We did a webinar about this with Security Weekly. You can check it out here: https://securityweekly.com/ondemand 

But while an hour seems like a long time to discuss the topic, it really wasn’t enough. There were so many details that we didn’t get into. Plus, some people prefer to just read a post than sit through a 60 minute webinar. The webinar featured Lea Snyder, Jason Blanchard, and Patrick Laverty (me). If you still have questions after this, let me know.

Cred

If you care about credentials, cool, there they are. I’ve been organizing conferences since 2013 with the creation of BSides Rhode Island, OWASP Rhode Island and now DefCon 401. I co-organized the BSides with Paul (Security Weekly) Asadoorian. Lea jumped in and helped on that one as well. After that, I helped out with the BSides Boston team and was the speaker coordinator for a few years. Lea chaired BSides Boston for three years, and she organizes BSides Seattle, DefendCon and this year volunteered with Diana Initiative. Jason has been an organizer with SANS conferences and is also a part of the Black Hills Infosec‘s two great Wild West Hackin’ Fest conferences in Deadwood and San Diego. Finally, Lea and I are the co-creators and co-organizers of the Layer 8 Conference (this web site).

tldr;

Here’s what you need:

• A space (physical or virtual). Physical can be the corner of a bar, a classroom, a conference room or a convention center.
• Attendees/participants. What’s the point if no one shows up?
• Speakers. That’s it. Participants can be speakers. You don’t need anything else. Everything else is “extra”.

Why?

This is for people who want to create a conference. What are you looking to do? Do you want to create a general conference? Or will you have a niche? Will you create your own brand, or go with a known name like BSides? There’s no right or wrong answers here, it’s all whatever you want to do. If you go with a BSides, what you do is contact them at info@securitybsides.org and let them know what you want to do. They’ll fill you in on. One huge benefit of running a BSides is sponsors know and trust that name. It can make fundraising a bit easier. Ok, a LOT easier. If you want to create your own brand, great! You can do that too, but it’ll take some time for people to know who you are and trust you with their time and money.

Where?

Where will you hold the conference? You can have it in person or online, or a combination of both. If you are able to have it in-person, you can grab the corner of a bar (done it!), a conference room (done it!), a classroom (done it!) or a convention center (yep, done it!). If going virtual, just figure out what streaming service you want to use like GoToWebinar, Zoom, YouTube, Twitch or any of the others. For more info about going virtual, I wrote another blog post all about that.

So how do you find a space? Well, just ask. Get an idea of how big you want your conference to be and then find an appropriate sized space to fit it. If you go with something like a bar, you might be able to do it for free, as the bar will get money from food and drinks. A local business may be willing to let you use their conference rooms. Some businesses have rooms that can accommodate a few hundred people at a time. A local university might rent space for relatively cheap too, but if you plan to have food, find out if you’re required to use their catering. If you’re ready to make the jump to a convention center or a hotel, get ready for some sticker shock. Also, prices can change depending on what other services you contract with them for. For example, the space could be $12,000 but if you use the catering, the space drops to $2,000, with a minimum of $15,000 purchase to the caterer. In a small city, the per-person cost for space could be as low as $20-30, but in a bigger city, $100-200 is not unheard of. This pricing means that if you intend to have a conference with 300 people, the cost for space could be as much as $60,000 depending on where it is. We’ll talk more about food in a minute.

Attendees/Participants

You can’t have a conference without people attending. Plus they probably help to pay the bills, if you sell tickets. Just a quick word about not charging for attendance. In my experience, the no-show rate to free events is always at least 50%. If you have costs to consider, like food or swag, know that if the event is free to participants, many will not attend.
So how do you find people? If it’s a BSides, they’ll likely find you. The BSides people can help to get the word out, but you’ll also need to drive attention. Social media is a great way to do that.

