Share what you know with millions of people

Focus is the best place to turn what you know into remarkable content

×

David Rimmer

Follow Following Unfollow

Security Manager, Executive Agency for the UK Government

60 points

Information security practitioner working for a UK government agency, with experience in managing and auditing technical, physical and personnel security issues across 400+ physical sites.

Sept. 23, 2011

David Rimmer recommends this answer by Sean Kline

Is social media effective for marketing to IT professionals? If so, what platforms are best?

I think that social media is more effective for marketing to IT professionals than some other titles because those in IT tend to be early adopters of technology - social media still being new in some circles. My experience is that Twitter, LinkedIn and Facebook ... more

Information Technology

Sept. 9, 2011

David Rimmer and 3 other people answered this question

Are we about to see the collapse of the current Certificate Authority system?

As a follow up, Mozilla have started demanding more details of security programmes at Certificate Authorities. The fact that they have to ask for lists of third party CAs indicates how little transparency (and consistent application of sensible security controls) there has been to this ... more

Information Technology

Certificate Authority

Sept. 9, 2011

David Rimmer and 1 other person answered this question

How were Lockheed Martin's security systems breached?

There's a big difference between sensitive data being "on the internet" and being held within well architected corporate networks which are connected to the internet with appropriate safeguards. I'd expect defence contractors to keep their most sensitive data on air-gapped standalone systems, but there'll still ... more

Information Technology

Lockheed Martin

Sept. 7, 2011

David Rimmer and 2 other people answered this question

Are organizations starting to see benefits from becoming "ISO27001" Certified"

From the perspective of a UK organisation, certification offers very little value besides providing assurance of your security management (and the fact that you put enough emphasis on security to become certified) to third parties.
Are there US regulations in the finance/healthcare/government sectors which require or ... more

Information Technology

Risk and Compliance

Risk Assessement

Sept. 6, 2011

David Rimmer and 1 other person answered this question

Will cloud-based DDoS protection tools prove to be more effective? If not, are there any benefits?

Cloud-based defences should certainly be more affordable than buying a dedicated hardware appliance for a corporate network, as the cost will be shared across the customer base - so dollar for dollar you're getting a more effective and intelligent tool with a shared cloud-based solution.
The ... more

Information Technology

Cloud Computing

Sept. 4, 2011

David Rimmer and 6 other people answered this question

Facebook is crowd sourcing IT security by paying anyone who can hack their site. Thoughts?

I don't think anyone's suggesting that the amount offered by Facebook will stop a hacker selling a zero day on the black market for twenty times the price, and that's certainly not what I suggested. There is no way to stop hackers trying to find ... more

Information Technology

Sept. 4, 2011

David Rimmer and 2 other people answered this question

How often do you check user accounts?

I suppose this taps into the problems associated with outsourcing, as well - a lot of smaller companies might outsource the management of their firewalls, for example, so even if they company gets their internal process right in terms of disabling accounts of ex-staff, there ... more

Information Technology

Aug. 12, 2011

David Rimmer and 1 other person answered this question

What is an Advanced Persistent Threat (APT)? Is this a relatively new threat?

APT was the term given to Chinese state hacking by the US military about 7-10 years ago.
It's now used so heavily in marketing and as an excuse for being hacked that it generally refers to any attack preceded by some sort of spear phishing and ... more

Information Technology

Advanced Persistent Threats

Aug. 10, 2011

David Rimmer and 5 other people answered this question at this roundtable

Security in the Cloud: Data Sovereignty, Open Source and Multi-Tenancy [8/9 @ 11 am]

Do you agree that the auditor is more feared than an attacker/hacker? Is this reasonable?

If your policies and procedures put a series of controls in place against a successful attack, and your auditor verifies that they're being followed consistently and effectively, then you get assurance from that audit. Nothing will ever guarantee that you won't be hacked (short of ... more

Information Technology

Cloud Computing

Aug. 7, 2011

David Rimmer answered this question

Is Microsoft's security contest better than traditional bug bounties?

In principle, anything that improves a platform as a whole should be better than addressing individual vulnerabilities. It would seem like asking for "bigger picture" research addresses two relevant issues for Microsoft:
1) I presume (or at least hope) that they receive a decent quantity of ... more

Information Technology

Aug. 5, 2011

David Rimmer asked a question at this roundtable

Security in the Cloud: Data Sovereignty, Open Source and Multi-Tenancy [8/9 @ 11 am]

What's a reasonable expectation in terms of ability to audit a cloud provider?

