43,346 reputation
860228
bio website infosecfrog.blogspot.com
location Scotland, United Kingdom
age 43
visits member for 4 years, 6 months
seen 1 hour ago

Information Security, Risk and Governance Specialist.

Heavily involved in information security and risk solutions for the last 16 years in the UK, US and throughout Europe.

  • Scottish Chairman of the Institute of Information Security Professionals
  • Immediate Past President of ISACA Scotland
  • Mensa Security SIG Secretary
  • Full Member of the IISP (M.Inst.ISP)
  • Security mentor and evangelist
  • Moderator of the Security, Music, Parenting, Outdoors, Video Production, Sound Design and Personal Productivity Stack Exchange sites and Administrator for the Security Stack Exchange Blog
  • Contributor to the Open Web Application Security Project (OWASP)
  • EC Council Certified Chief Information Security Officer (C|CISO)
  • ISACA Certified Information Security Manager (CISM)
  • ISACA Certified in Risk and Information Systems Controls (CRISC)

  • have also been a member of the Standards and Operations Committees for the Council of Registered Ethical Security Testers (CREST), an ISC2 Certified Information Systems Security Professional (CISSP) and a CLAS Consultant.

Extensive experience in Enterprise Risk and Security, from a deep technical grounding in application, network and platform security, as well as over 10 years working with global banking clients helping them identify, evaluate and mitigate information risks from a business and governance perspective.

Key roles in integration programmes, aligning security policies and business risk appetites across divisions in order to provide pragmatic security solutions.

Has created security development pathways and managed large scale security programmes, including global attack & penetration engagements, privacy and security assessments, incident response and fraud and forensic investigations.

Core clients have included global and UK banks, government departments as well as organisations in the Energy, Telecomms and other markets.

Acts as a mentor and coach for numerous security professionals in Scotland, providing career guidance as well as promoting a passion for the industry.

Provides subject matter experience at both strategic and technical levels, defining, reviewing and assessing enterprise level information security strategy, policies and standards for clients, incorporating the ISO 27000 series, COBIT, ITIL and other industry recognised baselines.

Presented at the inaugural e-Crime Scotland Summit and presents regularly on aspects of Information Security at various events in the UK, especially on the business implications of security issues.

Published in the Financial Times, ISACA Journal, assisted in the production of ISACA's APT white paper, and various other publications.


1h
comment Securing the security guy's home office: what should we do?
Bob - a combination of off the shelf kit (some a bit hacked about) and slightly higher end stuff I have picked up over the years. This network is really simple compared with ones I have configured and managed in my earlier role as network Admin, so it's really not an issue
1h
comment Securing the security guy's home office: what should we do?
Actually, since I wrote this I have now added cloud backup for my essential files :-)
3h
comment In a monitored network, can the admins tell if Tor is being used?
daniel - can you edit this post to answer the question please? Otherwise it will probably end up deleted.
1d
comment static vs dynamic vs challenge response
Joshua - if you use someone else's image you must reference the source. Otherwise we will have to delete this post.
2d
comment Host Protected Area forensics
Hi Manumit - not sure what security question you are asking here
2d
comment How to begin learning about cyber security?
If you look through the questions here in categories such as professional development, or careers, you'll see why this question is way too broad for this site. We aren't in the market for recommending study resources generally (although a Google search doors turn up loads!)
2d
comment How to Check if a server is not vulnerable to logjam?
Mike, Scott and cciegeek - those answers don't apply in the OP's scenario.
May
22
comment What makes an Android application vulnerable to Cross-site scripting (XSS)?
Cereal - please do not delete and recreate questions!
May
22
comment What makes an Android application vulnerable to Cross-site scripting (XSS)?
Cereal - the word "Android" is utterly irrelevant to these questions (with the possible exception of the SQLite angle as discussed by Tom) - I think you need to edit your questions to remove that restriction, otherwise these are not the best of questions, and may be downvoted or closed (possibly as dupes of more general case questions)
May
22
comment Is WPA(2)/AES or some derivative really perfectly secure?
Edits to make the post readable - please don't use bold like that. It actually makes it much harder to read.
May
22
comment Give Someone Access to Secure Website?
I've worked with teams that duplicated > 2 million accounts and then sanitised all the personal details in order to provide a test database, and that wasn't too big a job. If it is just one account, surely you can duplicate it.
May
20
comment Identifying the correct ssid
faraz - please read tour. If a question is put on hold, there is always guidance given as to what you need to do to reopen it. In future please do that rather than create a new one.
May
20
comment PCI DSS Vulnerability Scan failed
The fact that it hasn't worked means you need to do some further delving as there is obviously something in your config/environment that is the problem. This doesn't appear to be a Security question at this point.
May
19
comment Where to start with api security testing?
Anonymous - we explicitly do not do tools recommendation, and despite your edits, you have not addressed the problem - there are so many areas you need to learn that this question is unlikely to be answerable.
May
18
comment what is today allowed, when I travel to USA?
dschinn - I see all your posts so far have been downvoted/closed/deleted. Please have a good read of our tour page and a browse around existing questions to make sure you understand our scope.
May
13
comment Ensure that a file can only be decrypted after a specific date
That's some appetite! :-)
May
6
comment How to avoid to lose data encrypted because it was encrypted by no longer supported software?
Paul - no they don't. Most paper/papyrus writings from ancient history are lost forever. The fact we have any is a small miracle.
May
5
comment Services Like McAfee Secure
Brand squatting also includes similar looking sites, not just mis-spelled domains etc
May
3
comment Is there any benefit to login to a website as anonymously as possible, if you've already been there from an identifiable IP address?
No - you misunderstand. Getting it back makes no sense in this context, and deleting it almost certainly won't remove it either as the provider will have backups of some type.
May
2
comment How can I get EAPOL packet's number?
At risk of sounding facetious - don't use WPA.