Application security and coding requirements

Zero-day exploits increasingly sought out by attackers

Threat actors increasingly favour zero-day exploits to attack their victims before patches become available, according to the NCSC and CISA, which have just published a list of the most widely used vulnerabilities of 2023 Continue Reading

By

• Alex Scroxton, Security Editor

Innovating with weather data at the Met Office

In this week’s Computer Weekly, we find out how the Met Office is using its vast stores of weather data to create innovative new products. Our latest buyer’s guide looks into identity and access management systems. And we examine the geopolitical threats that could curb the openness of open source. Read the issue now. Continue Reading

Virtual collaboration within and across industries – promises and challenges

New technologies enable intuitive and realistic visual and auditory landscapes that put users within applications. We look at which industries will likely illustrate the impact of virtual collaboration in commercial environments Continue Reading

By

• Martin Schwirn, Computer Weekly

Inside Google Cloud’s secure AI framework

Google Cloud’s secure AI framework that’s integrated into its Vertex AI platform offers practical tools and guidance to manage the lifecycle, data governance and operational risks of AI Continue Reading

By

• Aaron Tan, TechTarget

Dutch critical infrastructure at risk despite high leadership confidence

Stark paradox in Dutch cyber security landscape has business leaders expressing high confidence in their IT infrastructure as cyber attacks rise Continue Reading

By

• Kim Loohuis

Danish government reboots cyber security council amid AI expansion

Denmark’s government relaunches digital security initiative to protect business sectors and society at large Continue Reading

By

• Gerard O'Dwyer

Can AI be secure? Experts discuss emerging threats and AI safety

International cyber security experts call for global cooperation and proactive strategies to address the security challenges posed by artificial intelligence Continue Reading

By

• Aaron Tan, TechTarget

Reinventing security operations for the modern threat landscape

The growing pace of digital transformation has opened new avenues for attackers, making traditional security measures obsolete. Organisations must modernise their security operations to fortify their defences and navigate the evolving threat landscape Continue Reading

By

• Aaron Tan, TechTarget

How Zoom is charting its course towards an AI-first platform

Zoom CEO Eric Yuan talks up his vision for the future of work, the company's transition to an AI-powered platform and what it is doing to stay ahead of rivals Continue Reading

By

• Aaron Tan, TechTarget

Five zero-days to be fixed on October Patch Tuesday

Stand-out vulnerabilities in Microsoft’s latest Patch Tuesday drop include problems in Microsoft Management Console and the Windows MSHTML Platform Continue Reading

By

• Alex Scroxton, Security Editor

Cups Linux printing bugs open door to DDoS attacks, says Akamai

The Cups Linux printing vulnerabilities disclosed at the end of September would seem to have a nasty sting in their tail, according to researchers at Akamai Continue Reading

By

• Alex Scroxton, Security Editor

The cyber industry needs to accept it can't eliminate risk

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Paul Lewis, Nominet

Printing vulnerability affecting Linux distros raises alarm

Security pros need to get in front of a series of vulnerabilities affecting the Cups Linux printing service after an apparently botched disclosure process saw technical details published in advance of a patch Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike apologises to US government for global mega-outage

CrowdStrike executive Adam Meyers appears before a US government committee to explain the series of errors that led directly to one of the biggest IT outages in history Continue Reading

By

• Alex Scroxton, Security Editor

Splunk and Cisco integration moving apace

Splunk is rapidly integrating with Cisco’s technology to enable seamless transitions between their platforms while delivering advanced threat detection capabilities Continue Reading

By

• Aaron Tan, TechTarget

Microsoft shares progress on Secure Future Initiative

Microsoft has published a progress report on its Secure Future Initiative, launched last year in the wake of multiple security incidents, and made a series of commitments to improve its internal cyber culture Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Win back lost trust by working smarter

The Computer Weekly Security Think Tank panel considers incident response in the wake of the July CrowdStrike incident, sharing their views on what CrowdStrike got wrong, what it did right, and next steps Continue Reading

