Ron Shaffer Email & Phone Number

Baltimore, Maryland Area

Maddrix is a cyber security company focused on helping government, critical infrastructure, and private sector organizations protect their mission critical and national security information from advanced threat actors and hacktivists. Our mission is to help our clients with the paradigm shift from traditional risk management programs to new and innovative ways to manage risk from these advanced threat actors. What We Do: We provide enterprise incident response, digital forensics, malware analysis, cyber analytics, proactive threat actor hunting with Endpoint Analytics, and build risk mitigation programs that address today's advanced threat actors. We have over twelve years of national and international experience supporting all branches of the U.S. Government and critical infrastructure organizations, and have built and implemented advanced risk management programs for many of them. We also provide strategy consulting to help our clients develop advanced risk mitigation programs, direct their limited security resources to the most effective areas, and help them leverage and integrate their existing solutions into an advanced risk mitigation program. Endpoint Analytics provides an enterprise view of endpoint activity that allows our cyber security analysts to hunt and detect advanced threat actors from a single location. Endpoint Analytics uses a small binary that can be deployed to the enterprise in minutes to our customers specifications. We use highly innovative and custom hunting techniques to identify advanced threat actors that can’t be detected with traditional solutions. Endpoint Analytics gives organizations the capability to rapidly identify known and unknown indicators of compromise prior to the release of anti-virus and IDS signatures, significantly improving detection time.

I am currently an adjunct professor at Stevenson University teaching digital forensics and intrusion analysis. Courses I teach include:File System Forensics - Prepares students with a thorough knowledge of file system structures and the ability to analyze digital evidence found in the various implementations of FAT, NTFS file systems, and other disk allocation structures. This knowledge and associated skill is essential for a complete understanding of evidence imaging and the analysis required providing testimony in court as an expert in the field of computer forensics.Network and Cloud Forensics - Provides students with a practical approach to obtaining forensic data from always-on, cloud-based resources.Incident Response and Investigation Methods – Students examine the role of the computer forensics investigator as a member of an Incidence Response Team and explore the nature of the threat to organizations, the indicators that an incident is underway, the policies and procedures to be followed when an incident is detected, and the investigation methods used to collect evidence for prevention or prosecution.

Baltimore, Maryland Area

I was a Delivery Manager for Booz Allen’s Advanced Persistent Threat team. I was responsible for leading multiple concurrent enterprise intrusion investigations for the Department of Defense (DoD), intelligence agencies, financial, government, and commercial clients. As a subject matter expert with Booz Allen’s intrusion and forensics team, I managed 50+ cyber analysts that provided counterintelligence reporting, detection, incident response, digital forensics, malware analysis, and remediation support to identify organized adversaries and other sophisticated threat actors. I was responsible for detecting intrusion artifacts not identified by traditional security devices and developing tactical and strategic plans for mitigation.I supported the DoD Cyber Crime Center (DC3) and developed the first intrusion exercise for the annual DC3 Cyber Crime Challenge -- a global event with over 1000 teams from 54 countries. I also managed the Defense Industrial Base Computer Emergency Response Team (DIB CERT) team providing oversight to several security analysts for the DIB Collaborative Information Sharing Environment (DCISE). DCISE was designed to improve and strengthen network defenses of the Defense Industrial Base (DIB) through information sharing.I developed techniques and procedures to utilize forensic tools and investigative techniques to monitor and test computer network operation capabilities. I was responsible for identifying and implementing appropriate tool sets, establishing protocols and training of staff on several commercial and open source utilities. I participated in congressional committee briefings related to Advanced Persistent Threats and cases on behalf of government clients. I was the lead author of a major intelligence product on the topic of the Advanced Persistent Threat and the affect they could have on defense systems that resulted in congressional testimony before the House Armed Services Committee.

While working at CSC I managed several tasks including a client facing Security Operations Center (SOC) for the Department of Education, the cyber security team, and CSC’s internal network operations support team. At the Department of Education I was responsible for management and coordination of six SOC personnel supporting the security of critical production environments in the 24x7 operation. I delivered daily reports, with recommendations to improve enterprise security. I led over 20 penetration testing engagements for government, intelligence, defense, and commercial clients. The team conducted internal, external, wireless, and application vulnerability assessments reporting detailed findings, immediate needs, and severity rating for each finding. For the digital forensics team I supported CSC clients with traditional forensic investigations, such as misuse of corporate resources as well as investigating enterprise intrusions. I developed techniques to detect organized adversaries without leveraging traditional security devices relaying on signature based technology.I was a developer and instructor for the DoD Cyber Crime Center (DC3) on initial digital forensic courses for what is now known as the Defense Cyber Investigations Training Academy (DCITA). I trained over 75 students from various intelligence agencies, DoD, and law enforcement in basic forensic examination techniques.

Washington, Dc

I was the system administrator for the Republican National Committee supporting a Novell and Microsoft environment with up to 350 – 400 users. I was responsible for maintenance of the servers and workstations. I played a critical role migrating the environment from Novell 3.x to Novell 4.x. I also helped develop a network design strategy for the 1996 Republican National Convention that provided extended network communications and resources for 300 staff members.

Fairfax, Va

As a technician for American Computer Rental, I was responsible for building computer systems and peripherals to the specifications of client requirements. I assembled hardware, installed and configured operating systems and applications and delivered the completed systems to client sites in the Mid-Atlantic region.

Ms, Network Secuirty

Bs, Computer Networking

Cs, Computer Science