Brent Alan Hammond - Resume Date Available: October 13, 2003 Last Updated: September, 2003 Position: Senior Project Manager/Systems Security Architect Contact: Brent Hammond, 916-641-7531, b@bh49.net Qualifications -------------- * Summary: Threat/Vulnerability Manager, Senior Systems Architect, and Project Manager with over 10 years of experience in Leadership, Network Security, Network Forensics, Systems Architecture, Programming, and Technological Oversight (IV&V). Worked extensively with the State of California providing technological engineering/oversight and Independent Verification and Validation (IV&V). Agencies include DHS (at HHSDC), DTSC, DSS (CWS/CMS), DOJ, and CDC. Commercial focus in Web Systems/Application Development, and Security Services for large and small organizations. * Accomplishments: Helped facilitate State projects for law enforcement including the DOJ interface with the NCIC National Sex Offender Registry, Law Enforcement Automated Data System (Parole LEADS for CDC), security enhancements for the Prison Industry Authority, and the rollout of electronic fingerprinting technology to California State Institutions. Commercially, I pioneered network applications development, new products research and development, new business opportunities, and developed opportunities through close relationships with clients by learning their business and vertical markets. Spearheaded major projects conceiving and implementing multi-tier, E-Commerce, and legacy integration architectures. (See attached "Project Detail" for specific accomplishments.) * Expertise: Oversight and technological assistance for the State of California including all stages of procurement; Leadership as Technical Project Manager, Technical Lead, and Product Manager; Integrator of heterogeneous infrastructures with networked Windows, UNIX, AS/400, and OpenVMS; and, Designer of testing infrastructures for projects including performance and scalability testing. Completed security training at SANS and DECUS and graduated from the Object Management Group's CORBA Academy. * Methodologies and Standards: Adaptable and proficient with varied software development methodologies (spiral, waterfall, RAD, configuration management, etc.), industry standards compliance (IEEE, ANSI, ISO, CORBA, etc.), and governmental standards (HIPAA, California Procurement, etc.) Regularly consult with industry recognized think tanks such as the Gartner and Hurwitz Groups. * Communication: Accomplished at briefing directors, CEO's, boards, and all levels of management on critical and sensitive information. I develop superior relationships with clients through integrity, always striving to be a bi-lateral advocate. I am an accomplished speaker awarded CTM from Toastmasters International. * Foundation: My experience is grounded in distributed technologies, risk management, secured networks, intrusion technologies, and integration to legacy systems. I began as a C programmer expanding over time into areas of my own fascination, interest, and expertise accumulating over 10 years experience. Experience ---------- 7/2002-present Independent Contractor Sacramento, CA Threat/Vulnerability Manager and Network Administrator -------------------------------------------------------- * Work small contracts for various clients, providing expert security and network services. * Provide emergency services to client affiliates. * Develop private network lab for testing new security and networking technologies to assist in proof of concept for clients in a heterogeneous networking environment. 5/2000-6/2002 IP Warp Incorporated Sacramento, CA Founder and Chief Technology Officer -------------------------------------------------------- * Lead diverse team developing custom integration solutions for clients. * Performed design analysis, code walkthroughs, system and architecture support, risk assessments, and oversight for large development projects. * Architected IP Warp's server farm, network infrastructure, E-Commerce websites, and security systems for internal and client-based systems. * Designed information security infrastructures, firewalls, intranets, extranets, and gateways, secure email, secure web services, and virtual private networks. * Provided technological strategic direction and management to IP Warp, a Professional Services Company. * Experience with Cisco and Livingston routers, IP-Sec, PKI, C, XML, CORBA (Orbix ORB), OO requirements definition, spiral/RAD development methodologies, and data mapping into XML using Sefas technologies. * Designed the installation of wireless LAN technology in a heterogeneous environment with legacy components. * Developed business opportunities through close relationships with clients. * Actual business start date is 10/1995. From then until incorporation date in 5/2000 IP Warp was a small sole proprietorship that I ran in my spare time as Fallen Leaf Consulting As IP Warp's Senior Architect, I performed expert technical guidance and consulting for IP Warp's valued partners and clients. I enabled IP Warp's clients to expand business into e-commerce and Internet-centric business. I redesigned IP Warp's network infrastructure consisting of additional redundant (mirrored) web and email servers, geographical distribution to improve fault tolerance, new sendmail-Linux based anti-spamming email servers, multiple upstream ISP gateways, and a very fast DNS server farm providing superior fault-tolerance. 