Patrick Maroney Email & Phone Number

Philadelphia, Pa, Us

Dallas, Tx, Us

Principal Engineer and visionary for the AT&T Threat Information Sharing System (TISS). TISS consists of MISP, OpenCTI, and Maltego. We capture Cyber Threat Intelligence (CTI) from 100++ Premium and OSI sources and normalize, transform, correlate, contextualize, aggregate, and disseminate to stakeholders. Additional focus has been on architecting and deploying supporting infrastructure to scale to orders of magnitude increases in CTI and contextual taxonomies. Leading efforts to transition this Data Center centric architecture to Azure using containerization methodologies to increase scalability & resilience while significantly lowering costs and time to execute. Responsible for Customer Engagement to capture and execute on "Analyst Driven" initiatives across 10 internal Customer Domains.

A successful independent consulting firm that specializes in the design, implementation, and operation of large-scale network/security infrastructures. Founded in 1988, we have formed long-term partnerships with L3 Communications; Lockheed Martin; General Electric; Johnson & Johnson; S.W.I.F.T.; Ascom/Timeplex; and Infotron Systems.Focused on leveraging "best of breed" technologies, processes, and people to deliver transformational capabilities that empower organizations to execute on key business objectives, realize opportunities, and solve complex issues. With special focus since 2002 on Advanced Cyber Threat/Risk Prevention, Detection, Mitigation, Remediation, CSIRT Leadership, and Incident Investigations.

Redmond, Washington, Us

DarkLight Cyber is an Artificial Intelligence software utilizing an Expert System with contextual reasoning capabilities. (1) Design and implementation of AWS DarkLight Server architecture for Demonstration, Production, and Test/Development requirements (including implementation of frameworks like MISP, Elastic Stack, Kafka, etc.). (2) Establish and facilitate DarkLight Team active engagement in OASIS Technical Committees (e.g., Cyber Threat Intelligence, OpenC2).(3) Provide Cyber Domain operational experience.

New Boston, New Hampshire, Us

Chief Architect of Wapack Labs CTAC (Cyber Threat Analysis Center). CTAC fuses 6 years of analyst derived intelligence. These Wapack Labs & Red Sky Alliance data sets are transformed, ingested, and indexed into an Elastic Stack framework (Commercial X-Pack, Kibana, Machine Learning Elastic Search Clusters, Beat and Logstash Ingestion).The CTAC Analytic Framework provides a number of powerful Analytic and Data Science tools to Wapack, Red Sky Alliance, and Customer analysts that empower crowd sourced development and sharing of analytic models. The concept is to develop rich models of Adversaries, TTPs, and Targets.CTAC Analytic Frameworks include Cloud based instantiations of CRITS, MISP, Jupyter Lab, Apache Zeppelin, H2O AI, BlazeGraph Graph Database, OpenRefine, and CyberChef. CTAC also includes RocketJot (proprietary analyst driven research report generator) & Wapackapedia (a private Wikimedia instantiation that fuses 6 years of Analysis Reports, IOCs, “How-To”s, Rogues Gallery, Malware Analysis, RAT/C2 libraries, etc.).Chief Architect of the underlying CTAC infrastructure that houses all of isolated AWS Ubuntu servers supporting the CTAC Analytic Frameworks, protected by an F5 BIG-IP VE Security Appliance, and integrated with SAASPASS SAML Multi-Factor Authentication.Chief Data Scientist leading efforts to normalize, transform, and load 6 years of legacy Cyberthreat Intelligence Data Sets. Also leading efforts for new data set collection and integration.

Provide leadership, technology/process architecture, design, implementation, and consultation, to DSIE Board of Directors, Executive Director, Steering Committee, Working Groups, and Project Teams, as required for the execution of major DSIE initiatives and Technical Exchange Conferences.• Oversee the development of future component architectures and migration plans.• Conceive, design, prototype, and test new methods, algorithms, and models.• Define and enforce appropriate technical standards and procedures.• Lead the research and development of new software products and applications.• Define system, technical and application architectures for major areas of development.The Defense Security Information Exchange (DSIE) has served as the DIB Cyber-ISAC since 2007. DSIE restructured organizationally as DIB-ISAO and continues dba DSIE.

Serving the DSIE Board of Directors to advance strategic and tactical objectives of the Defense Security Information Exchange organization. The DSIE was formed by 20 of the leading DIB companies in 2008 and formalized under the DIB Sector Coordinating Council as the Cyber Sub-Council and defense industry ISAC. With over 60 defense companies and 375 members actively collaborating in real-time on all aspects of Cyber Threat Mitigation, the DSIE represents one of the most effective Threat Intelligence sharing organizations in the world. Acting as liaison between the DSIE Board, Steering Committee, Working Groups, and Project Teams, in the execution of major DSIE initiatives and Technical Exchange Conferences.