By

• Vladimir Jirasek, Foresight Cyber

Gartner: Mitigating security threats in AI agents

Agents represent a step-change in the use of artificial intelligence in the enterprise - as attendees at Salesforce's annual conference saw first hand this month - but do not come without their risks Continue Reading

By

• Avivah Litan, Gartner

First CyberBoost Catalyse startup cohort named

The first group of companies named to a cyber incubator programme run by Plexal and the National University of Singapore includes two growing UK businesses Continue Reading

By

• Alex Scroxton, Security Editor

Cyber workforce must almost double to meet global talent need

Research from ISC2 finds global cyber workforce needs additional 4.8 million people to fully secure businesses Continue Reading

By

• Clare McDonald, Business Editor

How Sonar is elevating code quality in the age of AI

Sonar’s code quality platform helps developers maintain secure, high-quality code amid the rise of artificial intelligence-based coding assistants, now expanding into the Asian market Continue Reading

By

• Aaron Tan, TechTarget

JFrog and GitHub unveil open source security integrations

Secure software specialist JFrog is working with code development service GitHub to integrate the onboard capabilities of its Software Supply Chain Platform service into GitHub’s platform Continue Reading

By

• Alex Scroxton, Security Editor

Multiple Veeam vulns spark concern among defenders

Veeam users are urged to patch a series of vulnerabilities in the firm’s Backup & Replication product to get out ahead of potential exploitation by ransomware gangs Continue Reading

By

• Alex Scroxton, Security Editor

PyPI loophole puts thousands of packages at risk of compromise

Thousands of PyPI packages are at risk of an attack technique dubbed Revival Hijack, which exploits a loophole in the platform’s package naming feature Continue Reading

By

• Alex Scroxton, Security Editor

Study highlights secure software supply chain best practices

Security trends report from open source firm shows the approaches IT leaders take to secure their software supply chain Continue Reading

By

• Cliff Saran, Managing Editor

Global cyber spend to rise 15% in 2025, pushed along by AI

Security spending will increase at pace in 2025, with artificial intelligence, cloud and consultancy services all pushing outlay to new highs, according to Gartner Continue Reading

By

• Alex Scroxton, Security Editor

How to avoid joining the Dead Java Code Society

Unused or dead Java code is bogging down software engineers and developers, causing weird dependencies and security risks Continue Reading

Challenges of deploying PQC globally

Quantum computers will eventually be powerful and reliable enough to crack strong encryption. PQC is the answer, but it could take years to deploy Continue Reading

By

• Cliff Saran, Managing Editor

Popular Microsoft apps for Mac at risk of code injection attacks

Researchers at Cisco Talos turn up evidence suggesting that Microsoft apps running on the Apple macOS operating system are not as secure as they seem Continue Reading

By

• Alex Scroxton, Security Editor

User mode vs. kernel mode: OSes explained

Kernel mode exists to keep user applications from disrupting critical system functions. Learn how each state works and what can happen when an error occurs in kernel mode. Continue Reading

By

• Ben Lutkevich, Site Editor

Thousands of NetSuite customers accidentally exposing their data

Misconfigured permissions across live websites are leaving thousands of NetSuite users open to having their valuable customer data stolen, researchers say Continue Reading

By

• Alex Scroxton, Security Editor

August Patch Tuesday proves busy with six zero-days to fix

Microsoft patches six actively exploited zero-days among over 100 issues during its regular monthly update Continue Reading

By

• Alex Scroxton, Security Editor

NIST debuts three quantum-safe encryption algorithms

NIST has launched the first three quantum-resistant encryption algorithms, and as the threat of quantum-enabled cyber attacks grows greater, organisations are encouraged to adopt them as soon as they can Continue Reading

By

• Alex Scroxton, Security Editor

Forrester: Rethink your software asset management practices

Software as a service needs to be managed as part of software asset management. Forrester analysts offer some practical advice on how to succeed Continue Reading

By

• Biswajeet Mahapatra

Deep dive into quantum-resistant cryptography for email security

Quantum computers have the potential to crack many of the encryption methods we currently rely on to keep our digital communications safe. Quantum-resistant cryptography may be the answer Continue Reading

