DerbyCon attendees and co-founder reflect on the end

The legacy of DerbyCon

Kennedy told SearchSecurity that his inspiration for fostering the DerbyCon community initially was David Logan's Tribal Leadership, "which talks about growing a tribe based on a specific culture.

"A culture for a conference can be developed if we try hard enough and I think our success was we really focused on that family and community culture with DerbyCon," Kennedy said. "A conference is a direct representation of the people that put it on, and we luckily were able to establish a culture early on that was sorely needed in the INFOSEC space."

April C. Wright, security consultant at ArchitectSecurity.org, said in her years attending, DerbyCon provided a "wonderful environment with tons of positivity and personality."

"I met my best friend there. I can't describe how much good there was going on, from raising money for charity to knowledge sharing to welcoming first-time attendees," Wright said. "The quality of content and villages were world class. The volunteers and staff have always been friendly and kind. It was in my top list of cons worldwide."

Eric Beck, a pen-tester and web app security specialist, said the special part about DerbyCon was a genuine effort to run contrary to the traditional infosec community view that "you can pwn or you can't."

"We all start somewhere, we all have different strengths and weaknesses and everyone has a seat at the table. Dave [Kennedy], set a welcoming tone and it meant that people that might otherwise hesitate took that first step. And that first step is always the hardest," Beck said. "DerbCon was my infosec home base and where I recharged my batteries and I don't know who or what can fill its shoes. I have a kiddo I thought I'd share this conference with and met people I assumed I'd see annually. I'm personally determined to contribute more in infosec and make the effort to reach out, but I have a difficult time imaging being part of something that brought in the caliber of talent and the sense of welcoming that this conference did."

Danny Akacki, senior technical account manager with Gigamon Insight, said his first time attending was DerbyCon 6 and the moment he walked in to the venue he "fell in love with the vibe of that place and those people."

"I still didn't know too many people but I swear to god it didn't matter. I made so many friends that weekend and I had the hardest bout of post-con blues I've ever experienced, which is a testament to just how profound an effect that year had on me," Akacki said. "I had to skip 7, but made it to 8 and 9. Every year I went back, it felt like only a day had passed since the last visit because that experience and those people stay with you every day." 

For Alethe Denis, founder of Dragonfly Security, DerbyCon 9 was her first time attending and she said the experience was everything she expected and more.

"The atmosphere was like a sleepover, compared to the giant summer camp that is DEF CON, and I really enjoyed that aspect of it. It felt like it was a weekend getaway with friends and the lack of casinos was appreciated. But I don't feel that the quality of the talks and availability of villages was sacrificed in the least," Denis said. "Even as small as Derby is, it was really tough to do everything I wanted to do because there were so many interesting options available. I feel like it brought only the best elements of the DEF CON type community and DEF CON conference to the Midwest."

Micah Brown, security engineer at American Modern Insurance Group and vice president of the Greater Cincinnati ISSA chapter, echoed the sentiments of brother/sisterhood at DerbyCon and the cheerfulness of the conference and added another key tenet: Charity.

"One of the key tenets of DerbyCon has always been giving back. During the closing ceremonies, it was revealed that over the past 9 years, DerbyCon and the attendees have given over $700,000 to charity. That does not count the hours of people's lives that go into making the presentations, the tools, the training that are freely distributed each year. Nor does it factor in the personal relationships and mentorships that are established and progress our community," Brown said. "It was after my first DerbyCon I volunteered to be the Director of Education for the Greater Cincinnati ISSA Chapter and after my second DerbyCon I volunteered to be the Vice President of the Chapter. DerbyCon has also inspired me to give back by sharing my knowledge through giving my own presentations, including the honor to give back to the DerbyCon community with my own talk this year."

Beyond DerbyCon

Xena Olsen, cyberthreat intelligence analyst in the financial services industry, attended the last two years of DerbyCon and credited the "community and sense of belonging" there with encouraging her to continue learning and leading her to now being a cybersecurity doctoral student at Marymount University.

"The DerbyCon Communities initiative will hopefully serve as a means for people to experience the DerbyCon culture around the world," Olsen said. "As far as a conference taking the place of DerbyCon, I'm not sure that's possible. But other conferences can adopt similar values of community and inclusiveness, knowledge sharing and charity." 

Wright said she has seen other conferences with similar personality and passion, "but none have really captured the heart of DerbyCon."

"There are a lot of great regional cons in the U.S. that I think more people will start going to. They are affordable and easily accessed, with the small-con feel -- as opposed to the mega-con vibe of 'Hacker Summer camp'," Wright said, referencing the week in Las Vegas that includes Black Hat, DEF CON, BSides Las Vegas, Diana Con and QueerCon plus other events, meetups and parties. "I don't think anyone can fill the space left by DerbyCon, but I do think each will continue with its own set of ways and personality."

Akacki was adamant that "no other con will ever take Derby's place."

"It burned fast and it burned bright. It was lighting in a bottle, never to be seen again. However, I'm not sad," Akacki said. "I can't even say that its vibe is rising from the ashes, because it would have to have burned down for that to happen. The fire that is the spirit of DerbyCon still burns and, I'd argue, it burns brighter than ever."

I'm not sure any other con will be able to truly capture that magic and fill the space left by Derby.

Denis said it will be difficult for any conference to truly replace DerbyCon.

"I feel like the people who organized and were passionate about DerbyCon are what made Derby unique. I'm not sure any other con will be able to truly capture that magic and fill the space left by Derby," Denis said. "But I guess that remains to be seen and hope that more cons, such as Blue Team Con in June 2020 in Chicago bring high quality content and engaging talks to the Midwest in the future."

Wright noted that some of her favorite smaller security conferences included GRRcon, NOLAcon, CircleCityCon, CypherCon, Showmecon, Toorcon and [Wild West Hackin' Fest], and she expressed hope that the proposed "DerbyCon Communities" project "will help with the void left by the end of the era of the original DerbyCon."

The DerbyCon Communities initiative

The organizers saw DerbyCon growing fast, but "didn't want to turn the conference into such a large production like DEF CON," Kennedy told SearchSecurity.

"We wanted to go back to why DerbyCon was so successful and that was due to three core principles: Posivitiy and Inclusiveness, Knowledge Sharing and Charity. There is a direct need for a community to help new people in the industry and help charity at the same time," Kennedy said. "The goal for the Communities initiative is to bring people together the same way DerbyCon did for one common goal."

Kennedy also confirmed that there will be some involvement with the Communities initiative from the "core group" of organizers, including his wife Erin, Martin Bos and others.

Akacki said that with the local Derby Communities initiative, "the spirit of Derby has exploded into stardust, covering our universe."

"You can't kill what we've built, you can't contain it and you can't stop it," Akacki said. "I'm not crying because it ended, I'm smiling and laughing … because it just became bigger than ever."

On Sept. 11, Kennedy pitched the full idea of DerbyCon Communities to the team and said there should be four main areas of focus:

• Chapter Groups
  • Independently run with chapter heads
  • Geographically placed
  • Volunteer network
• Established Groups
  • Partner with similar groups that meet criteria and approval process to join DerbyCon network.
• Conferences
  • Established or new. Allow for new conferences to be created.
• Kids
  • Programs geared towards teaching next-gen children.

Ultimately, Kennedy told SearchSecurity he wants new groups to "be welcoming and accepting of new people and making a difference and impact in their local communities or worldwide."

"Our hope is that not only do DerbyCon Chapters spawn up, but other conferences and chapter groups will join forces to create a DerbyCon network of sorts to grow this community in a positive way."