1,777 reputation
211
bio website
location Scotland
age
visits member for 2 years
seen yesterday

I'm a contract Security Architect based in Scotland, UK. I derive strategy for large organisations as well as provide design mentoring and governance. My company also provides forensic analysis for the legal community in Scotland.


Jun
19
revised Is there any way to tell if CCTV is on or not?
added 25 characters in body
Jun
19
answered Is there any way to tell if CCTV is on or not?
May
15
comment Unsolicited Password Request from Facebook
interestingly, my wife got one of these for the first time on her Android yesterday. The message also included the name and location "Howard from Houston" and asked her "do you know this person?" to which she said no and then she was forced to change her password in the Android app (did not ask for old passwd). The problem is that the user has no cue as to whether it is real or not.
Mar
7
comment How do I get my Encryption Certificate back?
do you know if the user backed up the certificates?
Mar
7
comment CSRF mitigation in MVC
if the app was totally stateless then I don't think a CSRF would be possible. So... there must be a session state being recorded somewhere. If it's a java-based app then you'd naturally use the HttpSession.
Mar
7
answered Reading for starter in Computer System Security
Feb
11
answered what is the use of stolen personal details?
Feb
6
answered When should I use the word hacker, cracker, or black hat?
Feb
4
answered Securing the SOAP Messages
Feb
4
comment Are you aware of any CEO that went to jail because of Security Flaws?
I was more referring to the actions taken by staff during the investigation rather than the phone hacking itself. When staff realised they were being prosecuted they went on the rampage deleting evidence... not a perfect example but it's the closest I can think of.
Feb
1
answered Are you aware of any CEO that went to jail because of Security Flaws?
Jan
30
comment Are banks required to be PCI compliant?
It's a mixture. There are legal, contractual, regulatory and ethical standards to apply. Clearly the bank owns it's own appetite to risk and therefore can have it's own take on these standards. There is a balance between cost, security and functionality that each bank has to make a decision on before investing in an effective control framework. In my experience, it's rare for a bank not to take security standards seriously.
Jan
30
answered how Cookie tracking threat works?
Jan
30
answered Are banks required to be PCI compliant?
Jan
30
answered What vulnerabilities in the OWASP Top 10 are relevant to WordPress?
Jan
29
answered Reverse engineering and Java
Jan
29
comment How secure is the new Mega-site encryption?
Mega themselves recognise the "lost passwd = lost data" issue and are coming up with a system to allow users to recover data using a key export feature. Check out: gizmodo.com/5978164/…
Jan
28
comment Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?
it may be legal in Europe, but your EULA that was expressly agreed does not allow it in 2.2.6. Just pointing it out to the community because it could cause some in-house lawyers to have minor heart feailure.
Jan
28
comment How to treat non-optional bad security questions?
One site I went to used the same "security questions" online as on the phone. which made for a strange conversation when I had to explain that my mothers maiden name was a mixture of numbers, non-alphanumeric characters and letters. (this is an example of bad practice btw. never use full security questions on phone and online)
Jan
28
answered Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?