Information Technology

Cloud Computing

Data Sovereignty

Aug. 5, 2011

David Rimmer and 2 other people answered this question at this roundtable

Security Awareness Roundtable: Defining Security Awareness [7/20 @ 11 am]

Is your HR department responsible for security awareness? What does your program look like?

Our HR team is generally focussed on traditional HR issues - so within our Information Assurance branch we run our own awareness programme. The idea of a HR team capable of (and sufficiently interested in) running a security awareness programme sounds fantastic.
Typically it's one annual ... more

General Management

Human Resources

Information Technology

Aug. 5, 2011

David Rimmer and 8 other people answered this question

How should hackers from international hacking groups be prosecuted?

The emphasis is on country B to extradite the hacker from country A (and organisations which get hacked aren't necessarily, or even commonly, stupid).
Given how interconnected the world's economies are, there's no logical reason (other than the backing of the state for certain hacking ... more

Information Technology

Aug. 4, 2011

David Rimmer and 1 other person answered this question

Will there eventually be any backlash against China for its perceived role in security attacks?

...having said that, I read today that an application used in a lot of APT/suspected Chinese persistent hacks is prone to produce consistent error messages on servers which can be used to detect its presence.
http://www.theregister.co.uk/2011/08/04/secret_malware_error_message/
It's possible that the dawning realisation of the breadth of these ... more

Information Technology

Cyber Espionage

Aug. 3, 2011

David Rimmer and 2 other people answered this question

Only 50% of oil and gas companies have an official info security strategy. Why?

The "Night Dragon" hacking/malware attacks targeted the oil and gas industries, so they have been subject to high profile data losses. Some organisations would rather just get on with security as a day to day ad hoc job rather than documenting a strategy, unless they're ... more

Information Technology

Aug. 3, 2011

David Rimmer answered this question at this roundtable

Security Gotchas that are Often Overlooked in SMBs [8/12 @ 1 pm]

What one thing do you recommend for SMBs getting their arms around IT to minimize their info risks?

Formal identification of the nature and extent of their info risks.
Once they understand the risks associated with their IT deployment, they can make informed decisions about how to deal with them (or whether deploying IT in a different direction could avoid the risks entirely). I ... more

Information Technology

Aug. 2, 2011

David Rimmer recommends this answer by Glen Marshall

If a small company uses a managed security service provider, is that enough to keep them secure?

No. Security is not something you can put in a contract and just have happen. It requires an understanding of the risks to one's business and involves appropriate physical, technical, and administrative controls as well as ongoing assurance actions. Security outsourcing only covers part of ... more

Information Technology

Managed Security

Aug. 1, 2011

David Rimmer and 1 other person answered this question

Are there any common themes with the recent arrests of suspected members of LulzSec and Anonymous?

If the UK charges against Topiary end up in a conviction with a meaningful penalty (presuming that it is actually Topiary who was arrested), it will be interesting to see how other Lulzsec/Anonymous leaders react; the perception around the other arrests is that they're drones ... more

Information Technology

July 31, 2011

David Rimmer and 3 other people commented on a brief

It’s Time to Re-Evaluate Host-Based Security

That was an interesting read - thanks for posting it.
I can see how application whitelisting can be powerful when combined with the native Windows protection for its critical system files, but surely malware writers would still be able to deploy malware designed to infect (or ... more

Information Technology

Host-based Security

July 29, 2011

David Rimmer and 3 other people answered this question

Do any IaaS, PaaS or SaaS companies offer DLP? If not, why hasn't this been addressed?

For Brian's benefit:
IaaS - infrastructure as a service
PaaS - platform as a service
SaaS - software as a service
These are the three recognised models of cloud service delivery. IAAS gives most control to the client (and has a corresponding higher management overhead), PaaS a little less, ... more

Information Technology

Cloud Computing

Data Loss Prevention

July 23, 2011

David Rimmer and 7 other people answered this question

Is it possible to overdo security? How can you know?

Absolutely. Too much security prevents established and reasonable processes from continuing - for example, preventing data transfers to business partners or increasing costs to unreasonable levels for day to day transactions. It's pretty topical given the recent roundtable on security awareness and some of the ... more

Information Technology

July 20, 2011

David Rimmer and 3 other people answered this question

Do you need a firewall to secure web and application services? Are there other options?

The key, as Andrew mentions, is defence in depth; a traditional firewall doesn't offer much protection to web applications, but that's a job that's fulfilled by other devices or processes. A firewall will still do a decent (if limited) job of protecting open ports or ... more

Information Technology

Following 0 Topics

Following 0 People

Followed by 3 People

Knowledgeable in 6 Topics

#3 of 30

#28 of 300

Information Technology

#277 of 2263

#6 of 36

Risk Management

#7 of 67

#126 of 480