40,354 reputation
753205
bio website infosecfrog.blogspot.com
location Scotland, United Kingdom
age 43
visits member for 3 years, 9 months
seen 2 hours ago

Information Security, Risk and Governance Specialist.

Heavily involved in information security and risk solutions for the last 16 years in the UK, US and throughout Europe.

  • Scottish Chairman of the Institute of Information Security Professionals
  • Immediate Past President of ISACA Scotland
  • Full Member of the IISP (M.Inst.ISP)
  • Security mentor and evangelist
  • Moderator of the Security, Music, Outdoors, Video Production, Sound Design and Personal Productivity Stack Exchange sites and Administrator for the Security Stack Exchange Blog
  • Contributor to the Open Web Application Security Project (OWASP)
  • EC Council Certified Chief Information Security Officer (C|CISO)
  • ISACA Certified Information Security Manager (CISM)
  • ISACA Certified in Risk and Information Systems Controls (CRISC)

  • have also been a member of the Standards and Operations Committees for the Council of Registered Ethical Security Testers (CREST), an ISC2 Certified Information Systems Security Professional (CISSP) and a CLAS Consultant.

Extensive experience in Enterprise Risk and Security, from a deep technical grounding in application, network and platform security, as well as over 10 years working with global banking clients helping them identify, evaluate and mitigate information risks from a business and governance perspective.

Key roles in integration programmes, aligning security policies and business risk appetites across divisions in order to provide pragmatic security solutions.

Has created security development pathways and managed large scale security programmes, including global attack & penetration engagements, privacy and security assessments, incident response and fraud and forensic investigations.

Core clients have included global and UK banks, government departments as well as organisations in the Energy, Telecomms and other markets.

Acts as a mentor and coach for numerous security professionals in Scotland, providing career guidance as well as promoting a passion for the industry.

Provides subject matter experience at both strategic and technical levels, defining, reviewing and assessing enterprise level information security strategy, policies and standards for clients, incorporating the ISO 27000 series, COBIT, ITIL and other industry recognised baselines.

Presented at the inaugural e-Crime Scotland Summit and presents regularly on aspects of Information Security at various events in the UK, especially on the business implications of security issues.

Published in the Financial Times, ISACA Journal, assisted in the production of ISACA's APT white paper, and various other publications.


Sep
23
revised Does it matter which Certificate Authority I source my SSL Certificate from?
added 51 characters in body
Sep
23
comment Does it matter which Certificate Authority I source my SSL Certificate from?
Just to confirm - I have provided access to the chat room so please feel free to use it to discuss.
Sep
23
reviewed Approve suggested edit on when is it safe to click through an SSL warning message?
Sep
23
answered Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Sep
22
comment SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity?
Questions about whether or not they will have to pay out are offtopic, and speculation anyway. You could edit the question to just be that final paragraph, then it would be on-topic and we could re-open.
Sep
22
comment Which is the easiest secure file transport protocol to implement (SFTP, FTPS, HTTPS, FTP over SSH, FTP over IPsec)
Agree with @Scott - this is not actually a security question, it is an implementation question. But it seems too subjective in any case: I might find it easy to implement SSL/TLS where someone else might fint SFTP easier...
Sep
22
comment Is using a public-key for logging in to SSH any better than saving a password?
Welcome to Security.SE. As you may have noticed, your answers are being downvoted by various members of the community. If you have a good read of the FAQ (link at the top of the page) you will get a better view of how to post in this community. You might also want to concentrate more on the newer questions rather than dig up old ones with highly voted, accepted answers.
Sep
22
revised How do the processes for digital certificates, signatures and ssl work?
changed title to match question
Sep
22
comment How should I determine if an application transmits my credentials securely?
@Christian +1 for "For some reason, I never gave in..."
Sep
22
revised MiTM - Non-HTTP TLS
corrected HTTP to HTTPS
Sep
22
answered Servers: Why a separate device for a firewall, aside from reduction in IP spoofing or increase in performance
Sep
21
answered Appsec Standards Organizations?
Sep
21
comment Are there any websites that gather hash sums of different disk image files?
Wouldn't the trust model required be just as easy to implement for the original site? Kinda see what you mean though
Sep
21
comment Are there any websites that gather hash sums of different disk image files?
hmmm - can't think why you would want this. Can you clarify why you want to trust another 3rd party, rather than the host and all its mirrors?
Sep
21
comment Are there any websites that gather hash sums of different disk image files?
Not sure what you are asking here - certainly the ISO file hosts, their mirrors and torrent hosts often provide the hash of the image. Can you clarify the question?
Sep
21
comment How should I determine if an application transmits my credentials securely?
If you can restructure this question to be a security question, we may be able to re-open it. As it is, I'm not sure what you are asking. The final sentence could be on-topic for gaming.stackexchange.com?
Sep
19
revised Payment gateway integration, any security considerations?
tagging
Sep
19
answered Guarding against rogue certificates
Sep
19
comment It is possible that brute force attempts are successful before the worst case, correct?
To be precise, the 'worst case' means that all brute force attempts will be successful before that point (given the caveat that the character space used does include the answer)
Sep
19
comment Would you go with SSD or Disk Hard Drive?
+1 for your final paragraph alone. Very true.