Rothesay

Head of Security Engineering

Bank of England

Deputy CISO

Senior Manager

Head of Threat & Vulnerability Management

DevSecOps

Cigital, Inc

Managing Consultant

Senior Security Consultant

Software Security & Testing (IBM Rational)

Software Developer in IBM

🔴 All posts are my observations of the general landscape meant to engage and educate. NOT problems I'm encountering. All views are my own and not that of my employer. I’m a techie, not an economist.

🔴 Please don't invite me to meals, drinks or round tables. ALL requests will be ignored.

I help CIOs in dynamic organisations reduce cyber risk, by developing pragmatic cybersecurity functions that align with the business needs and have a proven track record of increasing simplicity and promoting accountable visibility. 

I'm a Technical Cyber Security Leader with over 17 years of experience within start-ups, management consulting and top-tier organisations. Extensive hands-on experience with Security Architecture, Engineering, DevSecOps, Security Posture Management, Penetration Testing & Red Teaming.

Engagements, Awards, Articles and Education

🔵 InfoSec Europe, Advisory Board • 2024
🔵 e-Crime & Cybersecurity Congress, Lost in Translation • 2024
🔵 Webcast, Control Effectiveness • https://www.brighttalk.com/webcast/19525/609336
🔵 SASIG, Adapting to the new cyber threat landscape • 2023
🔵 Central Banking African Summit, x4 talks over 2 days • 2022
🔵 CyberCon, Hosted fireside chat: BoE, LSEG, MS • 2022
🔵 Secure Southwest, High-value security testing • 2019

🟢 National Cyber Awards, Winner of the Financial Services Award • 2023
🟢 BCS Awards, Finalist for High Impacting Business Project • 2021
🟢 SC Awards Europe, Finalist for Best Security Team Europe • 2019

📒 Preparing your Organisation for AI Cyber Warfare • https://tinyurl.com/df-ai-war
📒 Finding High-Value Security Initiatives • https://tinyurl.com/df-sec-roi
📒 No Bullsh*t Approach To Simplifying Cyber Supply Chain Risk • https://tinyurl.com/df-supplychain
📒 Critical Vulnerability Management Cheat Sheet • https://tinyurl.com/df-cheat

📕 Master of Business Administration (MBA) • Exeter University, 2021
📕 Bachelor of Science (BSc Hons), Computer Systems & Networking • University of Plymouth, 2007
📕 CISM, Certified Information Security Manager • ISACA, 2016
📕 CISSP, Certified Information Security Professional • (ISC)2, 2011
📕 CSSLP, Certified Secure Software Lifecycle Professional • (ISC)2, 2014

Dave F.

Imbricate Security

I'm still creatively applying all my experience to helping executives succeed. Imbricate Security helps CISOs and other executives navigate modern cybersecurity problems such as digital transformation, governance-as-code, application security, software supply chain management, vulnerability management, DevSecOps, and resilience.

I have extensive experience with cybersecurity models, metrics, and strategies around these topics and would like to build new ones for organizations and the industry at large.

I'm open to work on Technical Advisory Boards and with venture capital and private equity firms to bring my experience and voice-of-the-customer view to accelerating progress and success. I'm also open to collaboration on efforts such as a book, standard, or similar projects.

Principal

Synopsys Inc

Continued my senior technical leader functions in security consulting and now also applying the resulting vision across a portfolio of products and services to create new and timely solutions for software security programs and supply chain security, particularly in a SaaS delivery model. Created an agile internal process that brings together people, IP, and technology to do rapid prototyping of solutions to meet emerging market needs, get new logos, and build backlog.

Continuing my role as BSIMM lead, a widely used model I co-created in 2008, then nurtured and did data analysis for since its start. Work internal cybersecurity projects for Synopsys executives and co-lead an ongoing innovation program. Worked 18 months in Product Management to instill new voice-of-the-customer requirements for innovation, features, and value delivered. 

Working across products and services to create strategic plans and novel solutions that create deeper relationships by addressing client needs in a way that a standalone service or product can’t. Also work to create and monetize IP in new ways to address evolving market needs.

