0x03 Advisory board
Five people whose job is to tell us when we are wrong.
The Security BSides Dehradun 0x03 advisory board does not run the conference. It is a small group with more track record than the organising team, asked to look at the programme, the process and the promises before an audience does, and to say the uncomfortable thing early enough for it to still be worth saying.
Four of the five seats are filled and the fifth is not. Nobody is listed as an advisor to 0x03 until they have agreed in writing, so the gap below is a real gap rather than a name being held back for an announcement.
- Seats
- Five Fixed for this edition.
- Paid
- No Volunteers, like everybody else on this conference.
01 What the board does
Advice, with the right to be ignored.
An advisory board that can overrule the organisers is a second organising team, and two teams running one conference is how a conference stops happening. So the arrangement is deliberately lopsided: the board advises, the team decides, and the team has to explain itself.
Every edition of BSides Dehradun has been run by people who were still learning how to run it. That is not a criticism of this conference in particular. It is what a volunteer event is, but it does mean the organising team is reliably the group least able to see its own blind spots. The advisory board exists to be a second pair of eyes from outside, attached to nothing.
Seats are held for one edition. An advisor who wants to carry on is asked again; an advisor who does not is thanked and left alone. Nobody accumulates a title here, and nobody's name stays on this page longer than their involvement does.
-
Reads the programme before it is public
A running order reads very differently to somebody who has not spent six months building it. The board sees the shape of the day early enough for a bad call to still be reversible.
-
Keeps the conference honest about its size
This is a volunteer event in a valley, not a trade show. The board's most useful function is saying when an ambition has outgrown the number of people available to deliver it.
-
Sits outside the money
Advisors take no part in sponsorship decisions and receive nothing for the role. Where an advisor's employer sponsors the conference, that buys exactly what the prospectus says it buys and nothing on the programme.
-
Is willing to disagree in public
The whole point of an external board is that it can say no in a way an internal team cannot. An advisory board that has never disagreed with anything is decoration.
02 The board
Four names, and one seat still open. One seat open
Seats are filled one at a time and announced as they are, rather than held back for a single reveal. A part-built board that says which part is missing is more useful to a prospective speaker than an empty page, and more honest than one arranged to look finished.
Announced individually as each seat is confirmed
-
Veerababu Penugonda
Founder, and better known as Mr-IoT
IoTSRG
Has been publishing IoT and embedded security work since 2017, and runs IoTSRG, whose tooling, device lists and lab guides are all open source.
LinkedIn profile -
Nipun Jaswal
Senior director, and global capability lead for offensive security
NTT DATA
Has written twelve books on penetration testing, network forensics and exploit development, the first of them Mastering Metasploit in 2014, and has disclosed more than ten zero-days.
LinkedIn profile -
Sanjeev Multani
Head of security, and better known as Mr. BoF
Nuvollo
Has published LVS, an open source vulnerable web application covering the OWASP Top Ten of 2013, and gives the specialism as kernel exploits and buffer overflows.
X profile -
Dhawal Shrivastava
Senior security assurance engineering lead
Microsoft
Is a founding member of the security assurance team at Microsoft's Security Response Center in India, sits on the core team for BlueHat Asia and BlueHat India, and built PSIRT operations at Citrix before that.
LinkedIn profile -
Seat five
Not confirmed yet
Employer
The fifth seat is open. It is filled when somebody has said yes, and not before.
Link to follow
Where an employer is named it is there to tell you what kind of work the person does. It is not a statement that the organisation endorses, sponsors or has any view about BSides Dehradun. Advisors sit here as individuals.
A line here is drawn from work the person has already published under their own name or written by the person themselves, and where neither exists the line stays empty rather than being filled in. One of the four sat empty for two days for exactly that reason, and was written the day a source arrived. Writing somebody a personality from a search result is how a board page ends up carrying a sentence its own member would not sign.
03 Conflicts
Where an advisor steps back.
An advisor with a stake in an outcome does not get to advise on it. Three cases cover almost everything, and all three have come up at conferences smaller than this one.
- Submitting a talk
- Allowed, declared An advisor may submit to the call for papers like anyone else, and says so when they do. They take no part in the review of their own proposal.
- Their employer sponsoring
- Allowed, declared Sponsorship buys what the prospectus lists. An advisor does not carry an employer's interest into a programme conversation.
- A conflict they spot first
- Expected The version of this rule that actually works is the one an advisor applies before anybody has to ask.
The two boards are separate lists with separate jobs. The advisory board looks at the conference; the review board reads submissions to the call for papers. One person may sit on both, and where that happens it is stated on both pages rather than left for a reader to notice.
Anything that looks like a conflict nobody has declared is worth an email to info@bsidesdehradun.com, the general address. Reports about behaviour rather than process go to conference@bsidesdehradun.com instead, which is a shorter list and is set out in the code of conduct.
04 Questions
What people ask about the board.
What does the advisory board actually do?
It advises, and the organising team decides. The board reads the programme before it is public, says when an ambition has outgrown the number of volunteers available to deliver it, and is expected to disagree out loud when that is the honest thing to do. An advisory board that has never disagreed with anything is decoration.
Can the board overrule the organisers?
No, and that is deliberate. A board that can overrule the organisers is a second organising team, and two teams running one conference is how a conference stops happening. The arrangement is lopsided on purpose: the board advises, the team decides, and the team has to explain itself.
Why is one seat empty?
Because nobody has said yes to it yet. There are Five seats, four are filled, and nobody is listed as an advisor until they have agreed in writing. Seats are announced one at a time as they are confirmed rather than held back for a single reveal, because a part-built board that says which part is missing is more useful than an empty page.
Are advisors paid?
No. Advisors are volunteers like everybody else on this conference, take no part in sponsorship decisions, and receive nothing for the role.
How long is a term?
One edition. An advisor who wants to carry on is asked again, and one who does not is thanked and left alone. Nobody accumulates a title here, and nobody's name stays on this page longer than their involvement does.
Can an advisor submit a talk?
Yes, like anyone else, and they declare it when they do. They take no part in the review of their own proposal. The same holds if their employer sponsors the conference: sponsorship buys what the prospectus lists and nothing on the programme.
Is this the same as the review board?
No. Two separate lists with separate jobs. The advisory board looks at the conference as a whole; the review board reads submissions to the call for papers and chooses the talks. One person may sit on both, and where that happens it is stated on both pages rather than left for a reader to notice.
How do I nominate somebody?
Write and tell us who they are. If you know somebody in Indian information security whose judgement you would take on a bad day, that is the whole of what we are asking for. Self-nominations are fine and are held against nobody.
Nominations
Five seats, and no shortlist worth keeping secret.
If you know somebody in Indian information security whose judgement you would take on a bad day, tell us who they are. Self-nominations are fine and are held against nobody.