASE-ics! - A Talk prepare for the GitHub Security Fund cohort Oct 2025
- Best Practices make Perfect! - Presentation Marta and I gave about the OpenSSF's BEST Working group - OSS-EU 2022
- Cherry Blossom and Compliance - A Talk that Mike Bursell and I gave at OSS-JP 2025 in Tokyo. video
- Crossing the Streams - a presentation Madison and I gave that explains how downstream can better understand upstream oss - VulnCon 2024 video
- Cybersecurity Strategy in the Face of Global Digital Regulation - A talk around the CRA and other global cybersecurity regulations - LFEU Roadshow 2025
- Developing a secure open future - a presentation I gave to provide actionable advice for project maintainers to improve the security of their projects - OSS-NA 2024 Video
- Drowning & Angry - Open Source Project Vulnerability Handling in the Era of AI Slop reports - Presentation about the increase of AI Slop vulnerability reports and how upstream is managing them. - Vuln4Cast 2025
- Free Fish Aren't Free - A presentation about how open source software projects work and how steps downstream consumers of those projects need to do to ensure they are secure from several conferences in 2021
- Implementing the OSSF Best Practices Badges & Scorecards into your project - A presentation that Dr. Wheeler and I have given at the 2023 OSS-NA and OSS-EU conferences about how developers can integrate the OSSF Best Practices Badge and OSSF Scorecard into their projects. There also were videos for the NA and EU]( ) sessions.
- Open By Default - A presentation about 2019 CVEs in open source software from the FIRST PSIRT TC 2019
- The Lazy Guide to OSS Risk Management - a presentation about Risk Management (and CyberFace!) - Stir Trek 2024 + CLE-ISS 2024
- Let's Play AI Candyland a presentation that Sarah Evans from Dell and I gave at the 2024 LFMS speaking about implementing DevSecOps processes for AI/ML/MLL development.
- Open Source doesn't care about you, but you should care about it - A presentation about how vulnerabilties are worked upstream and about things downstream consumers should be aware of/plan for the inevitable vulnerability in some open source software they are using - FIRSTCON2022 & CLE-ISS 2022
- Rusty & the Crate Escape - Choose Your Own Disaster - A mock incident/tabletop exercise using the "Choose Your Own Adventure" format focused on a Rust crate vulnerability. - RustCon 2025
- Sailing the Seas of Open Source - Presentation I did about open source security (this later became the basis of "Free Fish aren't Free!") - CLE-ISS 2019
- SBOM in the Age of Global Regulation - SBOMit - A talk I gave at the SBOMit workshop attached to Kubecon2025
- Securing OSS At Scale - a presentation about OSS threats and how the Open Source Security Foundation is working to address them from Blackhat 2021 & OSS-NA 2022 Youtube Video
- Six Months in.... Developing the OpenSSF's Security Toolbelt - a presentation my pals John, and Sarah, and I did about what the OpenSSF's Security Toolbelt project is all about - OSS-NA 2024 Video
- Super BEST Friends - a presentation we gave at 2024 LFMS about the OpenSSF's BEST working group, the new OSSF Security Baseline, and our newest project, Minder.
- The Chain - an open source software supply chain talk I've given in 2023 at the Intel Vision, Cloud Nirvana, and CLE-ISS conferences
- The Future of Open Source is Trust - a keynote I gave around how open source always was and will be based on trust at the OSS-EU 2022 YouTube Video
- Zero Day Preppers - A presentation about zero days in open source and how maintainers/contributors can work to ensure positive outcomes from them from OSS-NA 2022