40,754 reputation
753211
bio website infosecfrog.blogspot.com
location Scotland, United Kingdom
age 43
visits member for 3 years, 10 months
seen 3 hours ago

Information Security, Risk and Governance Specialist.

Heavily involved in information security and risk solutions for the last 16 years in the UK, US and throughout Europe.

  • Scottish Chairman of the Institute of Information Security Professionals
  • Immediate Past President of ISACA Scotland
  • Full Member of the IISP (M.Inst.ISP)
  • Security mentor and evangelist
  • Moderator of the Security, Music, Outdoors, Video Production, Sound Design and Personal Productivity Stack Exchange sites and Administrator for the Security Stack Exchange Blog
  • Contributor to the Open Web Application Security Project (OWASP)
  • EC Council Certified Chief Information Security Officer (C|CISO)
  • ISACA Certified Information Security Manager (CISM)
  • ISACA Certified in Risk and Information Systems Controls (CRISC)

  • have also been a member of the Standards and Operations Committees for the Council of Registered Ethical Security Testers (CREST), an ISC2 Certified Information Systems Security Professional (CISSP) and a CLAS Consultant.

Extensive experience in Enterprise Risk and Security, from a deep technical grounding in application, network and platform security, as well as over 10 years working with global banking clients helping them identify, evaluate and mitigate information risks from a business and governance perspective.

Key roles in integration programmes, aligning security policies and business risk appetites across divisions in order to provide pragmatic security solutions.

Has created security development pathways and managed large scale security programmes, including global attack & penetration engagements, privacy and security assessments, incident response and fraud and forensic investigations.

Core clients have included global and UK banks, government departments as well as organisations in the Energy, Telecomms and other markets.

Acts as a mentor and coach for numerous security professionals in Scotland, providing career guidance as well as promoting a passion for the industry.

Provides subject matter experience at both strategic and technical levels, defining, reviewing and assessing enterprise level information security strategy, policies and standards for clients, incorporating the ISO 27000 series, COBIT, ITIL and other industry recognised baselines.

Presented at the inaugural e-Crime Scotland Summit and presents regularly on aspects of Information Security at various events in the UK, especially on the business implications of security issues.

Published in the Financial Times, ISACA Journal, assisted in the production of ISACA's APT white paper, and various other publications.


7h
reviewed Close How much real improvements in PKI since more than a decade?
7h
reviewed Close Securing CentOS /boot readonly breaks system on reboot
7h
reviewed Close How to securely store users' private keys?
10h
comment What is the use of PL/SQL gateway and what is its relevance in oracle DB testing for injection attacks?
Anandu - many of your questions get closed because they are off topic, or because you are not structuring them in a way that fits this site. Specifically, it looks like you are asking very open and broad questions about the basics of IT Security. Have a good read of our tour pages and read lots of existing questions here - you will then hopefully have a much better approach to asking questions
1d
comment Phone location detection
I can't google for the relevant papers from work, but yes - phones are much more vulnerable than you'd think. Only safe method (near enough 100%) is to remove the battery.
1d
comment How to prevent ddos and brute-force attack by restricting IP's on Wordpress website
It won't - that's the simple answer. Botnets are independent of countries and borders; and the stats do show a very large number will appear to come from IP's in the US.
1d
answered Why does the finance industry uses 2TDEA instead of 3TDEA?
1d
revised Authentication vs. Verification in General and with Biometrics
deleted 149 characters in body
1d
comment How to prevent ddos and brute-force attack by restricting IP's on Wordpress website
Have you thought that you may be protecting against the wrong thing? A DDoS will use IP addresses from all over the world - and a large proportion will be within the US (based on current botnet stats)
1d
comment Phone location detection
Chris - correct except for the fact that phones can be persuaded to communicate even when ostensibly off or in airplane mode...
1d
revised Phone location detection
edited body
1d
revised The simplest way to emulate TCP-IP protocol violation / anomaly attacks
deleted 1155 characters in body
1d
comment The simplest way to emulate TCP-IP protocol violation / anomaly attacks
Your questions 2 and 3 are off topic here, and you answered 4 yourself. If you have separate questions, please ask them separately.
1d
reviewed Close What aspects of a Host OS can be detected from VirtualBox VM?
1d
reviewed Close Removing malware which is creating temp file and modifying network traffic
1d
reviewed Close Password stolen on public wifi even though https was used
1d
reviewed Close Proper way to shutdown OpenVAS
Sep
19
reviewed Close Why the Websense blocks same site when used with http & not when used https?
Sep
19
reviewed Close What are the best and most popular authentication algorithms/protocols?
Sep
19
reviewed Close A future heartbleed bug?