By

• Isla Sibanda

Microsoft and CrowdStrike hit back at Delta’s legal threats

Microsoft and CrowdStrike have rejected claims by Delta Air Lines that it was left high and dry amid thousands of flight cancellations during July’s software outage, accusing the airline of ignoring their offers of help and running out-of-date IT systems Continue Reading

By

• Alex Scroxton, Security Editor

2024 seeing more CVEs than ever before, but few are weaponised

The number of disclosed CVEs soared by 30% in the first seven-and-a-half months of the year, but a tiny fraction of these have been exploited by threat actors, a reminder of the importance of focused security strategies Continue Reading

By

• Alex Scroxton, Security Editor

Chinese cyber attack sparks alert over six-year-old MS vuln

After a proof-of-concept for a six-year-old Microsoft vulnerability emerged in a Chinese APT attack chain, defenders should be on the look-out for exploitation of CVE-2018-0824 Continue Reading

By

• Alex Scroxton, Security Editor

How CrowdStrike is leveraging AI to empower security teams

CrowdStrike CTO Elia Zaitsev explains how the company’s multi-agent AI architecture can help to enhance analyst efficiency and tackle cyber security challenges Continue Reading

By

• Aaron Tan, TechTarget

CrowdStrike shareholders sue, alleging false security claims

A US pension fund is lining up a lawsuit against CrowdStrike, claiming the cyber company lied about the integrity of its systems, leading to failings that caused a worldwide IT outage Continue Reading

By

• Alex Scroxton, Security Editor

API attacks surge by 65% in APAC, fuelled by rapid digitisation

Akamai's report reveals a significant rise in cyber attacks on web applications and APIs in the region over the past year, with financial and commerce sectors hardest hit Continue Reading

By

• Aaron Tan, TechTarget

CrowdStrike blue screen bug serves a stark warning

In this week’s Computer Weekly, we analyse the lessons from the global IT outage caused by the blue screen bug in CrowdStrike security software. We talk to the data chief of Barilla, the €4bn pasta maker, about the benefits of asking, “So what?” And we find out how Finland is taking a lead on quantum computing. Read the issue now. Continue Reading

CrowdStrike update chaos explained: What you need to know

A botched software update at cyber security firm CrowdStrike has caused IT chaos around the world. Learn more about the global CrowdStrike update outage as it develops Continue Reading

By

• Alex Scroxton, Security Editor

Scam CrowdStrike domains growing in volume

Hundreds of malicious domains exploiting CrowdStrike’s branding are appearing all over the web in the wake of the 19 July outage. Experts from Akamai share some noteworthy examples, along with guidance on how to avoid getting caught out Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike says most Falcon sensors now up and running

The vast majority of CrowdStrike Falcon sensors affected by a coding error have now been recovered, with a final resolution expected this week Continue Reading

By

• Alex Scroxton, Security Editor

Why is CrowdStrike allowed to run in the Windows kernel?

Microsoft has pointed the finger at EU regulators, blaming them for a ruling that means it needs to offer third parties access to the core Windows OS Continue Reading

By

• Cliff Saran, Managing Editor

CrowdStrike blames outage on content configuration update

CrowdStrike publishes the preliminary findings of what will be a lengthy investigation into the root causes of the failed 19 July update that caused Windows computers to crash all over the world Continue Reading

By

• Alex Scroxton, Security Editor

CrowdStrike chaos: Enterprises urged to take protective action in wake of botched software update

Enterprises that emerged unscathed from the roll-out of the botched CrowdStrike software update are being urged to view it as a wake-up call rather than a lucky escape Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Innovations to power secure-by-design development

Secure Code Warrior unveils technology designed to help CISOs and AppSec teams ensure their projects remain safe and free of coding errors and vulnerabilities – a big issue following the CrowdStrike incident Continue Reading

By

• Alex Scroxton, Security Editor

Why did CrowdStrike cause the Windows Blue Screen?