Chief technical architect of the CyberIQ Vision for threat intelligence services, analyst focused tools, advanced analytics, and “Smart-Data” strategy. Scope included assembling an agile software development team; Identification of key capabilities/technologies and opportunities for strategic partnerships; and architecture/design/implementation of all related network, systems, and security infrastructure.

New York, Ny, Us

Reporting to Enterprise WAN Program Manager & Executive VP-CIO, responsible for all aspects of Enterprise network operations & security (~$15 Billion Revenue, ~100,000 nodes, ~200 sites, ~110 Divisions, ~66,000 Employees). Scope included: Enterprise WAN & CSIRT Team development/management; Network/Security Operations; Incident Response; Risk Management; Network/Security infrastructure life-cycle management; Policies & Procedures; and new business acquisition due diligence & corporate integration.Since 2003, primarily focused on Advanced Persistent Threat (APT) mitigation. Responsible for all aspects of Enterprise CSIRT coordination between Divisions, Forensics Partners, DC3/DCISE, DSIE, US-CERT, US Agencies, Vendors, and Executive Management. Actively engaged with DIB/DC3/DOD/US-CERT/Partner/Vendor communities in the definition/adoption of standardized Data Inter-Exchange formats and processes to effectively describe/exchange Incident metadata & complex Indicators of Compromise (IOCs). Collaborative efforts include: the development of Reference Implementations using IODEF XML Schema for Incident Reporting; direct partnership with Mandiant to develop OpenIOC Schema/Tools; and development of XML/JSON/YAML IOC Schemas. Developed and evangelized Reference Implementations for the automated collection, processing, and inter-exchange of structured threat intelligence. These reference implementations included Mandiant, NetWitness, & ArcSight. Key objectives: automated detection, collection & processing of IOC metadata; automated policy implementation; metadata association & temporal analysis, Adversary Modeling, and automated CSIRT case file Work Flow & data management.

Reporting to Communications Systems East CIO, responsible for all aspects of network and security infrastructure (~ 2000 nodes). Highlights include design, implementation, and operation of: Policy based VLAN; Network Management Systems; Secure Remote Access; Divisional Firewalls; External Partner Networks; Certificate Authority & PKI; RSA SecurID Authentication Services; Threat & Vulnerability Assessment Systems; Systems Integrity Assurance; Intrusion Detection; and Event Correlation. Other major projects include: the successful migration of the CSE business from the Lockheed Martin Enterprise Network into the newly formed L3 Communications Enterprise Network; design and implementation of an integrated multi-vendor solution to securely extend external Customer and Partner access to Metaphase data systems; and the consolidation of multiple network protocol/cabling architectures (AppleTalk, LocalTalk, DECnet, Sun NIS/NFS, DEC LAT, IBM SNA, Terminal Servers, Protocol Translators, etc.) into a single integrated TCP/IP LAN/WAN and structured cabling infrastructure.

Bethesda, Md, Us

Key contributor to the Enterprise Remote Access Team that deployed unified global remote access services to over 100,000 employees, while consolidating widely diverse authentication systems into a centralized RSA Two Factor Authentication architecture. Project lead for the implementation of specialized Remote Access Services to Executive staff at Lockheed Martin Headquarters. Project Lead & Team member on the Enterprise Infrastructure Management teams that implemented standardized Desktop, File, Print, and Mail services across Lockheed Martin. Other projects included full responsibility for the design and implementation of LAN/WAN infrastructure to support relocation of four Lockheed Martin divisions to the Camden Waterfront Technology Center.

Senior representative from Network Infrastructure team to the TeamIS Taskforce chartered to address inter-departmental issues with identification, prioritization, coordination, and implementation of critical applications, systems, and network infrastructure. Project lead for implementation of VAX/VMS Network Management and Network Analysis Systems. Technical lead for a team responsible for the integration of multiple mail and directory services. Technical lead for a project to provide LAN/WAN access to centralized CDROM libraries from a highly diversified desktop environment.

Design, implementation, and management of the LAN/WAN facilities for the U.S. Operating Center and annex sites in Culpeper, Virginia. Also responsible for multi-vendor workstation integration, mail systems integration, and VAX systems management. Assumed project management responsibilities for both local and multi-national corporate projects. Appointed to an international task force chartered to transition distributed networks and systems into a centralized management structure. Tasked by Senior Executives to execute an emergency project to identify and resolve complex organizational and technical issues causing severe business disruptions at S.W.I.F.T. corporate headquarters in Belgium.