Are you Proactive about Risk?

Do you think like an attacker?

Seventeen million programmers are churning out an estimated 102 billion new lines of code per year. Add 162 million websites online, with 809,000 using SSL (an indication of valuable data) and the problem becomes apparent. Researchers estimate that roughly one security defect exists per 10,000 lines of code and nine out of 10 websites contain one or more serious vulnerabilities. If only 1 percent of security defects are exploitable that means we are generating 102,000 zero-days per year - we just don't know where most of them are. Even if 90 percent of the SSL websites contained only a single issue, 728,100 website vulnerabilities are already in circulation, and we don't know where those are, either.

This website is simply a page on a cloud for Tom Brennan. I am always happy to lend a hand on complex, covert, and interesting research topics. You can contact me by calling 973-506-9303 or use skype

Brennan Bio

Twitter | Blog | LinkedIn

Tom is a member of the WhiteHat Security team of application security experts and a volunteer to the OWASP Foundation globally and locally as the chapter leader for the NYC Metro Chapter. Strong interpersonal skills with the ability to work in a team environment or independently to complete the mission a style acquired while serving with the United States Marines Corps.

Frequent conference speaker and regularly quoted in the media such as the Wall Street Journal, NBC & ABC News in NYC, USA Today, CRN and Dark Reading and various podcasts technology topics.

Tom has led red teams and delivered hands-on technical services for over a decade circumventing, defeating and otherwise thwart clients internal and external security controls for a multitude of public and private critical infrastructure clients. He has also contributed to successful dot-com start-up's, commercial and open-source projects.

In addition to raw skill, he holds agnostic industry certifications including: Certified Information Systems Security Professional (CISSP), ISACA Certified Information Security Manager (CISM), National Security Agency, INFOSEC Assessment Methodology (IAM), and Certified Ethical Hacker (C|EH) and pokes the bear with the ASSCERT as a habitual prankster. He also holds many additional vendor certifications for products and tools. When the task is tuff... and does not know the answer RTFM, google and talking to industry peers he is connected to on LinkedIn has worked. With technology, #fail is the rule rather than the exception, being proactive about risk is performing a 3rd party holistic assessment and not talking about it... doing it.