2/98-5/2000 Logicon Sacramento, CA Senior Network Security Engineer (Senior Technical Lead) -------------------------------------------------------- * Provided expert systems engineering support (IV&V) for development projects including architecture, deployment, acceptance, configuration management, requirements definition, project planning, scheduling, staffing, training, and testing. * Performed architecture assessments, risk assessments, and oversight for large development projects (IV&V). * Assessed designs and utilization of technology for scalability, maintainability, extendibility, and stability (IV&V). * Analyzed architectural design and thousands of lines of C code for a proprietary CGI (Common Gateway Interface) to sensitive information in order to improve security, scalability, and maintainability. * Led development teams and implemented architectural assessments, performing security audits, planning, design, and testing. * Conducted internal and external security audits assessing security planning and architectures utilizing network analysis, hacking, and system administration tools to simulate a network-based break-in, denial of service attacks, and resource hijacking. * Developed Statewide and department-wide security design, architecture, policies, procedures, and information security management plans. * Provided technical designs for electronic forensics facilitating the prosecution of internal fraud and external hacking. * Experience with C, Apache, IIS, SSL, ISP techniques, Cisco/Livingston routers, network analysis tools, IPSec, PKI, Oracle development tools, Oracle web development tools, Oracle databases, Microsoft SQL, Microsoft SQL Server, Sun Solaris, Linux, Windows NT/XP/2000/98/95, AS/400, MVS, OS/390, TCP/IP, Requisite Pro, Microsoft networking, DNS, Sendmail, Java, JavaScript, and more. I performed infrastructure and architectural design and assessments, security and systems engineering services, technical leadership, and information security consulting services to Logicon clients primarily under IV&V contracts. I was Logicon's premier architectural expert on web-based and legacy systems integration, security engineering, and middleware expertise in Sacramento. I trained Logicon consultants on Information Security technologies and techniques, and applied expertise towards securing Logicon's Advanced Technology department's network infrastructure, servers, and remote facilities. 9/92-12/97 Synergex International Corporation Sacramento, CA C Programmer/Architect/Product Manager/Network Products Manager -------------------------------------------------------------- * Designed and proposed the architecture for middleware that abstracts CORBA and DCOM distribution mechanisms utilizing Unified Modeling Language (UML), Rational Rose, and Requisite Pro. * Designed a tool providing component development, deployment, management, and security tools targeted at the abstract "component". * Developed a architectural design for Java/Web integration with legacy business logic on NT, UNIX, and VMS servers based upon Java RMI (Remote Method Invocation) bridged to server resident Synergy legacy applications that was delivered six months early. * Responsible for architecting a new product family and business channel for Synergex to break into new markets and move away from a legacy niche customer base. * Evaluated technical and market feasibility for several new product proposals, including: modeling tool utilities, a pre-POA (Portable Object Adapter) CORBA vender abstraction tool, a global vender-independent CORBA name service, a Java RMI (Remote Method Invocation) bridge to abstract distributed components, and component licensing tools. * Lead Architect and Designer responsibilities for Java/Web, object-oriented, and distributed middleware architectures. * Worked with analysts and consultants from Gartner Group, Hurwitz Group, and Business Research Group. * Participated in Object Management Group (OMG) meetings in Canada and the US. * Lead architect and C Programmer for all of Synergex's information security requirements and development. * Founded the Network Products Group in Software Development. * Designed and managed the installation of two