42,791 reputation
859222
bio website infosecfrog.blogspot.com
location Scotland, United Kingdom
age 43
visits member for 4 years, 4 months
seen 8 hours ago

Information Security, Risk and Governance Specialist.

Heavily involved in information security and risk solutions for the last 16 years in the UK, US and throughout Europe.

  • Scottish Chairman of the Institute of Information Security Professionals
  • Immediate Past President of ISACA Scotland
  • Full Member of the IISP (M.Inst.ISP)
  • Security mentor and evangelist
  • Moderator of the Security, Music, Parenting, Outdoors, Video Production, Sound Design and Personal Productivity Stack Exchange sites and Administrator for the Security Stack Exchange Blog
  • Contributor to the Open Web Application Security Project (OWASP)
  • EC Council Certified Chief Information Security Officer (C|CISO)
  • ISACA Certified Information Security Manager (CISM)
  • ISACA Certified in Risk and Information Systems Controls (CRISC)

  • have also been a member of the Standards and Operations Committees for the Council of Registered Ethical Security Testers (CREST), an ISC2 Certified Information Systems Security Professional (CISSP) and a CLAS Consultant.

Extensive experience in Enterprise Risk and Security, from a deep technical grounding in application, network and platform security, as well as over 10 years working with global banking clients helping them identify, evaluate and mitigate information risks from a business and governance perspective.

Key roles in integration programmes, aligning security policies and business risk appetites across divisions in order to provide pragmatic security solutions.

Has created security development pathways and managed large scale security programmes, including global attack & penetration engagements, privacy and security assessments, incident response and fraud and forensic investigations.

Core clients have included global and UK banks, government departments as well as organisations in the Energy, Telecomms and other markets.

Acts as a mentor and coach for numerous security professionals in Scotland, providing career guidance as well as promoting a passion for the industry.

Provides subject matter experience at both strategic and technical levels, defining, reviewing and assessing enterprise level information security strategy, policies and standards for clients, incorporating the ISO 27000 series, COBIT, ITIL and other industry recognised baselines.

Presented at the inaugural e-Crime Scotland Summit and presents regularly on aspects of Information Security at various events in the UK, especially on the business implications of security issues.

Published in the Financial Times, ISACA Journal, assisted in the production of ISACA's APT white paper, and various other publications.


Feb
22
comment Similarly to How Photos Have Meta Data, Does Audio As Well?
As regards soundcloud or YouTube, try it. Pop in some meta data and see if it's there when you download it again.
Feb
20
comment Is it secure to have source code for website public?
Your updates don't show me why this should be reopened - it still is answered by the duplicate
Feb
19
reviewed Reviewed Could a large amount of wget requests be viewed as an attack?
Feb
19
comment Could a large amount of wget requests be viewed as an attack?
Of course they could, however if you want to know if they do you will need to either ask Yahoo or read available documentation.
Feb
19
reviewed Close Can Google's administrators be trusted with Google Authenticator?
Feb
19
reviewed Close How do PGP keyservers synchronize the keys?
Feb
19
reviewed Close How to share internet over wifi without commands?
Feb
19
comment Why do browsers default to http: and not https: for typed in URLs?
Comments are not for extended discussion; this conversation has been moved to chat.
Feb
18
comment Are web scrapers fooled by obscured emails anymore?
If it gets to that level you can use images...but then captcha technology might be used...as you said, arms race :-)
Feb
18
revised How should I document my Public Key Infrastructure?
edited title
Feb
14
revised SQL injection — why isn't escape quotes safe anymore?
deleted 317 characters in body
Feb
13
revised How to determine if someone is scanning my server?
deleted 123 characters in body
Feb
13
comment How to determine if someone is scanning my server?
nicks - whicle your answer includes some valid points it is not acceptable to spam your own product. please read our guidelines on spam.
Feb
11
revised How does SAQ A-EP apply in the situation where no I frames are used
title was irrelevant to question. fixed.
Feb
11
reviewed Leave Closed How can an attacker access a system with a private IP address?
Feb
11
comment How can an attacker access a system with a private IP address?
this question is not a security question. It demonstrates a misunderstanding of basic networking. I have asked before: please read and understand our site scope - tour
Feb
11
awarded  Enlightened
Feb
11
awarded  Nice Answer
Feb
11
awarded  Nice Answer
Feb
9
comment Mitigating DDoS With Command of Ports
Thanks Ian - that's much more on topic. I have a feeling the answer's going to be a no, though. I have done a fair bit of work on DDoS mitigation and can't imagine this working.