Dave Palumbo Email & Phone Number

Burlington, North Carolina, Us

New York, Ny, Us

Provided strategic firewall architecture and operational input to the enterprise, keeping in mind security, simplicity, and cost.Led network and security engineering efforts on a project to migrate outbound Internet access from explicit proxies to transparent firewalls at key domestic and international hub sites; successful completion improved customer satisfaction and slashed recurring costs.Provided technical oversight on a project to evaluate next generation firewalls from five different vendors (Juniper, Check Point, Cisco, Fortinet, Palo Alto); identified, ranked, tested, and scored requirements and features (technical, operational, lifecycle, and support).Developed and maintained standards and baseline configuration templates for firewall deployments.Spearheaded a strategic PCI compliance initiative to firewall off AS/400 mainframes that process and transmit personally identifiable information (PII); worked with relevant system and business owners to identify and translate data flows into requisite firewall policies.Liased with system owners to ensure vulnerabilities and system exposures are patched or sufficiently mitigated in order to maintain compliance with internal and 3rd party standards.Worked alongside internal audit team to place Qualys scanning engines at key perimeter and internal points of interest.Leveraged Tufin SecureTrack to identify shadowed, legacy, and non-compliant firewall policies; generated reports showing firewalls and policies with most and least used hits.Provided technical documentation and organizational feedback to external audit firms.Participated in multiple capital planning exercises, documenting needs, risks, and articulating the proposed solution for senior management in order to justify funding.Communicated exposures and mitigation status to senior management as appropriate.

Developed host and application security guides, detailing how to harden common operating systems and applications including Windows 2000, Solaris, Linux, IIS, and SQL Server.Assisted with the design and implementation of a secure, 802.11b-based wireless LAN solution based on strong authentication (LEAP) and encryption (128-bit dynamic WEP keys).Devised and implemented a security advisory distribution and implementation process, notifying systems administrators and relevant personnel of vulnerability details and mitigation recommendations.Led a project team to install network-based intrusion detection software (initially ISS RealSecure, later migrated to Snort ) in a production environment; assisted with the maintenance and management of those IDS sensors.Provided Finance department and company insurance carrier with appropriate information to rate-tier the organization.Responded to numerous requests from customers and prospective customers to articulate Factiva’s strategy in protecting its information assets, one of which was known to make the difference in winning a customer deal. Wrote and published to senior management an information security organizational strategy document, detailing why security is important and laying out the organizational goals of information security.Wrote and published an evolving set of Technical Security Policies with support from Technology, Human Resources, and Legal departments.Assisted Human Resources and Legal departments in conducting corporate investigations.Developed and implemented an incident response policy.Formulated a standard risk assessment template used for all new projects, documented risks where appropriate. Performed web application tests based on the OWASP (Open Web Application Security Project) document, A Guide to Building Secure Web Applications.Implemented and maintained a certificate authority built upon OpenSSL in order to meet a need for self-signed digital certificates.

Performed black-box style penetration testing of company networks, compromising a number of front end and back end systems, including web servers and database servers.Evaluated the security architecture for the next version of a major consumer financial software product. Project scope included standard network penetration tests, sniffing the wire for information leakage, probing binaries for passwords and other sensitive information, and using SSL proxies to view HTTP header information.Conducted security and privacy policy reviews for the product in light of industry best practices (BS 7799/ISO 17799).Reviewed the security posture of a software-based load balancing solution, at the time in beta testing. Analyzed the different communications interfaces (TCP ports, services installed) for potential local and remote attack conditions.Performed a remote network vulnerability assessment of Lotus Domino corporate web servers by finding unprotected NSF (Notes Source Files) files. Initially enumerated system administrator usernames, followed by successful penetration of a “secure” web-based application.

Bachelor Of Arts, Psychology

Bachelor Of Arts (B.A.)