The ‘blue screen of death’ signals a catastrophic Windows failure, which is exactly what many people faced on 19 July 2024 – but why did it happen? Continue Reading

By

• Cliff Saran, Managing Editor

CrowdStrike chaos shows risks of concentrated ‘big IT’

The concentration of so much mission-critical technology in the hands of a few large suppliers makes incidents like the Microsoft-CrowdStrike outage all the more dangerous Continue Reading

By

• Alex Scroxton, Security Editor

Incubator Plexal heads to Singapore for CyberBoost

Cyber startup hub Plexal expands its presence to Singapore through a new initiative, and sets its sights on helping new UK businesses break into the booming Asia-Pacific market Continue Reading

By

• Alex Scroxton, Security Editor

How Snowflake is tackling AI challenges

Snowflake’s regional leader Sanjay Deshmukh outlines how the company is helping customers to tackle the security, skills and cost challenges of AI implementations Continue Reading

By

• Aaron Tan, TechTarget

Dutch research firm TNO pictures the SOC of the future

In only a few years, security operations centres will have a different design and layout, and far fewer will remain Continue Reading

By

• Kim Loohius

Hyper-V zero-day stands out on a busy Patch Tuesday

Microsoft has fixed almost 140 vulnerabilities in its latest monthly update, with a Hyper-V zero-day singled out for urgent attention Continue Reading

By

• Alex Scroxton, Security Editor

Black Basta ransomware crew may be exploiting Microsoft zero-day

A Microsoft vulnerability that was addressed without fanfare in March may in fact have been exploited as a zero-day by the notorious Black Basta ransomware gang, threat hunters warn Continue Reading

By

• Alex Scroxton, Security Editor

Best practices to beat container misconfiguration

How can organisations ensure containerised environments are configured correctly and adequately defended, without getting lost in the complexity? Continue Reading

By

• Fleur Doidge

Building a more secure, and sustainable, open source ecosystem

In April 2024, the discovery of an intentionally-placed backdoor in the open source XZ Utils data compression caused concern. Sentry's Chad Whitacre says a more thoughtful approach is needed to balance the individual freedom and creativity of open source, with more rigorous security practice. Continue Reading

By

• Chad Whitacre

How to avoid joining the Dead Java Code Society

Unused or dead Java code is bogging down software engineers and developers, causing weird dependencies and security risks. Eric Costlow of Azul shares some advice on how to avoid becoming a member of a rather unpleasant club Continue Reading

By

• Eric Costlow

Critical SharePoint, Qakbot-linked flaws focus of May Patch Tuesday

A critical SharePoint vulnerability warrants attention this month, but it is another flaw that seems to be linked to the infamous Qakbot malware that is drawing attention Continue Reading

By

• Alex Scroxton, Security Editor

Government focuses on improving AI security

Two codes of practice are now available to help developers boost the security of their AI applications Continue Reading

By

• Cliff Saran, Managing Editor

Microsoft beefs up cyber initiative after hard-hitting US report

Microsoft is expanding its recently launched Secure Future Initiative in the wake of a hard-hitting US government report on recent nation state intrusions into its systems Continue Reading

By

• Alex Scroxton, Security Editor

Adobe expands bug bounty programme to account for GenAI

Adobe has expanded the scope of its HackerOne-driven bug bounty scheme to incorporate flaws and risks arising from the development of generative artificial intelligence Continue Reading

By

• Alex Scroxton, Security Editor

Patch GitLab vuln without delay, users warned

The addition of a serious vulnerability in the GitLab open source platform to CISA’s KEV catalogue prompts a flurry of concern Continue Reading

By

• Alex Scroxton, Security Editor

How Okta is fending off identity-based attacks

Okta has been bolstering the security of its own infrastructure and building new tools to scan customer environments for vulnerable identities, among other efforts to fend off identity-based attacks Continue Reading

By

• Aaron Tan, TechTarget

Australia’s Qantas apologises for mobile app data breach

Australian flag carrier Qantas has apologised after a glitch in its mobile application temporarily enabled some customers to view the flights and booking details of other frequent fliers on two separate occasions Continue Reading

