Hugh D. Gamble 905 787 1849 40 Church St. S. Richmond Hill, ON L4C 1W2 email: hugh@PhaedraV.com Qualifications: * Over twenty years of experience in the Computer and Networking Industries. * Demonstrated expertise in LAN/WAN Design, Implementation, and Administration. * Design and Implementation of Network Security Architecture. * Experienced Information Technologies (IT) Manager. * Keep current on industry and government standards through meetings with policy makers and attending seminars. Employment History: 2002 – Present: Principal, Phaedra V. * Network and systems security architecture consulting: For one client I conducted a network security audit and recommended system changes. In another I re-implemented the firewall and PKI architecture. I also monitor security threats and legislation on an ongoing basis. * Technical management: vendor management, managing developers, and International projects. April 2004 – March 2005: Security Consultant, Empire Financial * With good IT Security and Access Control teams in place, Empire is preparing for an increasing emphasis on e-business by evaluating, co- ordinating, and updating their entire security architecture. I was brought in initially to collect and document existing security procedures, processes and policies. Following the completion of a five hundred page Security Administration Manual, we are now proceeding with the new Security Architecture. I continued in the role of Security Analyst to implement a comprehensive security management console, monitoring the Cisco firewall and VPN devices and network authentications. Dec. 1996 – Sept. 2001: Net Technology Analyst, ICE. * managed internal IT security: supervised IT department in matters of network and system security and information privacy policy and planning. I designed and monitored network security including the installation of firewalls, CISCO VPN hardware with IPsec, email virus scanners. Network vulnerability scanning with Cybercop and Nessus. Maintained OS configuration and patches for Solaris and Windows in accordance with security best practices. * intrusion detection and forensics: monitored network and system logs, tracked down attackers, emergency response and repair. When a development server became compromised I co-ordinated emergency response, and applied forensic techniques to track down the origin of the attack. * client systems and network design and security: designed system security architecture, VPN, firewalls, virus scanners, OS patching for IT and client projects including: Bank of Montreal EFS Intranet; Signature Vacations and Dominion Bond Rating Service e-business systems. I was responsible for writing test plans, auditing security, and re-evaluating after recommended actions had been taken. The designs ensured security for all tiers of the application architecture from internal databases to public web servers. Operated Noranda’s website working with IBM for systems and network security. * privacy policies and statements: consulted on legal and client confidence requirements for web projects, validated compliance of technical architecture with policy. Tracked Bill C6 compliance for clients in regulated industries. * e-business software privacy and risk assessment: evaluated existing systems for vulnerabilities, network scans, system audits. * LDAP: implemented corporate directory in OpenLDAP, ported to iPlanet LDAP. Migration towards ‘single sign on’. Some interfacing with Active Directory required for Windows 2000 servers. * eBusiness software architecture: worked on s/w architecture of enterprise Java eCommerce system for LaSenza lingerie in WebSphere, Signature Vacations and Dominion Bond Rating Service with J2EE in BEA WebLogic. Working with the development teams to ensure proper implementation of the security architecture. Specific client projects in which I played a key role include: Bank of Montreal and Nortel Intranets and live webcasts; system security design of e-business websites and transactional systems for Signature Vacations and Dominion Bond Rating Service implemented with J2EE in BEA Weblogic. I was solely responsible for security in the systems and network designs, performing security audits with network and system scanning tools, and intrusion detection and forensics. Jul. 1990 – Sept. 1996: Manager, Advanced Systems, NTT. * networked kiosk security: ensured robust and secure communication for a nation wide network of retail kiosks, supervised primary contractors. * Secure network administration: managed a lab network for reliability and security at the Department of Defence. * Software programming: networked system programming in C++ and Java. For the K-mart retail kiosk network I got a colleague on the PGP development team to make us a custom version of the MD4 code for my use in password authentication when updating the kiosk database. May 1986 – Sept. 1989: Staff Manager – Engineering Design, Bell Canada * Integrated Office Systems development: evaluated and selected products for inclusion in the IOS product portfolio, included system security analysis of Unix minicomputers and PC LANs. Sept. 1983 – Sept. 1984: Co-op Student, Bell Northern Research * data processing and business analysis of the pending divestiture of AT&T. * expert systems for telephony software. Other relevant experience: * Unix: owned and operated networked Unix systems since 1982. * Windows 2000: administrate server with Active Directory ACLs. * University computer security: detected and reported mainframe security violations while a student. * PDP-11 admin: administered and upgraded minicomputer security while a high school student. * Microsoft .NET and IBM J2EE seminars. Education: I have completed a B.Sc. in computer science at the University of Toronto, studying part time after starting at the University of Georgia with a National Merit scholarship Published papers: Perceptual Control and Layered Protocols in Interface Design I: Fundamental Concepts International Journal of Human-Computer Studies, 50, 489-520, (1999) M.M.Taylor, P.F.H.Farrell, H. Gamble, and J. Hollands An Expert System Opponent for Wargaming DCIEM Report No. 93-54, April 1995 T.R.H. Cutmore, H.D. Gamble E-business Security whitepaper for ICE Conferences: Colorado Software Summit http://www.softwaresummit.com/ 8th International WWW Conference Computers Freedom and Privacy 2000 iBAND broadband networking conference Content Delivery Network conference IPMulticast conference Netscape Developers Conference Affiliations: ICANN, ACM, Java Users Group Skills: Unix/Linux, Windows, TCP/IP, PKI, Firewall, VPN, LDAP, IIS, SSL, P3P, IPSec, DES, NMAP, Cybercop, nessus, CA-Top Secret, Java, C++, PERL, technical writing. References: Available on request.