proprietary firewalls and designed firewall enabled products and product extensions written in C. * Designed the Synergex Knowledge Base, Intranet Web infrastructure, and external policies and procedures * Delivered the first three stable releases of Synergex's IDE on Windows 95 and NT 3.5.1/4.0 written in C. * Released first version of a new 2-tier TCP/IP product while piloted a cross-functional software testing effort that fueled the creation of Synergex's Quality Improvement group. * Experience with C, component-based architectures, PVCS, VMS, UNIX, Windows NT/95, HP-UX, Linux, AIX, Sun Solaris, Digital UNIX, CORBA, DCOM, PERL, TPU, DCL, Java, JavaScript, Java RMI, DNS, sendmail, HTTP, Apache, IIS, CERN HTTPD, Firewalls, packet filtering, proxy servers, Rational Rose, Requisite Pro, and more. Education --------- 1992 University of California Davis, CA B.S. Computer Science and Mathematics. -------------------------------------------------- * * * * * * * * * * * * * Project Detail Below * * * * * * * * * * * * * * * Project Experience ------------------ 2/01-4/01: Lead Network Architect, IP Warp Incorporated Client: KWS Real Estate, Lodi, CA ------------------------------------------------------- Responsibilities: Design, procure, and oversee the installation and testing of a cost-effective wireless LAN with a DSL Gateway. Accomplishments: Integrating legacy workstations in addition to newer technology to work with wireless technology. The heterogeneous environment consists of Macintosh and Windows 95/98 workstations. Utilized a single dynamic IP assigned DSL modem, NAT, and multiple wireless internal subnets. Provided email services utilizing authenticated SMTP, POP3, relaying exception rules, and backup sendmail/Linux based servers. Installed the KWS website on IP Warp's primary systems with backup mirrored websites and geographically distributed redundancy (standard service at IP Warp). Project Experience ------------------ 5/00-11/00: Senior Design Analyst, IP Warp Incorporated Client: Output Technology Solutions (OTS) Inc., YourAccounts.Com Professional Services ----------------------------------------------------------------------------- Responsibilities: Conduct business and technical analysis of custom implementations of OTS' Electronic Bill Presentment and Payment (EBPP) solution for four leading telecommunications companies. Provide design specifications for conversions from OTS's base system to their new Object-Oriented/Java/XML implementation. Accomplishments: Played a key role in defining YourAccounts.Com Project Team's processes and developing repeatable definition, design, and implementation plans to enable subsequent teams to convert the rest of the billers. Brent was the Lead Design and Development Analyst for the first conversions to their new architecture. The target environment is an XML-CORBA based architecture written in Java. Trained for the conversion of print-ready data streams into XML using Sefas mapping tools. Project Experience ------------------ 2/00-5/00: Security Audit and Risk Assessment, Logicon Client: California Department of Corrections Prison Industry Authority (PIA) ---------------------------------------------------------------------------- Responsibilities: Team Lead directing technical execution providing systems and security engineering support in response to successful security breach. Perform risk assessment of the Manufacturing and Accounting Planning System (MAPS), a security analysis of the MAPS network and MAPS AS/400 central server, assess and audit PIA's post-incident corrective measures and internal security audit plan. Accomplishments: This audit involves over ten disparate technologies but the specifics cannot be revealed in order to protect PIA security interests.. Tools utilized are the Microsoft Network Monitor (and other protocol analyzers), GASP, ISS, and Pentasafe's line of security tools. Project Experience ------------------ 11/99-5/00: Security Consulting for the New Medi-Cal System, Logicon Client: California Department of Health Services (DHS) -------------------------------------------------------------------- Responsibilities: Team Lead directing technical execution and design developing security procedures and plans for the MIS/DSS Medi-Cal project to thwart existing losses due to fraud. Develop a Security Management Implementation Plan for security procedures, development requirements, security controls, audit trails, and intrusion detection. Conduct security audits for all internal and external threats. Proposed a strategy for an immediate significant improvement in overall security for all of DHS. Accomplishments: Security improvements proposed to help protect up to $20 billion passed through the system to providers and beneficiaries, also protecting sensitive patient, provider, and benefits