Principal Scientist

Cigital, Inc.

Held all the roles expected of a self-starting senior individual contributor reporting to the CEO of a services company that organically grew 10x from ~45 people to ~450. Includes strategy planning, offering creation, applied R&D, employee development, internal training, sales and marketing enablement, sales engineering, public speaking and writing, press, KPIs/KRIs, and billable hours. Stood for the customer voice to bring high-value problems into the firm and for the firm to evangelize the world into evolving its approach to software security.

Set vision on our management consulting advisory services, built offerings, and trained hundreds on sales, concepts, and delivery. Started, built IP, and trained others to sell and deliver computer-based and instructor-led training, smart grid security, maturity action plans, metrics programs, and security process analysis and improvement.

Co-creator of the BSIMM multi-year research study on creating scorecards for software security programs and primary gatherer of live data from the field. Talked with over 1000 CISOs, managers, and engineers as part of analyzing hundreds of software security programs and used the data to produce 13 annual reports.

Creator of the BSIMMsc, a streamlined method for analyzing software vendors’ secure development practices, including scoring approaches. Co-creator of the CISO Study, an analysis of management practices with and accompanying scoring model.

Cybertrust, Inc. (formerly TruSecure Corp. and owner of ICSA Labs)

Technical leader for product management and offerings development to make and improve IT security offerings, improve testing and managed service delivery, and capture reusable IP. Founding member of security services P&L and created delivery procedures and methods. Led IP modeling and creation to improve GRC managed service value delivery, including control sets, processing rules, scoring, and requirements relationships for quantitative and qualitative business and portfolio risk analysis and threat modeling. Patent granted for security risk index methods and process. Created security models as a new revenue source using requirements from industry practices in business process, financial, security management, critical infrastructure, privacy, payment card, and related laws and guidance.

VP, Knowledge Management

iDEFENSE

Founding member of iDEFENSE Labs with a goal to centralize innovation and research around threat intelligence and associated cybersecurity services. Founding member of consulting P&L and created training, procedures, and methods to drive quality and cost-efficiency in consulting delivery. Worked directly with threat/attack intelligence team to make knowledge actionable for clients and supply third-tier technical analysis of malware samples, security breaches, and related events. Created an information security maturity model for measuring people, process, technology, and environment to directly inform risk management decisions. Patent application for business intelligence methods and process.

Chief Scientist

I’m a lifelong innovator who has made a career of helping organizations address hard cybersecurity problems. While growing consultancies and revenues, my priorities as a senior technical leader included defining the cybersecurity problems CxOs and their organizations will be facing in the coming 12-24 months and maturing the people, offerings, technologies, and skill sets to deliver with high quality at scale. Those offerings include market-leading solutions that span software security, governance and risk management models, compliance, metrics and dashboards, threat modeling, DevSecOps, software supply chain security, and digital transformation. Delivery models include consulting, products, SaaS, and partnerships.

My approach to creating lasting organizational change has always been simple: wise spending balances business differentiators, controls, debt, risk reduction, and productivity. Good metrics show whether efforts are working.

In the early days, I contributed practical security models and approaches to seminal security works such as the Rainbow Books, Common Criteria, PCI, CMU CERT, and Government and NIST standards. More recently, I’m a creator of the Building Security In Maturity Model (BSIMM), a set of controls and an assessment methodology for creating software security program scorecards. The BSIMM’s interview-based approach allowed me to talk with over 1000 CISOs, managers, and engineers, and create annual publications on what I learned. I’m also a creator of the BSIMMsc, a streamlined method for analyzing and scoring software vendors’ secure development practices and a creator of The CISO Study, an analysis of and scoring approach for CISO security management practices.

My research has appeared in journals such as IEEE Security & Privacy, IEEE Software, ACM Proceedings, and in many industry publications. I’m a frequent speaker and am often asked to simplify complex topics for the press and for those who need simple guidance in making important security risk management decisions.

taplio

The Battle

Dave F.

Sammy Migues

Followers

Posts

Engagements

Likes

Ready to grow your LinkedIn presence?