41,900 reputation
857218
bio website infosecfrog.blogspot.com
location Scotland, United Kingdom
age 43
visits member for 4 years
seen 58 mins ago

Information Security, Risk and Governance Specialist.

Heavily involved in information security and risk solutions for the last 16 years in the UK, US and throughout Europe.

  • Scottish Chairman of the Institute of Information Security Professionals
  • Immediate Past President of ISACA Scotland
  • Full Member of the IISP (M.Inst.ISP)
  • Security mentor and evangelist
  • Moderator of the Security, Music, Outdoors, Video Production, Sound Design and Personal Productivity Stack Exchange sites and Administrator for the Security Stack Exchange Blog
  • Contributor to the Open Web Application Security Project (OWASP)
  • EC Council Certified Chief Information Security Officer (C|CISO)
  • ISACA Certified Information Security Manager (CISM)
  • ISACA Certified in Risk and Information Systems Controls (CRISC)

  • have also been a member of the Standards and Operations Committees for the Council of Registered Ethical Security Testers (CREST), an ISC2 Certified Information Systems Security Professional (CISSP) and a CLAS Consultant.

Extensive experience in Enterprise Risk and Security, from a deep technical grounding in application, network and platform security, as well as over 10 years working with global banking clients helping them identify, evaluate and mitigate information risks from a business and governance perspective.

Key roles in integration programmes, aligning security policies and business risk appetites across divisions in order to provide pragmatic security solutions.

Has created security development pathways and managed large scale security programmes, including global attack & penetration engagements, privacy and security assessments, incident response and fraud and forensic investigations.

Core clients have included global and UK banks, government departments as well as organisations in the Energy, Telecomms and other markets.

Acts as a mentor and coach for numerous security professionals in Scotland, providing career guidance as well as promoting a passion for the industry.

Provides subject matter experience at both strategic and technical levels, defining, reviewing and assessing enterprise level information security strategy, policies and standards for clients, incorporating the ISO 27000 series, COBIT, ITIL and other industry recognised baselines.

Presented at the inaugural e-Crime Scotland Summit and presents regularly on aspects of Information Security at various events in the UK, especially on the business implications of security issues.

Published in the Financial Times, ISACA Journal, assisted in the production of ISACA's APT white paper, and various other publications.


Dec
29
comment Chrome vs Explorer - how to explain in plain words that open-source is better?
Michael - I think we'll need to change the title here, as your premise (that open source is better) is misleading. It might also be worth merging with security.stackexchange.com/questions/97/… or security.stackexchange.com/questions/4441/…
Dec
29
comment How do companies track employee usage on corporate computers?
@user023 - not worthy of an answer, but the first page of results here gives you a good view: google.co.uk/…
Dec
29
answered is it worth to implement a firewall on a web server you control?
Dec
28
comment How do companies track employee usage on corporate computers?
There are many - all the big names in SIEM/SEM tend to have employee tracking options, and there are many more
Dec
28
revised Can Tamper Data (the plugin) modify multipart requests?
deleted 13 characters in body
Dec
28
answered Site listed as hacked by a hacking group
Dec
28
comment How do companies track employee usage on corporate computers?
@user023 - your easiest bet is to google that sort of thing as it changes over time so doesn't make for good canonical answers here on stack exchange
Dec
27
reviewed Approve virtualization tag wiki excerpt
Dec
27
reviewed Approve tls tag wiki
Dec
27
reviewed Reject tls tag wiki excerpt
Dec
26
comment How to exploit this SQL inection vulnerability?
@Rook - I agree. There are very few folks on here that can do this, and you and Karrax seem to know what you are talking about. Your answers tend to be excellent - the only challenge I have is that when a question strays outside this area you tend to get very argumentative, which is a pity. I wouldn't try and write an answer on exploit code, as it's been ages since I did that sort of thing or taught it, but I accept that some questions require that side of things. Us mods just try to keep the language clean and stop arguments and disparaging comments.
Dec
25
answered Explaining security vs. performace to a non-tech superior
Dec
23
comment Do I need to password-protect an “Electronic Copy” of health information given to a patient on e-media?
They would have delivered this zip file to you over an SSL encrypted link, so technically they did protect it during transmission to you.
Dec
22
answered Presentation on Web App Security (ACM Student Chapter)
Dec
21
reviewed Approve How to improve as a security expert
Dec
21
answered When will the webbrowsers have TLS 1.2 support?
Dec
21
comment Are there any instant messaging systems that offer resistance to traffic analysis?
@JeffBurdges - feel free to reword in a useful format, as we can always reopen if the core of your question/need fits the site.
Dec
20
revised Security implications of rooting Android
edited tags; edited title
Dec
20
comment How to improve as a security expert
@jl01 - you could post this as a question, rather than a comment. Then you will be able to add formatting etc.
Dec
20
comment Wireless MAC Address Filtering - Authentication/Association
sorry - fixed that now