records centrally stored in Medi-Cal's data warehouse. HIPAA standards where analyzed to help guide requirements. Provided a risk assessment methodology identifying project assets and threats providing a return-on-investment analysis of security measures and controls. This methodology provides for emphasis on controls for development and production environments including configuration management and disaster recovery. Project Experience ------------------ 7/99-10/99: Project Oversight Services for HWTS, Logicon Client: California Department of Toxic Substances Control (DTSC) ---------------------------------------------------------------- Responsibilities: Provide project oversight support in the procurement phase for the Hazardous Waste Tracking System (HWTS) project to replace the antiquated California Haznet system. Accomplishments: Developed a draft Request for Proposal (RFP) for the solicitation for development of HWTS. Developed detailed technical requirements and evaluation criteria for the RFP based upon initial vender proposals and DTSC department goals. HWTS architecture proposed as a public Internet accessible web-based, multi-tier solution: developed detailed technical requirements representing sensitive security issues of department architecture including security for DTSC intranet and database. Project Experience ------------------ 7/99-9/99: Project Oversight Services for DSS Adoptions Subsystem, Logicon Client: California Department of Social Service (DSS) -------------------------------------------------------------------------- Responsibilities: Provide project oversight support in the procurement phase for the expanded Adoption Subsystem of the Child Welfare Services Case Management System (CWS/CMS). Accomplishments: Prepared costs estimates ($17 million) for functional requirements for the Feasibility Study Report (FSR) designing an estimation system analyzing historical data from past change requests. Project Experience ------------------ 2/99-5/99: SRS Assessment and Systems Engineering Support, Logicon Client: California Department of Justice (DOJ) ------------------------------------------------------------------ Responsibilities: Performed independent analysis of the software requirements specification for the DOJ National Sex Offender Registry (NSOR) project, an Oracle based software development project to transmit California violent criminals and sex offenders information to the Federal NCIC NSOR database. Accomplishments: Worked closely with requirements definition and Project Management vendors to correct several iterations of business and technical requirements for inadequate coverage, accuracy, and testability. Project Experience ------------------ 8/98-1/99: Electronic Fingerprint Transmission to DOJ, Logicon Client: California Department of Corrections and Department of Justice (CDC/DOJ) -------------------------------------------------------------------------------- Responsibilities: Project oversight and system engineering support for the Institutions Division Livescan electronic fingerprinting systems rollout to California Institution Reception Centers. Accomplishments: Provided project management support services facilitating design sessions and developed project schedules. Assisted designing several network architectures supporting secured communications networks for sensitive information. Project Experience ------------------ 2/98-3/99: Centralized California Parolee System, Logicon Client: California Department of Corrections (CDC) Parole and Community Services Division (P&CSD) -------------------------------------------------------------------------------- Responsibilities: Project oversight and systems engineering support services for the California Parolee Information Network (CPIN) project consisting of a team of roughly 20 managers and technical staff. Accomplishments: Provided technical leadership in middleware technologies, legacy web integration, development tool evaluation and selection, requirements definition, and detailed project scheduling. Maintained project schedules, the Project Management Plan and proposed a new cost-effective solution in the face of a departmental budget crisis including a low-cost thin client legacy web-enablement solution. Project Experience ------------------ 2/98-2/99: Project: Internet Web-Based Secure System, Logicon Client: California Department of Corrections (CDC) Parole and Community Services Division (P&CSD) -------------------------------------------------------------------------------- Responsibilities: Project oversight and systems engineering support services for the Parole Law Enforcement Automated Data System (Parole LEADS) project providing highly sensitive data to law enforcement through the public Internet. Accomplishments: Provided extensive technical assistance for this