Bruce Marshall Email & Phone Number

Kansas City, Missouri Area

I created this site to consolidate the important information for dealing with password and authentication risks. I seek out and collect the research of security professionals and academics discussing practices for authentication system management. Over the past decades I have expanded this library to over a thousand papers and studies. My goal is to promote better use of the existing body of knowledge as well as encourage new collaborations between those in the academic and commercial circles.I have also conducted my own research on passwords and related authentication practices, the results of which I publish on the site and regularly discuss at security conferences. My expert commentary has been featured in articles by news organizations like BBC News, The Wall Street Journal, New York Post, Infosecurity Magazine, and Ars Technica,

Managed the web application security program for the bank, which involved identifying gaps between our program standards and regulatory / industry practices, improving our assessment methodologies, and documenting procedures. Created custom reports to communicate vulnerability findings with in-house developers or outside vendors, and to track issues to their resolution. Balanced business objectives with security goals.Performed manual penetration testing and automated scanning of 100+ customer-facing and internal web apps (primarily Java, C#, or JavaScript based), web services, open source projects, and some infrastructure components. Reviewed vulnerability assessment reports from tools and from third-party consultants to determine their accuracy, risk rating, and our remediation plan.Represented IT Security in application and infrastructure projects. Provided task scoping and process feedback to project teams. Documented, tracked, and communicated risks to IT and business units. Evaluated vendor security program maturity and product design.Collaborated with software development teams, which included delivering an annual secure development course and hosting quarterly secure development roundtables to discuss app vulnerabilities, internal standard changes, and Secure SDLC process integration. Also trained IT Security dept staff on web application security fundamentals, processes, and tool use.

Kansas City, Missouri Area

Performed security consulting services for clients, primarily in the financial industry. These projects included network vulnerability assessments, penetration tests, gap analysis, web application security assessments, incident response, and policy development. I managed these projects, wrote technical reports, and presented the findings to IT and executive management.Directed the network security services practice by creating new company service offerings to meet changing industry demands (PCI DSS, FFIEC guidelines, etc.) and developing the methodologies to deliver them. Managed other consultants on client projects. Supported business development with sales meetings, project scoping, and proposal creation. Started the Security PS blog and wrote technical content for it.Created and taught several day-long or multi-day information security training courses for clients, which covered subjects such as Windows & Active Directory security, web application security, information security fundamentals, and WebInspect. Presented at conferences, chapter meetings, and webcasts. Provided security subject matter expertise to Microsoft in the creation of their own course and certification exam content.

Kansas City, Missouri Area

Continued work mentioned below as INS was spun off as independent company from Lucent Technologies.

Kansas City, Missouri Area

Provided security, networking, and Windows consulting services to clients such asSprint, Conoco-Phillips, Radio Shack, and American Express. Worked on high profile projects and solved problems related to Cisco routing/switching equipment & protocols, Windows 2000 / XP / .NET Servers & Active Directory, Public Key Infrastructures (PKI), authentication protocols & practices, and IP network optimization. Managed these projects, wrote both technical and summary reports, and presented the findings in person to IT and executive management.Developed and facilitated technical training for customers and peers, improved our consulting project methodologies, and supported business development efforts. Presented on technical topics at national conferences, seminars, and webcasts.Led fellow consultants through formal and informal mentoring, technical practice management, and client project management. Represented the consulting staff in company leadership meetings and projects (such as technical bio template creation).

Kansas City, Missouri Area

I consulted with clients on topics of information security, internetworking, and Microsoft technologies. INS was acquired by Lucent Technologies where I've documented my accomplishments and responsibilities.