Speakers

There are two ways you can get speakers, either ask people you know, or put out a public call, aka CFP (Call for Presenters/Presentations/Papers). If you ask people you know, you have a little more control over who you get, but the community might feel slighted, especially if it’s a BSides conference. If you’re doing a CFP, advertise early and wide. Look for sites like cfptime.org who will advertise your listing for free. We typically use Google forms. We ask for the presenter(s)’ name, contact info, talk title, description, longer description, personal biography, whether the presentation has been done before, and anything else we need to know.

One thing I learned early on is to delegate. I thought it’d be great to choose all the content myself, but then realized I have biases and also make a lot of mistakes. These mistakes can often be headed off by letting a committee decide. Ensure that your committee is diverse in their background and viewpoints and let them make the decisions. We also do our choosing with all the CFP information visible. Doesn’t that lead to bias? Sure, but so does hiding the information. While it may seem that a “blind” process will eliminate bias, it doesn’t. People will favor certain words that appeal to them, and some of the same biased decisions can get made. So we give our reviewers all the information.

Even after the decisions are made, do you have a good representation of the community? If not, it’s ok to make some changes to the decisions that were made.

Do you have money to pay speakers, give them an honorarium or pay for their travel? Or can you give them some small gift as a thank you for taking the time to share their knowledge with the community? This isn’t required but can also go a long way to making someone feel good.

Food

If you’re doing a remote conference, food isn’t really an issue, people can just go eat from their own refrigerator. If you’re doing an in-person conference, you’ve got some decisions to make. First, food is probably a lot more expensive than you’d expect. Something as simple as a sandwich, bag of chips and bottle of water can run upwards of $20 per person. That big cookie/brownie plate you often see? $4 each cookie. Morning coffee can be $50 per gallon, and the estimate is about 12 cups of coffee per gallon. But, you’ll just do your own catering! Not so fast as many venues require you to use their catering and will not allow for you to bring in any outside food. You may be able to get cheaper prices on things like the actual conference rooms or Audio/Visual supplies for using the catering, so keep all of this in mind.

Sponsors

Oh boy, this one sure isn’t easy. If you want to make it easier on yourself to get sponsors, definitely start a BSides conference. That’s a known and trusted name that companies love to be affiliated with. If you have your own conference, finding sponsors can definitely be a struggle, even moreso with virtual conferences. Companies love to be able to meet people face to face, trade business cards, obtain leads. You will be asked if the attendee contact info will be available to them. Well, we never do that. We keep that information very much “need to know” and isn’t seen by more than just a few people.

Try to think of how you can offer the best value for sponsors with their outreach and recruiting efforts. It’s really going to be about building relationships, growing your conference, making your conference a “can’t miss” for the community where people really want to be a part of it. Other than that, just keep asking. Ask everyone, ask your speakers’ companies. If you’re selling speaker slots, be up front with that. If you’re not, be clear that a speaking slot is not tied in with a sponsorship. Again, there’s nothing wrong with running a “for profit” conference, but just be up front about that to everyone involved.

Swag

I only recently learned this is an acronym for “Something We All Get”, thanks Jason! Swag is something fun that people leave the conference with, or at least you hope they do. It can include marketing materials, stickers, a t-shirt or some little gadget they can leave on their desk. Is it worth doing for the participants, or is it better to put the money elsewhere in your conference, making it cheaper or accessible to more people. Decisions for you to make.

Tickets

If your budget can support it, a free conference can be good! Keep in mind that people equate value with cost. Also, my experience has shown about a 50% no-show rate when an event is free. If you’re putting money into the event for things like food or swag and half the people don’t even show up, that’s quite a bit of waste. Even charging $20 can bump the attendance rate well into the high 90s.

If you use a site like Eventbrite to sell your tickets, read the fine print. You might end up paying them as much as 10% per ticket and your money might be tied up until after your event.

Villages

A village is like a mini-conference in your conference. Lots of groups are supporting these now like Mental Health Hackers and TOOOL for lockpicking. These can also be a draw to your conference, but they can also incur a cost, depending on which group you’re working with.

Conclusion

I may update this if more ideas come to mind, and feel free to ask questions, I’m happy to help:
@plaverty9 on Twitter and Patrick@Layer8Conference.com