web-enabled application extension, including the evaluation of system security measures, identification or security risks, and provided guidance for developing scalable applications through N-tier architectures. In March 2000 I was asked to return to brief the Department Chief on security issues for the system. Project Experience ------------------ 10/96-12/97: CORBA/DCOM Middleware, New Product Development, Synergex --------------------------------------------------------------------- Responsibilities: Responsible for architecting a new product family and business channel for Synergex to break into new markets and move away from a legacy niche customer base. Evaluated technical and market feasibility for several new product proposals, including: modeling tool utilities, a pre-POA (Portable Object Adapter) CORBA vender abstraction tool, a global vender-independent CORBA name service, a Java RMI (Remote Method Invocation) bridge to abstract distributed components, and component licensing tools. Also managed a rush web-enablement development project. Accomplishments: Delivered technical designs, proposals the architecture for middleware that abstracts CORBA and DCOM distribution mechanisms utilizing Unified Modeling Language (UML), Rational Rose, and Requisite Pro. Designed for application developers to provide a substantial cost of development savings. It was also designed to support an extensible product family of more complex component management and security tools. Designed a "standards independence" tool providing component development, deployment, management, and security tools targeted at the abstract "component". Obtained an extensive background in distribution standards, Object Oriented (OO) modeling and design, and varied experience with development tools/middleware. Provided extensive market research for an OO modeling tool utility designed to create executive and technical documentation from models extracted from Rational Rose (competitor to Soda). Directed an inexperienced team to quickly deliver a Web development tool solution for Synergex's legacy customer base. Developed a sound architectural design based upon Java RMI (Remote Method Invocation) bridged to server resident Synergy legacy applications that could be delivered quickly. Ultimately delivered a fully functional, three-tier Web prototype six months early, instead of the smaller two-tier prototype originally planned. It made use of leading Java/Web development integrated with legacy business logic on NT, UNIX, and VMS servers. Project Experience ------------------ 8/94-9/96: Network Products Manager, Synergex --------------------------------------------- Responsibilities: Technical lead for all of Synergex's information security requirements and development. Managed and designed secure network development tools, a Microsoft Windows development team, and a serial communication management product. Accomplishments: Founded the Network Products Group in Software Development. Designed and managed the installation of two firewalls and designed firewall enabled products and product extensions. Delivered the first three stable releases of Synergex's IDE on Windows 95 and NT 3.5.1/4.0. Managed two interim releases of Synergex's IDE on UNIX and VMS. Released first version of a new 2-tier TCP/IP product. Piloted a cross-functional software testing effort that fueled the development of Synergex's new Quality Improvement group. Designed the Synergex Knowledge Base, Intranet Web infrastructure, and external web security policies and procedures. Project Experience ------------------ 9/92-7/94: Systems Software Engineer, Integrated Development, Synergex ---------------------------------------------------------------------- Responsibilities: Ported Synergex's IDE to many platforms. In charge of all VAX and AXP VMS clustered development systems including automated quality control for distributions, development environments, administration, and networking configurations. Design and implement feature enhancements and bug fixes. Accomplishments: Researched, designed, and implemented Synergex's first proprietary firewalls providing web and email access via T1 to the Internet. Configuration included the acquisition of three class C Internet domains, domain name, DNS servers, sendmail, proxy servers, Livingston routers, and POP3 servers. Implemented Synergex's first email capabilities via UUCP. Designed and implemented significant enhancements including error processing subsystems, debugger features, and supporting the extensive RMS file system support within Synergex's IDE (RMS on VMS). Ported Synergex's IDE from VMS AXP to VMS VAX using DEC C and UCX for networking. Ported a newer major revision of Synergex's IDE from UNIX to AXP VMS and AXP Digital UNIX and yet another to Digital UNIX, SCO UNIX, Linux, and AIX.