ShowMeCon and Security Perspectives with Amanda Berlin

Summary:

Use the promo code “ExploringSec” to get $50 off your registration

In this episode of Exploring Information Security, host Timothy De Block welcomes Amanda Berlin, CEO of Mental Health Hackers & Senior Product Manager at Blumira, to discuss her experiences in security product development, incident detection, and the challenges of balancing security with usability. They explore the limitations of pentest reports, the practicality of security automation, and the psychology behind effective security awareness training. Amanda also shares insights on how small businesses can implement security without breaking the bank and what to expect from ShowMeCon.

Topics Discussed:

  • Amanda’s Keynote at ShowMeCon – How she ended up speaking and why Dave’s method of picking speakers is unconventional.

  • Security Automation vs. Usability – Why some industries can implement auto-lockouts, while others (like hospitals) cannot.

  • The Problem with Pentest Reports – Why they often contain unrealistic security expectations that don’t translate to real-world environments.

  • Getting Buy-In for Security Solutions – How to understand what organizations actually need instead of pushing the latest security trend.

  • The Role of Nudge Theory in Awareness Training – Why small, repeated reinforcements can be more effective than long training videos.

  • Security for Small Businesses – Strategies for implementing security on a limited budget and making defenses practical.

  • Side Tangents & Fun Conversations – Crossword puzzles, Wordle streaks, and the absurdity of marketing budgets in cybersecurity.

Key Takeaways:

  • Security needs to be tailored to the environment—automation can improve security, but in some cases, it can create more risks.

  • Pentest reports often miss the mark by listing detected issues without considering operational feasibility.

  • Security awareness is most effective when it’s continuous and engaging, rather than a one-time annual training.

  • Listening to users is critical—security teams must balance technical controls with usability needs.

  • ShowMeCon continues to be a top-tier conference for hands-on security learning and industry networking.

Showmecon Links and Resources:

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


Real World Windows Forensics and Incident Response with JC at ShowMeCon 2025

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with JC, President at Snowfensive, to discuss Windows forensics, incident response, and the upcoming training session at ShowMeCon. JC shares insights on real-world forensic investigations, common challenges organizations face in responding to incidents, and how forensic methodology plays a critical role in cybersecurity operations. This episode is packed with valuable information for security professionals, IT admins, and anyone interested in digital forensics.

Showmecon Links and Resources:

Topics Discussed:

  • ShowMeCon Training Session: What attendees can expect from JC’s Windows forensics course.

  • The Reality of Incident Response: The distinction between forensic analysis and incident response and how they complement each other.

  • Ransomware Trends: The evolution from encryption-based ransomware to data extortion and the impact on organizations.

  • Real-World Forensic Cases: Examples of forensic investigations, including rapid containment strategies and detecting data exfiltration.

  • Critical Thinking in Forensics: How forensic methodology is akin to detective work, and why troubleshooting skills are essential.

  • Challenges in Reporting: Why documenting forensic findings properly is just as important as the investigation itself.

Key Takeaways:

  • Organizations are improving at responding to ransomware but still struggle with preventing data exfiltration.

  • Understanding Windows forensic artifacts is crucial for both security teams and IT administrators.

  • Effective forensic investigations require both technical expertise and strong reporting practices.

  • Training and tabletop exercises are essential for preparing organizations to handle real-world incidents.

Guest Info:

  • JC is a cybersecurity expert specializing in Windows forensics, incident response, and offensive security services. He is the President of Snowfensive and Co-Founder of the Social Engineering Community.

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and privacy.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


ShowMeCon: A Must-Attend Conference for Cybersecurity Pros

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Dave Chronister and Brooke Deneen to discuss ShowMeCon, the Midwest’s premier security conferences. Dave shares the vision behind ShowMeCon, how it stands apart from other security events, and what attendees can expect from the 2025 edition. Brooke provides insights into the logistics of running the conference and the community-driven experience that makes it special. Whether you're a seasoned security professional or new to the space, this episode highlights why ShowMeCon is a must-attend event.

Listen to the episode for the promo code and get $50 off.

Showmecon Links and Resources:

Topics Discussed:

  • The Origin of ShowMeCon: How the conference came to be and its unique place in the cybersecurity event landscape.

