43,704 reputation
863231
bio website infosecfrog.blogspot.com
location Scotland, United Kingdom
age 44
visits member for 4 years, 8 months
seen 59 mins ago

Information Security, Risk and Governance Specialist.

Heavily involved in information security and risk solutions for the last 16 years in the UK, US and throughout Europe.

  • Scottish Chairman of the Institute of Information Security Professionals
  • Immediate Past President of ISACA Scotland
  • Mensa Security SIG Secretary
  • Full Member of the IISP (M.Inst.ISP)
  • Security mentor and evangelist
  • Moderator of the Security, Music, Parenting, Outdoors, Video Production, Sound Design and Personal Productivity Stack Exchange sites and Administrator for the Security Stack Exchange Blog
  • Contributor to the Open Web Application Security Project (OWASP)
  • EC Council Certified Chief Information Security Officer (C|CISO)
  • ISACA Certified Information Security Manager (CISM)
  • ISACA Certified in Risk and Information Systems Controls (CRISC)

  • have also been a member of the Standards and Operations Committees for the Council of Registered Ethical Security Testers (CREST), an ISC2 Certified Information Systems Security Professional (CISSP) and a CLAS Consultant.

Extensive experience in Enterprise Risk and Security, from a deep technical grounding in application, network and platform security, as well as over 10 years working with global banking clients helping them identify, evaluate and mitigate information risks from a business and governance perspective.

Key roles in integration programmes, aligning security policies and business risk appetites across divisions in order to provide pragmatic security solutions.

Has created security development pathways and managed large scale security programmes, including global attack & penetration engagements, privacy and security assessments, incident response and fraud and forensic investigations.

Core clients have included global and UK banks, government departments as well as organisations in the Energy, Telecomms and other markets.

Acts as a mentor and coach for numerous security professionals in Scotland, providing career guidance as well as promoting a passion for the industry.

Provides subject matter experience at both strategic and technical levels, defining, reviewing and assessing enterprise level information security strategy, policies and standards for clients, incorporating the ISO 27000 series, COBIT, ITIL and other industry recognised baselines.

Presented at the inaugural e-Crime Scotland Summit and presents regularly on aspects of Information Security at various events in the UK, especially on the business implications of security issues.

Published in the Financial Times, ISACA Journal, assisted in the production of ISACA's APT white paper, and various other publications.


Mar
9
answered Is a mobile app more secure for mobile use than the “normal” website?
Mar
9
comment Wireless Activity Monitoring for PCI DSS Compliance
While what you say is true, it doesn't answer the question that was asked.
Mar
9
comment Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
Quite often payroll may be partially or fully outsourced so some type of sharing outside the network would be required.
Mar
9
comment How secure is to store encryption keys or SSH Keys on LPAR?
Absolutely - you got an upvote from me anyway :-)
Mar
9
comment How secure is to store encryption keys or SSH Keys on LPAR?
The problem with IBM's statement is it only applies to correctly configured LPARs under a subset of use cases. We have successfully retrieved data from LPARs due to slight misconfigurations, re-use of passwords and other techniques, so while EAL5 is a possible, do not assume anything...
Mar
9
comment How secure is to store encryption keys or SSH Keys on LPAR?
Sorry - what I meant was what information or assets are you protecting? What is their value? Are they credit card or personal sensitive data, or military secrets etc...
Mar
9
comment How secure is to store encryption keys or SSH Keys on LPAR?
Can you update your question with some context? What are you protecting?
Mar
8
revised Are there security (esp. privacy) benefits to deleting cookies?
added link for you
Mar
7
comment How long can I store personal information on unconfirmed subscriptions?
+1 as focusing on the practical here is probably the way to do it. Because there are so many different rules for different types of data in different jurisdictions, @DW's solution is likely to be both safe and relevant.
Mar
7
awarded  Announcer
Mar
5
comment Unauthorised Perl Scripts
Hi Frank - unfortunately this question is unanswerable in its current form. Without knowing your environment, your current security controls etc., there are a huge number of possible attack routes. Have a look at security.stackexchange.com/q/4313/485 as an example. If you think you can provide more info, edit the question and we may be able to reopen.
Mar
5
revised What aspects of hardware configuration are significant from a security perspective?
edited title
Mar
3
comment A proposal for Data Transmission and Password Encryption
There isn't any single config that is 'secure enough'. You need to decide what secure enough means for you, and describe your requirements. Then we can help find an answer that meets those requirements. So I have closed this until you update your question with this information.
Mar
3
revised A proposal for Data Transmission and Password Encryption
deleted 72 characters in body; edited title
Mar
3
awarded  Nice Answer
Mar
2
answered What is the likelihood of getting sensitive information off of a backup tape?
Mar
1
comment Recommendations for hosting highly sensitive data
whatever you do, however - do not rely on these: they can be mis-scoped or limited in what they give you. Treat them as a good indicator, but no more.
Mar
1
revised Recommendations for hosting highly sensitive data
edited title
Mar
1
reviewed Approve Reboot to clean state daily, on Windows
Mar
1
comment Recommendations for hosting highly sensitive data
@Joshua - popped your comment into the question and removed pci tag, as it won't be appropriate if you aren't doing anything with CC data