Since 1997 I have been contributing to the information security field for fun and profit. (cit)
Since then, I have cultivated profound and broad knowledge of different information security domains and obtained few professional certifications (COBIT®5(F), CISM, CISSP-ISSAP, CISSP, CCSP, CSSLP, CSPO, CSM).
My career took me from a start-up to mastodontic corporations, from niche sectors (lawful interception) to economy driving areas (defence, oil and gas, and finance) and also to the North Atlantic Treaty Organization (NATO).
From April 2018, I am going to attend an MSc in Leadership, Innovation and Technology delivered by School of Management, College of Business, DIT backing my deep technical knowledge with formal education on management and business, developing so the unique combination of technical, leadership, and business abilities needed in modern information security leaders.
In my free time, I'm an OWASP, Free and Open Source Software contributor, (occasional) speaker and last but not least I pretend to be a rock climber.
Likes: | cybersecurity software-security application-security network-security architecture security-program |
I am currently responsible for articulating, defining and overseeing the execution of UBS's global cybersecurity strategy (on-premise, on Azure).
The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible, so that individuals and organizations are able to make informed decisions. OWASP is in a unique position to provide impartial, practical information about AppSec to individuals, corporations, universities, government agencies and other organizations worldwide. Operating as a community of like-minded professionals, OWASP issues software tools and knowledge-based documentation on application security.
I've been an OWASP member since 2012. Starting from roughly 2015 I started to be more and more involved in few global and local OWASP projects and initiatives.
2017-05: Public Presentation on WannaCry (https://www.slideshare.net/rmartelloni/wannacry-no-thanks)
2017-04: Public Presentation about OWASP TOP 10 at .NET meetup
2017-01: My interview published on Il Giornale (major Italian language daily newspaper), about EyePyramid, a malware used to attack Italian prime minister and other major political player in Italy. (http://www.ilgiornale.it/news/politica/crimine-ormai-buca-rete-tecnologia-lunica-difesa-1351041.html)
2016-04: Pro bono publico contributor of Cppcheck (https://cppcheck.sourceforge.net) secure static analysis tool for C/C++ code. Introduced CWE v2.9 (https://cwe.mitre.org/) mapping for over 300 weakness found by the tool and obtained CWE MITRE'S compatibility claim (https://cwe.mitre.org/compatible/index.html).
2015-09 : Improvement of checksec tool. Tool to check executable properties like (PIE, RELRO, PaX, Canaries, ASLR, Fortify Source
2012-07: Patch to enhance the archive mode of Suricata IDS (http://suricata-ids.org/) to minimize packet loss and contain storage costs.
2004-08: Release to the general public of Bluernarfer tool. At the time of the release, it was capable of attacking and compromising the whole content ( phone book, sms, personal note and more ) of more than twenty phone on the market ranging from Nokia to Sony-Ericsoon. With it was also possible to get total remote control of the phone. The tool and a related Italian article was released on a well know, 10 years old, Italian security ezine “Butchered From the Inside” issued from a well know old-school security Italian organisation S0ftpj ( http://www.s0ftpj.org/en/site.html ). The article with other was also printed as “BFI special printed edition” and distributed at the MOCA for the 10-year summer camp for the organisation "Metro Olografix" ( http://www.olografix.org/ )
Citigroup Inc. or Citi is an American multinational investment banking and financial services corporation. It is the third-largest bank holding company in the US by assets. Its largest shareholders include funds from the Middle East and Singapore. It holds over 200 million customer accounts in more than 140 countries.
Focusing my efforts on risk management, systems architecture, systems requirements planning, technology R&D I'm supporting the business in its 2016-2020 global mobile-first strategy with the responsibility of securely provision solutions collaborating on a daily base across the globe with high distribute teams.
Within CITI I:
Reviewed information security architecture, authorization, assurance documents, and product roadmap to confirm that the level of risk is within acceptable limits and in compliance with policy & standards for:
Rewrote from zero the security compliance and assessment global process to approve unmanaged BYOD devices using the NIST Mobile Threat Catalog, and CVSS. The effort needed to run the process has been reduced to less than 6 days while it used to last up to 3 months.
Elicited and analyzed business requirements to substitute Board Vantage designing a solution that includes box.com, IonicSecurity, and a CASB.
Presented at "The 6th Annual Digital Banking & Mobile Payments Summit" (April 2017, Vienna) a deck titled IoT, Point Of Sales And Mobile devices, different names, same Information Security & Privacy concerns
In CITI I also volunteered to be in Dublin CITI Root Network, a network focused on celebrating ethnic, and cultural diversity organizing events, language courses and more. So far I organized the celebration for the Bastille Day and German language classes for a total of about 50 people.
Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) instructor.
CISM domains covered during the classes:
CISSP domains covered during the classes:
Verifone is the worldwide leading provider of point-of-sale technology for electronic payment transactions and value-added services in financial, retail, hospitality, petroleum, government, and healthcare industries.
I worked with teams all over Europe, the Middle East, India, China and the US on strategical, compliance, and architectural duties.
Strategical achievements
Compliance achievements
Architectural/Hands-on achievements/tasks
Employer www.techub.it, customer Eni.com
Eni S.p.A. is an Italian multinational oil and gas company. It has operations in 79 countries and is currently world's 11th largest industrial company with a market capitalization of 68 billion euros (US$ 90 billion) and more than 70 thousand employees (~20th in global fortune 500)
Information Security Manager of a team of ethical hackers.
I managed resources, timelines, overall scheduling and interactions with different (>10) internal and external development groups to ensure overall security of web applications through the execution of web vulnerability assessments and subsequently providing necessary guidance to succeed in the remediation of all vulnerabilities found.
Our approval was necessary to deploy the web app in production.
Cyberlabs is the Cyber Security laboratory of Selex-Es a Finmeccanica subsidiary. Finmeccanica holding is the leading industrial group in the high technology sector in Italy and one of the main global players in aerospace, defence and security.
Playing different leading and not leading roles in small teams of three to five persons I've:
DIGINT was the old name of CyberLabs before Selex-ES merge.
Playing different roles in small teams of three to five persons I've:
The core business of Ikon-Corp startup was to support the Italian Army Forces and secret service in all lawful interception related activities with bespoke software solutions and associated services.
The area of research & development were around the engineering and architecting of * high-performance packet sniffing solutions on Linux or FreeBSD.
The research was focused on maximise throughput and minimise packets loss tweaking IRQ-balancing, CPU-affinity, memory and I/O schedulers, network drivers, sysctl options and using not mainline Linux Kernel patches like PFRING or Real Time patches.
The development was focused on the development of high performance: * Ethernet lawful interception sniffer on Linux and FreeBSD and in the decoding of IPv4, TCP/UDP and radius. * high performance TCP/IPv4 flow re-constructor to record all traffic in a proprietary file format and allow Windows client software to view reconstructed network traffic.
Among other tasks and duties I've done I've also: * Engineered a ARP poisoning attack detector * Administering a Wan of 50 high availability Debian Gnu/Linux systems using OpenVPN to remote capture IPv4 traffic circulating within the Italian Critical Infrastructure that manage phone lawful interception
I've start to work as Debian Gnu/Linux system administration of Internet services and internal LAN.
I had the responsibility to support the senior administrator and manage service like apache, bind, samba, proftpd, vsftpd, openssh, cups, postfix, qmail, netfilter (iptables) and more.
I had also the responsibility to solve windows client issue and problem and in general solve all IT related problem on client and server machine.
Please note that in addition to the following courses, to hold in good standing my professional certifications I have to attend 70h years of courses and/or workshops as part of the continuous professional education requirements of the certifications.
2017 Attended courses
2016 Attended courses
Certified Information Security Manager - SkillSoft - Online course, 40 hours
Bitcoin and Cryptocurrency Technologies - Princeton University - Coursera online course. 7 weeks, 3-6 hours/week. Syllabus https://www.coursera.org/learn/cryptocurrency
Cyberwar, Surveillance and Security University of Adelaide - edX online course. 6 weeks, 2-3 hours/week. Syllabus https://www.edx.org/course/cyberwar-surveillance-security-adelaidex-cyber101x-0#!
2013 Attended courses
1 week, 8 hours/day on-site course.
Repositories that I own or on which I contributed:
Despite my long inactivity on the blog, it's true that behind the scene I'm still active.
Recently among the other I read a paper that need some attention: Memory Errors: The Past, the Present, and the Future
How to use Suricata 1.3 IDP with Unified2 alarms and AlienVault 4.0 (OSSIM)
If you, like me, want to have an overview on "Automated Dynamic Malware Analysis Techniques and Tools" I suggest to read "Manuel Egele, Theodoor Scholte, Engin Kirda, Christopher Kruegel, A Survey on Automated Dynamic Malware Analysis Techniques and Tools, ACM Computing Surveys Journal, Volume 44 Issue 2, February 2012"
First Computer: | C64 |
Favorite Editor: | Vim, SublimeText, Pycharm, Eclipse |