  • Balancing Corporate and Hacker Culture: Creating a professional yet welcoming environment that bridges the gap between security research and IT professionals.

  • Venue and Experience: Why the Ameristar Casino in St. Louis is an ideal location and what makes the event an immersive experience.

  • Speaker and Attendee Engagement: The focus on quality content, hands-on learning, and ensuring speakers are passionate and approachable.

  • Expanding to New Cities: Plans to bring the ShowMeCon model to new locations like Nashville and beyond.

  • ShowMeCon 2025 Highlights: The return of pre-conference training, CTFs, lockpicking villages, and an exciting Fallout-themed experience.

  • Building a Security Community: Encouraging new speakers, creating a welcoming space, and fostering professional development.

Key Takeaways:

  • ShowMeCon is designed for practical security education, offering content relevant to both IT and security professionals.

  • The conference prides itself on being a well-run, high-quality event where speakers and attendees engage meaningfully.

  • Training opportunities and community events, such as CTFs and lockpicking villages, enhance the overall experience.

  • ShowMeCon’s future includes expansion to other cities and continued efforts to foster an inclusive and passionate security community.

Guest Info:

  • Dave Chronister is the founder of ShowMeCon and a cybersecurity professional with over 18 years of experience in the industry.

  • Brooke Deneen plays a key role in organizing ShowMeCon and ensuring the event runs smoothly.

Support the Podcast:

Enjoyed this episode? Leave us a review and share it with your network! Subscribe for more insightful discussions on information security and cybersecurity events.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn][YouTube]


What is ShowMeCon 2024?

Summary:

Dave Chronister the organizer of ShowMeCon joined me to discuss the revival of the conference. ShowMeCon is one of my favorite conferences. I had the pleasure of going to it from 2016-2018. I had plans to return in 2020 but the world event that we shall not speak of happened. I’m happy to see it return in 2024 and I will be there!

We get into a variety of topics around the conference including sponsorship, who attends, the venue, and the theme for 2024. The conference is still looking for sponsors and they’re about to do a second round of call for papers for speakers. If you’re looking to attendee the early bird price ends January 14th, 2024. Looking forward to seeing you there!

Episode Highlights:

  • ShowMeCon is still looking for sponsors

  • Who comes to the conference

  • The origins and venue of ShowMeCon

  • The theme for ShowMeCon 2024

Guest Information:

Dave Chronister organizer of ShowMeCon and CEO of Parameter Security

Resources and Mentions:

  • ShowMeCon

  • For questions reach out to info@showmecon.com

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]


How to handle CFP rejection(s)

In this refused episode of the Exploring Information Security podcast, Michael Kavka joins me to discuss how to handle call for presentation rejections.

Michael (@SiliconShecky) wrote a blog post on his site at the beginning of the year titled, It is CFP season... So what. In the article he hit on rejections and I thought it'd make for a great podcast topic. More recently, he wrote a blog post on the, Anatomy of a Rejected CFP. The article walks through his rejected CFP for DerbyCon.

In this episode we discuss:

  • What is Michael's experience in submitting CFPs
  • Why a CFP is rejected
  • What are the different types of cons?
  • How to handle a CFP rejection letter

More resources:

What's happening at Converge and Detroit BSides?

IMG_5368.jpg

In this pile of an episode for the Exploring Information Security podcast, Johnny Xmas (@J0hnnyXm4s), Kate Vajda (@vajkat), Rachel Andrus, Kyle Andrus (@chaoticflaws), Daniel (not going to try spelling last name), Amanda Ebbutt, Daniel Ebbutt (@notdanielebbutt), Chris Maddalena (@cmaddalena), and myself get together to record a podcast during Converge and BSides Detroit.

It's another podcast special! This one was at Converge and BSides Detroit. This one took a little bit to get going. When we did we got into a little bit of everything. Topics both in infosec and topics outside of infosec.

In this episode we discuss:

  • Everyone tries Malort

  • The "breach" at Twitter

  • One size doesn't fit all for the populace

  • Real world issues (net neutrality, income, and public service)

How to submit a presentation to a conference - Part 2

In this presented edition of the Exploring Information Security podcast, Dr. Jessica Barker joins me to discuss how to submit a presentation to a conference.

