1,687 reputation
110
bio website
location Scotland
age
visits member for 1 year, 4 months
seen Feb 21 at 12:21

I'm a contract Security Architect based in Scotland, UK. I derive strategy for large organisations as well as provide design mentoring and governance. My company also provides forensic analysis for the legal community in Scotland.


Feb
11
answered what is the use of stolen personal details?
Feb
6
answered When should I use the word hacker, cracker, or black hat?
Feb
4
answered Securing the SOAP Messages
Feb
4
comment Are you aware of any CEO that went to jail because of Security Flaws?
I was more referring to the actions taken by staff during the investigation rather than the phone hacking itself. When staff realised they were being prosecuted they went on the rampage deleting evidence... not a perfect example but it's the closest I can think of.
Feb
1
answered Are you aware of any CEO that went to jail because of Security Flaws?
Jan
30
comment Are banks required to be PCI compliant?
It's a mixture. There are legal, contractual, regulatory and ethical standards to apply. Clearly the bank owns it's own appetite to risk and therefore can have it's own take on these standards. There is a balance between cost, security and functionality that each bank has to make a decision on before investing in an effective control framework. In my experience, it's rare for a bank not to take security standards seriously.
Jan
30
answered how Cookie tracking threat works?
Jan
30
answered Are banks required to be PCI compliant?
Jan
30
answered What vulnerabilities in the OWASP Top 10 are relevant to WordPress?
Jan
29
answered Reverse engineering and Java
Jan
29
comment How secure is the new Mega-site encryption?
Mega themselves recognise the "lost passwd = lost data" issue and are coming up with a system to allow users to recover data using a key export feature. Check out: gizmodo.com/5978164/…
Jan
28
comment Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?
it may be legal in Europe, but your EULA that was expressly agreed does not allow it in 2.2.6. Just pointing it out to the community because it could cause some in-house lawyers to have minor heart feailure.
Jan
28
comment How to treat non-optional bad security questions?
One site I went to used the same "security questions" online as on the phone. which made for a strange conversation when I had to explain that my mothers maiden name was a mixture of numbers, non-alphanumeric characters and letters. (this is an example of bad practice btw. never use full security questions on phone and online)
Jan
28
answered Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
one more question: do you have any password policies in force that would normally prevent an empty password? (just trying to work out whether this is user error or indeed something quite new and interesting)
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
is this a local account or on an Active Directory?
Jan
23
comment Is there a true alternative to using CAPTCHA images?
if the arithmetic was in plain text then a reader would indeed help. However, if an arithmetical challenge would be a lot easier to interpret. It really depends what the risk appetite is and what the end goal of the CAPTCHA is.
Jan
23
answered Is there a true alternative to using CAPTCHA images?
Jan
22
answered Foolproof Jailbreak detection?
Jan
22
answered How secure is the new Mega-site encryption?