By

• Alex Scroxton, Security Editor

Secure coding benchmark to increase standards among developers

Developer security advocate Secure Code Warrior has launched what it claims is the industry’s first benchmark designed to quantify the security competence of its customers’ software developer teams Continue Reading

By

• Alex Scroxton, Security Editor

Zero trust is a strategy, not a technology

Zero-trust security should be seen as a strategy to protect high-value assets and is not tied to a specific technology or product, says the model’s creator John Kindervag Continue Reading

By

• Aaron Tan, TechTarget

Mandatory MFA pays off for GitHub and OSS community

Mandating multifactor authentication for select developers has been a huge success for GitHub, the platform reports, and now it wants to go further Continue Reading

By

• Alex Scroxton, Security Editor

CSA warns of emerging security risks with cloud and AI

Few users appreciate the security risks of cloud and have the expertise to implement the complex security controls, says CSA chief executive David Koh Continue Reading

By

• Aaron Tan, TechTarget

CW Innovation Awards: Balancing security and user experience

The National University of Singapore’s Safe initiative has strengthened the security of IT systems and end-user devices while prioritising user experience through passwordless access Continue Reading

By

• Edwin Yapp

More social engineering attacks on open source projects observed

In the wake of the recent XZ Utils scare, maintainers of another open source project have come forward to say they may have experienced similar social engineering attacks Continue Reading

By

• Alex Scroxton, Security Editor

Cyber crooks poison GitHub search to fool developers

Researchers share data on new technique whereby malicious actors are manipulating GitHub’s search function and using cleverly crafted repositories to distribute malware Continue Reading

By

• Alex Scroxton, Security Editor

Salesforce helps customers establish bug bounty programmes

Salesforce has added new learning content to its Trailhead platform designed to help customers develop their own bug bounty programmes Continue Reading

By

• Alex Scroxton, Security Editor

How Prospect Theory helps us understand software disasters

By understanding the human psychology behind IT system failures that directly impact people, we can better protect ourselves Continue Reading

By

• Junade Ali

How Oracle Red Bull Racing guards against cyber threats

The F1 team is tapping managed security services, conducting penetration tests and improving security awareness among employees to fend off cyber threats such as phishing and ransomware Continue Reading

By

• Stephen Withers

Open source alert over intentionally placed backdoor

A backdoor in the open source XZ Utils data compression library could have led to widespread compromise across the Linux ecosystem - and the community is on the trail of a developer who seems to be behind it Continue Reading

By

• Alex Scroxton, Security Editor

Cyber spies, not cyber criminals, behind most zero-day exploitation

Analysis from Google has found that zero-day vulnerabilities are much more heavily exploited for espionage purposes than for financially motivated cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Apple, Meta and Alphabet under EU scrutiny

Under the new Digital Markets Act, European commissioners are looking at potential issues with the way Apple, Alphabet and Meta operate their platforms Continue Reading

By

• Cliff Saran, Managing Editor

US sues Apple, alleging smartphone monopoly

A major legal action against Apple over its dominance of the smartphone market has kicked off in the US, alleging anticompetitive practices on Apple’s part that have damaged the sector and restricted consumer choice Continue Reading

By

• Alex Scroxton, Security Editor

EMEA security spend will have another boom year in 2024

Cyber security services and technology will once again be the focus of major investment across EMEA during 2024, according to the latest Technology Spending Intentions study from TechTarget and ESG Continue Reading

By

• Alex Scroxton, Security Editor

Australia’s cyber security spending to grow 11.5% this year

Highly publicised cyber attacks and growing regulatory obligations are keeping security and risk top of mind for Australian organisations this year, says Gartner Continue Reading

By

• Aaron Tan, TechTarget

March Patch Tuesday throws up two critical Hyper-V flaws

Two critical vulnerabilities in Windows Hyper-V stand out on an otherwise unremarkable Patch Tuesday Continue Reading