Jess (@drjessicabarker) runs the @cyberdotuk account on twitter and website. She's also the co-founder of Redacted Firm (@redactedfirm). She wrote an article last year that covered recommendations and tips for submitting to a conference Call for Papers (CFP). It all started with a tweet asking what's holding people back from submitting to a conference. Over 6,000 responses later there were a variety reasons, including "I don't know enough.' The article goes on to ask several organizers for their suggestions on submitting. In this podcast episode we dive into the article and much more.

In this episode we discuss:

  • How is someone supposed to navigate advice

  • How to submit a presentation to a conference

  • What resources are available

  • What should someone do if the don't get accepted to speak?

How to submit a presentation to a conference - Part 1

In this presented edition of the Exploring Information Security podcast, Dr. Jessica Barker joins me to discuss how to submit a presentation to a conference.

Jess (@drjessicabarker) runs the @cyberdotuk account on twitter and website. She's also the co-founder of Redacted Firm (@redactedfirm). She wrote an article last year that covered recommendations and tips for submitting to a conference Call for Papers (CFP). It all started with a tweet asking what's holding people back from submitting to a conference. Over 6,000 responses later there were a variety reasons, including "I don't know enough.' The article goes on to ask several organizers for their suggestions on submitting. In this podcast episode we dive into the article and much more.

In this episode we discuss:

  • How to get started submitting a CFP

  • Why submit a presentation to a conference

  • The different types of CFP review

  • What preparation is necessary

What is Converge and BSides Detroit?

In this Motor City edition of the Exploring Information Security podcast, Ryan Harp, Kyle Andrus, and Kate Vajda join me to discuss the conferences Converge and BSides Detroit.

Ryan (@th3b00st), Kyle (@chaoticflaws), and Kate (@vajkat) help put on one of the best conferences. Last year was my first year at the conference. I was not disappointed. They had a workshop on application security; a room set aside to get resume feedback; Ham radio exams; and much more. They also had three days of wonderful talks with some really great speakers. At lunch there are multiple treks to go grab a coney dog.

The call for papers is currently open. They're looking for speakers and to add more workshops this year. Tickets are also available now. Make sure to grab yours and I'll see you at Converge and BSides Detroit May 10-12.

In this episode we discuss:

  • How the conference got started.

  • Where the conference is at and what's new this year for the layout.

  • What's unique about the conference.

  • Coney dogs.

What's happening at DerbyCon?

In this legacy edition of the Exploring Information Security podcast, Ben Miller (@securithid) , Cliff Smith (@BismithSalamandr) , Paul "BubbaSec" Coggin (@PaulCoggin) , Dave Chronister (@bagomojo), Sean Peterson (@SeanThePeterson), and Jimmy Byrd (@Jimmy_Byrd) (and briefly @aprilwright ) join me to talk security.

 This is likely the last podcast conference special of the year. It's a good one. We had quite the crew to record this one and got very in-depth and deep on topics related to infosec. Big shout out and thanks again to Dave for bringing the mics and participating in the podcast.

I've been pleasantly surprised with how this and the other podcasts have turned out. I've gotten some great feedback and I plan to do more of these in the future. It was also floated to me that we record one of these as a panel at one of the conferences. We'll see.

In this episode we discuss:

  • The legacy of DerbyCon and what the future holds.
  • What it's like at a developer conference?
  • Is there security fatigue?
  • Patch your shit.

Resource we discussed:

What's happening at BSides Augusta?

In this masters edition of the Exploring Information Security podcast, Adam Twitty, Robert Preston, Jeff Lang, and myself discuss security things.

This is another EIS podcast special at BSides Augusta. I have some close friends joining me for this one. Adam, Jeff, and Robert all part of a local user group in Columbia, South Carolina, aptly named ColaSec. I also worked with Adam and Robert at my first security gig.

BSides Augusta is one of my favorite BSides events. It's really well run. It has a great facility and there's so much to do. In fact, I took part in my first conference capture the flag (CTF) with some of the guys from ColaSec. It was quite the experience and a lot of fun. I highly recommend the conference for those free in mid-September.