By

• Alex Scroxton, Security Editor

OSS leaders detail commitments to bolster software security

CISA has announced a number of actions to help secure the global open source ecosystem, as leading package repositories including the Python and Rust foundations advance their own initiatives Continue Reading

By

• Alex Scroxton, Security Editor

Rapid7 hits out over botched vulnerability disclosure

Software development firm JetBrains and security specialist Rapid7 fall out over the handling of a critical vulnerability disclosure, while customers are left rushing to patch Continue Reading

By

• Alex Scroxton, Security Editor

IT chiefs fear Kubernetes data log overload

IT architectures are set to grow in complexity, and more mission-critical systems are being deployed on Kubernetes, meaning log files are becoming unmanageable Continue Reading

By

• Cliff Saran, Managing Editor

VulnCheck bug listing to help track new threats quicker

Exploit intelligence firm VulnCheck launches a proprietary Known Exploited Vulnerabilities catalogue in hopes of improving end-user access to intel on emerging threats and reaching those that the likes of CISA do not Continue Reading

By

• Alex Scroxton, Security Editor

Cyber experts alarmed by ‘trivial’ ConnectWise vulns

The disclosure of two dangerous vulnerabilities in the popular ConnectWise ScreenConnect product is drawing comparisons with major cyber incidents, including the 2021 Kaseya attack Continue Reading

By

• Alex Scroxton, Security Editor

Inside LockBit: A ransomware gang in decline?

The LockBit ransomware gang was already on the ropes prior to the NCA-led takedown, according to security researchers Continue Reading

By

• Alex Scroxton, Security Editor

CVE volumes set to increase 25% this year

The number of reported Common Vulnerabilities and Exposures is likely to grow significantly in 2024, hitting a new high of almost 35,000, according to Coalition, a cyber insurance specialist Continue Reading

By

• Alex Scroxton, Security Editor

Security-by-design push prompts new ISC2 accreditations

Security-by-design has become a hot-button regulatory issue. ISC2 has decided now is the time to upskill cyber pros around these vital software and hardware development principles Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft: Nation-state hackers are exploiting ChatGPT

Threat actors from China, Iran, North Korea and Russia have all been probing use cases for generative AI service ChatGPT, but have yet to use such tools in a full-blown cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches two zero-days for Valentine’s Day

Two security feature bypasses impacting Microsoft SmartScreen are on the February Patch Tuesday docket, among more than 70 issues Continue Reading

By

• Alex Scroxton, Security Editor

New variants of Qakbot malware under development

Despite its infrastructure having been taken down by the FBI last year, someone appears to be actively working on a new and improved version of the infamous Qakbot malware Continue Reading

By

• Alex Scroxton, Security Editor

Hunter-killer malware volumes seen surging

Latest Picus Security report on malware tactics, techniques and procedures reveals an increasing focus on disabling security defences Continue Reading

By

• Alex Scroxton, Security Editor

MoD ethical hacking programme expands after initial success

The Ministry of Defence has expanded the scope of its defensive security partnership with HackerOne Continue Reading

By

• Alex Scroxton, Security Editor

Defra legacy IT: 180 applications refreshed, over 1,500 remain

The Department for Environment, Food and Rural Affairs has a 10-year plan to update technology. So far, 180 have been replaced or updated Continue Reading

By

• Cliff Saran, Managing Editor

Low Code Hits New High - Results Of A New Survey

Had a really interesting conversation the other day with Adrian Bignall, he who is in charge of International Sales at Evoke Technologies. Evoke is a rather large tech consultancy that only ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Bugcrowd sees surge in vulnerability submissions, led by public sector

Crowdsourced vulnerability disclosure and bug bounty platform Bugcrowd says it saw a 151% uptick in submissions related to government and public sector organisations in 2023 Continue Reading

By

• Alex Scroxton, Security Editor

WebKit vulnerability sparks Apple’s first major security update of 2024

A zero-day in the open source WebKit browser engine that powers Safari has sparked Apple’s first major patch roll-out of the new year Continue Reading

By

• Alex Scroxton, Security Editor