In this episode we discuss:

  • What it's like to be on a good team
  • What you need to know to get into the field?
  • What paths are available to get into infosec
  • What is ColaSec?

What does Chris Maddalena, Kyle Andrus, and Daniel Ebbutt think about security at DEFCON?

In this crazy edition of the Exploring Information Security podcast, I am joined by Chris Maddalena, Kyle Andrus, and Daniel Ebbutt for another conference podcast special. This time it's DEFCON 25.

Chris (@cmaddalena), Kyle (@chaoticflaws), and Daniel (@notdanielebbutt) join me at DEFCON to discuss various topics ranging from conferences like DEFCON, Blackhat, and BSides Las Vegas to bird feeders. We read a couple passages from the POC||GTFO bible available from no start press.

In this episode we discuss:

  • The death of LineCon
  • Blackhat swag
  • BSides Las Vegas
  • Converge and BSides Detroit
  • Saying yes and knowing when to say no
  • Report writing
  • Macros
  • Bird feeders

What is BSides Bordeaux

In this exquisite episode of the Exploring Information Security podcast, Allan Liska and Tim Gallo join me to discuss a brand new BSides in Bordeaux.

Both Allan (@uuallan) and Tim (@TimJGallo) are in the Unite States. This makes starting a BSides in France challenging and intriguing. Both organizers love wine and saw an opportunity to put France on the BSides map. BSides Bordeaux (@BsidesBDX) is October 21, 2017, in Bordeaux France. The venue is Mama Shelter (which has a wicked video). Tickets are limited so be sure to grab one soon.

In this episode we discuss:

  • What inspired them to start BSides Bordeaux
  • The challenges of organizing a BSides on another continent
  • What makes the conference unique
  • What are some of the things to do in Bordeaux

How to get a DerbyCon ticket

In this scavenger edition of the Exploring Information Security podcast, I provide tips on getting a ticket to DerbyCon.

DerbyCon tickets went on sale May 6, 2017. Two minutes before the official release time, tickets were already sold out. This led to some controversy surrounding the release of tickets five minutes before. This was something that the conference has done for years. Last year the conference sold out in hours. This year it became a problem. There is still plenty of time to secure a ticket. Here are some ways to do that (h/t @PyroTek3).

DerbyCon Twitter account: DerbyCon plans to release more tickets in smaller batches. Watch their Twitter account for more information.

Watch Twitter: Plans change. People will be selling tickets leading up to the conference. Expect an increase in people looking to sell their tickets the month before the conference. I would also recommend paying attention for when speaker notifications go out. Usually around early August.

Submit a talk: The year I began speaking, I got accepted to speak at DerbyCon. The conference prefers new talks and loves new speakers. If you have an idea go for it. You never know. 

Volunteer: It takes a lot of people to run a conference. Volunteers get a free ticket to the con. You will have to work the conference. Which also may result in making some new friends and connections.

Sponsor the conference: DerbyCon is still looking for sponsors. Included in the sponsor package are tickets to the con.

Contests: Keep a look out for contests involving tickets. For example the Brakeing Down Security podcast is putting on a CTF for DerbyCon tickets. 

What is ShowMeCon?

In this show me episode of the Exploring Information Security podcast, Dave Chronister managing partner at Parameter Security (@ParameterHacker) and organizer discuss ShowMeCon.

I can't say enough good things about Dave (@bagomojo). Last year was my first opportunity to attendee and speak at ShowMeCon (@ShowMeConSTL). He and the organizers did a tremendous job taking care of the speakers and attendees. There was great content, activities, food, parties, and the venue was top notch. This is one of the most well run and classiest conferences I've had the opportunity to attendee. I am excited to have the opportunity to speak again at the conference.

The conference has a different feel than other security conferences. It has more of a business feel. Which is a nice change of pace. This gives businesses in St. Louis an opportunity to tap into the vast knowledge of infosec community. It gives speakers of the infosec community an opportunity to show businesses how deep the infosec rabbit hole goes. I highly recommend (and often do) this conference to everyone in IT security.

ShowMeCon is June 8 and 9, 2017, at the Ameristar Casino and Resort. Tickets are available until May 15, 2017.

Other Details:

If you need to contact the organizers of ShowMeCon their phone number is 314-442-0472. If you would like to volunteer send an email to info[@]showmecon[.]com

In this episode we discussed:

  • What is ShowMeCon
  • How the conference got started
  • Who should attend ShowMeCon
  • What can attendees expect
  • A Saturday morning cartoon party

What is BSides Nashville?

In this musical edition of the Exploring Information Podcast, organizers Jennifer Samardak and Finn Breland join me to discuss BSides Nashville.

BSides Nashville (@bsidesnash) is the second BSides I attended and the only one I've attend each year since it's inception. It's a really well put together conference. They have three tracks. They have the usual side areas with lock picking, hardware hacking, and a kids area. The best part though is the lunch. They cater lunch from Martin's BBQ. One of Nashville's best BBQ places. I would put the food up against any conference. I join Jen (@jsmardak) and Finn (@FinnBreland) to talk about all that and much more.

BSides Nashville is April 22, 2017, at Lipscomb University. Tickets are sold out. A waiting list is available for those hoping to attend.

In this episode we discuss:

  • What is BSides Nashville
  • Who should attend the conference
  • What makes it's unique
  • Where are the places to visit in Nashville?

What is BSides Indy?

In this circular edition of the Exploring Information Security podcast, Frank the Tank joins me to discuss BSides Indy.

Frank (@TheDevilsVoice) is the lead organizer of BSides Indy (@indybsides). I am excited to be traveling to the conference this year. I will be taking pictures and speaking at the event. I decided to have Frank on to talk about BSides Indy to gauge what type of BSides event I can expect. The theme I got from my chat with Frank is that it's a very laid back type of BSides with a lot of the usual events. They have some wonderful speakers. A lock pick village and a place for hacking Internet of Things (IoT) devices. Hack4Kidz for the little ones and a devious capture the flag (CTF) event. I am excited to go. Tickets are still available. General Admission is $15 for Saturday. Hack Harder (Friday workshops) and the Saturday talks are $30. If you're a student or broke tickets are free. See you there!

In this episode we discuss:

  • What is BSides Indy?
  • How the con got started
  • What makes this conference unique?
  • What is the one thing to do in Indy (Pork tenderloin sandwiches)

What is BSides Hunstville?

In this launched edition of the Exploring Information Security podcast, Paul Coggin joins me to discuss BSides Hunstville.

Paul (@PaulCoggin) is the founder and organizer of BSides Hunstville (@BSidesHSV). I will be attending the conference for the first time this year. The conference is in it's fifth year of existence. In our discussion I found something unique about the conference. Paul doesn't deal with sponsors like some other BSides conferences. Which isn't a bad thing and I'm interested to see how that plays out in talks and networking opportunities. The lineup of speakers looks fantastic. Tickets are still available and I encourage people to check it out.

In this episode we discuss:

  • What is BSides?
  • How BSides Hunstville got started?
  • What is unique about the conference?
  • Why Huntsville is a prime place for a BSides?

What I learned at DerbyCon

In this enlightening episode of the Exploring Information Security podcast, I talk about what I learned at DerbyCon.

This was my second trip to DerbyCon. Last year was a wonderful experience. This year was much the same. While at the conference I had some takeaways that I wanted to share on the podcast (Also, I've been slack in getting guests on the show lately).

In this episode I discuss:

What is DerbyCon?

In the return of the Exploring Information Security podcast, I explore DerbyCon with Adrian Crenshaw AKA Irongeek.

Adrian (@Irongeek_adc) is one of the founding members of DerbyCon. Last year I went to DerbyCon for the first time. I had an absolute blast and I happy that I am getting an opportunity to go again this year. The talks are all fantastic, but even better are the connections that can be made at the conference. DerbyCon is in Louisville, Kentucky, September 21 - 25, 2016. The conference is sold out, but tickets can be usually found by watching Twitter for people selling tickets.

DerbyCon videos are up.

In this episode we discuss:

  • The origins of DerbyCon
  • All the events and activities available
  • How to get involved in the conference
  • BONUS: How to get accepted at DerbyCon

Other resources: