Hackers and cybercrime prevention

BACnet IoT building automation devices vulnerable to attack

A security researcher has revealed that internet-connected building automating devices using the BACnet communication protocol are vulnerable to cyber attack Continue Reading

By

• Warwick Ashford, Senior analyst

Cisco pays $8.6m after whistleblower discloses security flaws in video surveillance system

James Glenn, a video surveillance expert working for a Cisco reseller in Denmark, alerted Cisco to security faults and stands to gain a share of a multimillion-dollar settlement with the US government. Continue Reading

How tech experts could earn millions as whistleblowers

In this week’s Computer Weekly, a tech expert is set to earn millions after successfully blowing the whistle on vulnerabilities in Cisco’s video surveillance software. Our latest buyer’s guide examines the issues around big data architecture. And we look at how the end of Windows 7 could spark a new era for desktop productivity. Read the issue now. Continue Reading

Phishing top security threat to business

A new Telefónica security service for business shows that phishing is the most-blocked threat and smaller businesses are a popular attack target in the first two months of deployment Continue Reading

By

• Warwick Ashford, Senior analyst

Digital transformation driving security rethink

Organisations are focusing on internet of things and cloud in developing cyber defence systems, study shows Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Balancing data accessibility with security controls

How can infosec pros and data architects work together to support business goals and achieve a good level of cyber security? Continue Reading

By

• Simon Persin, Turnkey Consulting

McAfee warns of serious security flaw in building controller

Security researchers have demonstrated how simple flaws in building controllers could allow malicious actors to manipulate control systems with devastating effect, highlighting the importance of operational technology security Continue Reading

By

• Warwick Ashford, Senior analyst

F-Secure warns of F5 Big IP-related security issue

F-Secure has discovered security issues relating to an F5 device that it says could potentially turn hundreds of thousands of load balancers into beachheads for cyber attacks Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Communication, processes and tech: A new beginning for security

How can infosec pros and data architects work together to support business goals and achieve a good level of cyber security? Continue Reading

By

• Ramsés Gallego, Isaca

NCC Group warns of security risks of leading printers

Researchers uncover more than 35 vulnerabilities in six leading enterprise printers, many of which could allow access to corporate networks, underlining the need to counter security risks of embedded systems Continue Reading

By

• Warwick Ashford, Senior analyst

Whistleblowers: James Glenn’s battle with Cisco opens new front on cyber security

James Glenn, a 42-year-old security specialist, fought a 10-year legal battle with Cisco after blowing the whistle on serious security flaws. He lost his job, but has no regrets Continue Reading

By

• Bill Goodwin, Computer Weekly

Ransomware a continued threat to business, report warns

Businesses are increasingly becoming the most popular targets for ransomware, which remains a top cyber threat around the world, especially in the US, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Cyber criminals hijacking legitimate website comms

Criminals are exploiting firms’ use of online feedback methods to distribute spam and phishing emails, security researchers warn Continue Reading

By

• Warwick Ashford, Senior analyst

Can you trust pen-testers?

Pen-testers have knowingly posted security workarounds on the public internet that are now commonly used by hackers Continue Reading

By

• Cliff Saran, Managing Editor

Security Think Tank: Security is a business, not an IT function

How can infosec pros and data architects work together to support business goals and achieve a good level of cyber security? Continue Reading

By

• Mike Gillespie

CW Benelux: Dutch academic hunts the personality behind the hacker

Rutger Leukfeldt, senior researcher on cyber crime at the Netherlands Institute for the Study of Crime and Law Enforcement, is working to help organisations understand the personalities behind criminal hackers. Also in this issue, read about research that shows over half of Dutch organisations admit their knowledge of blockchain is substandard. We also feature an article about ABN Amro’s work with researchers to explore how quantum computing can be used to secure online banking. Continue Reading

Southeast Asian ‘white hat’ urges more countries to sign the Paris Call

A renowned ethical hacker in Malaysia has called for more nations to support the Paris Call for Trust and Security in Cyberspace to counter the threat of cyber warfare Continue Reading

By

• Avanti Kumar

Security Think Tank: Dialogue between data architects and security leads is essential

How can infosec pros and data architects work together to support business goals and achieve a good level of cyber security? Continue Reading

By

• Paddy Francis

Shared files in the cloud are a top ransomware target

Vectra 2019 Spotlight report shows recent ransomware attacks cast a wider net to ensnare cloud, datacentre and enterprise infrastructures Continue Reading

By

• Warwick Ashford, Senior analyst

FireEye identifies dual nature Chinese cyber threat group

Security researchers have identified a China-based cyber threat group engaged in state-spored espionage in parallel with cyber criminal activities targeting multiple industries worldwide Continue Reading

By

• Warwick Ashford, Senior analyst

Industry collaborates to patch SwapGS CPU vulnerability

Newly disclosed SwapGS vulnerability in modern processors has been patched in Windows, Linux and ChromeOS, underlining the importance of keeping systems up to date Continue Reading

By

• Warwick Ashford, Senior analyst

African bank foils suspected North Korean cyber attack

An African bank is among the financial institutions to be targeted by North Korea’s multi-billion dollar cyber theft campaign to support its weapons programmes Continue Reading

By

• Warwick Ashford, Senior analyst

Most UK firms lack confidence in disaster recovery

Only a third of UK firms are confident in their ability to recover from cyber attacks and other disasters, with business continuity still relatively low on the agenda, a study reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Using tech to boost staff morale

In this week’s Computer Weekly, we look at the emerging technologies being used to improve employee experience and raise staff loyalty and motivation. The CIO of the Football Association explains how IT is changing the way the national game is administered. And we examine the growing role of AI in preventing cyber attacks. Read the issue now. Continue Reading

Organisations turn to AI in race against cyber attackers

Businesses are racing to automate their defences as hackers and nation states launch increasingly sophisticated cyber attacks. Continue Reading

Security Think Tank: Close interdisciplinary ties are key to security integration

How can infosec professionals and data architects work together to support business goals and achieve a good level of cyber security? Continue Reading

By

• Petra Wenham

DDoS on the rise, warns Kaspersky

Security researchers at Kaspersky are among those warning business that, more than ever, mitigation of distributed denial of service attacks needs to be a key element of cyber defence strategies Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: CIA at heart of infosec-data architect partnership

How can infosec professionals and data architects work together to support business goals and achieve a good level of cyber security? Continue Reading

By

• Maxine Holt, Omdia

Most UK university applicants at risk of email fraud

The majority of hundreds of thousands of applicants to UK universities are at risk of email fraud before and after A-level results day, due to a failure to implement full Dmarc protection, a study reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Developing innovative security analytics approaches in the digital age

With security threats growing in scale and complexity, security analytics provide a way for IT teams to stay one step ahead of cyber attackers. The challenge is to ensure this technology continues to be effective in the face of new security challenges Continue Reading

By

• Nicholas Fearn

Would you trust a criminal with your cyber security?

Several industry sectors have set a good example by hiring ex-offenders, and the cyber security industry could benefit in similar ways by looking at members of the hacker community Continue Reading

By

• Ian Glover, CREST

Lack of resources top challenge to IT security

A lack of resources is the top challenge to information security professionals, followed by a lack of experience and skills, a survey reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Government continues probe of UK cyber security labour market

The government has announced a second phase of research to help understand the UK's cyber security labour market Continue Reading

By

• Warwick Ashford, Senior analyst

Industrial control system cyber security risk high, report warns

The industrial control system cyber risk to global oil and gas companies is high and rising, as new attack groups continue to enter the arena Continue Reading

By

• Warwick Ashford, Senior analyst

Leaked Sephora databases peddled on dark web

Cyber security firm finds two databases likely to be related to the Sephora data breach that affected online customers in Southeast Asia, Australia and New Zealand Continue Reading

By

• Aaron Tan, TechTarget

Cisco pays $8.6m after whistleblower discloses security flaws in video surveillance system

James Glenn, a video surveillance expert working for a Cisco reseller in Denmark, alerted Cisco to security faults and stands to gain a share of a multimillion-dollar settlement with the US government Continue Reading

By

• Bill Goodwin, Computer Weekly

Financial services top cyber attack target

Financial services are among the most attractive targets for cyber attackers, security researchers reveal, with phishing and credential stuffing among the top threats Continue Reading

By

• Warwick Ashford, Senior analyst

Mobiles top target of nation state surveillance

Nation states are targeting individual mobile users for intelligence gathering and disruption of rivals as security on mobile devices lags behind traditional computing, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Huawei ‘galvanised’ by Trump ban

Huawei has found itself caught in the crossfire of the US president’s trade war with China, but chairman Liang Hua says the firm is rising to the challenge Continue Reading

By

• Alex Scroxton, Security Editor

Former AWS engineer arrested for Capital One data breach

Capital One announces data breach affecting more than 100 million customers as US federal authorities arrest a Seattle woman formerly employed by Amazon Web Services Continue Reading

By

• Warwick Ashford, Senior analyst

Visa card vulnerabilities enable contactless limit bypass

Security researchers have discovered vulnerabilities on Visa cards that could be exploited to bypass contactless payment limits and result in huge losses Continue Reading

By

• Warwick Ashford, Senior analyst

Space – the new frontier in cyber security

50 years after the Moon landings, our growing reliance on satellite communications presents a new target for malicious cyber attacks Continue Reading

By

• Elliot Rose

WannaCry hero Marcus Hutchins spared jail

British security researcher who helped halt the global WannaCry ransomware attack that hit the NHS in 2017 has avoided jail in the US for creating other malware Continue Reading

By

• Warwick Ashford, Senior analyst

Cyber kill chain is outdated, says Carbon Black

The chief cyber security officer of Carbon Black calls for a new cognitive paradigm to fend off cyber adversaries that are now attacking in cycles Continue Reading

By

• Aaron Tan, TechTarget

Email security as important as ever, report shows

Cyber security professionals need to keep up to date with email-borne threats because they continue to evolve and have a major impact on business, research reveals Continue Reading

By

• Warwick Ashford, Senior analyst

86 million reasons to support No More Ransom

Anti-ransomware cross-industry initiative says it has prevented more than £86m in ransom payments as it marks its third anniversary, which coincides with a resurgence in ransomware in many parts of the world Continue Reading

By

• Warwick Ashford, Senior analyst

F-Secure talks up threat-hunting to stay ahead of cyber attacks in APAC

Cyber security firm calls for organisations to double up on threat-hunting now that nearly all attack and reconnaissance traffic is automated Continue Reading

By

• Avanti Kumar

Mobile banking malware surges in 2019

Mobile banking malware surged in the first half of the year, email scams geared up and attacks on cloud increased, while illicit cryptocurrency miners declined, report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Most SMEs severely underestimate cyber security vulnerabilities

Small businesses are the primary target for cyber attacks, yet most are unprepared and do not think they will be targeted, a survey reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Internet crime costs global economy £2.3m a minute

Cyber crime cost the global economy £2.3m every minute in 2018, reveals a report aimed at defining the scale of cyber attacks taking place over the internet Continue Reading

By

• Warwick Ashford, Senior analyst

Global malware down but ransomware up, with UK hard hit

Despite a global decrease in the volume of malware in the past year, ransomware is surging once again, and the UK is one of the worst-hit countries, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

AI to advance Swedish military systems

Swedish report into use of artificial intelligence in military systems reveals opportunities and concerns Continue Reading

By

• Gerard O'Dwyer

Phishing attack highlights cyber security need at universities

UK university cyber security is once again under the spotlight after Lancaster University reveals that it has been targeted by a phishing attack used to send fake invoices Continue Reading

By

• Warwick Ashford, Senior analyst

Norsk Hydro cyber attack could cost up to $75m

March 2019 ransomware attack could cost Norwegian aluminium giant up to $75m in the first half of the year, according to latest estimates Continue Reading

By

• Warwick Ashford, Senior analyst

Data breach costs on the rise, IBM study shows

Data breach costs have risen in the past decade, and the financial impact can be felt for years. Breaches posing a growing risk for small businesses, a study shows, underlining the importance of incident response Continue Reading

By

• Warwick Ashford, Senior analyst

Government delays final decision on Huawei

Culture secretary says he cannot yet make specific decisions about Huawei’s involvement in the UK’s telecoms and mobile networks due to a lack of clarity from the US, effectively green-lighting its use Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft talks up benefits and pitfalls of machine learning in security

Software giant Microsoft uses machine learning models to detect emerging threats while keeping an eye on potential bias in security data points that could derail its analysis Continue Reading

By

• Aaron Tan, TechTarget

US fines Equifax $700m over 2017 breach

Global settlement with US authorities follows systems breach that saw more than 140 million customer records stolen Continue Reading

By

• Alex Scroxton, Security Editor

Big tech firms back UK cyber security initiative

Big technology firms have pledged their support for UK investment in an initiative to “design out” of new tech the most damaging cyber security threats Continue Reading

By

• Warwick Ashford, Senior analyst

Latest ICO fine highlights privacy due diligence

A week after issuing the first serious GDPR fines, the ICO has further underlined the importance of data stewardship and due diligence regarding privacy practices Continue Reading

By

• Warwick Ashford, Senior analyst

Second CyberThreat Summit announced by NCSC and SANS Institute

CyberThreat 2019 aims to bring together a more diverse set of technical professionals in cyber security from the private and public sectors in the UK and abroad to encourage collaboration Continue Reading

By

• Warwick Ashford, Senior analyst

Warzone bulletproof hosts protecting Magecart group

Security researchers have discovered a Magecart group operating with impunity using bulletproof hosting services, including one in battle-scarred Ukraine Continue Reading

By

• Warwick Ashford, Senior analyst

How IT pros are building resilience against email security threats

For most people, emails are an easy and harmless way to communicate in the workplace, but they could also be a security disaster waiting to happen Continue Reading

By

• Nicholas Fearn

How ASEAN firms are using AI to combat cyber threats

Artificial intelligence tools are becoming a vital part of the security arsenal for organisations and cyber criminals alike. Continue Reading

CW ASEAN: Trend Watch – Security

Artificial intelligence tools are becoming a vital part of the security arsenal for organizations and cyber criminals alike. In this handbook, Computer Weekly looks at how ASEAN firms are using AI to combat cyber threats and experts discuss the latest smart cyber security tools. Continue Reading

CW ANZ: Trend Watch – Security

With regulations pushing data protection up the business agenda, we look at how Australia’s Notifiable Data Breaches scheme has been received and consider why a survey that found Australian firms are experiencing fewer cyber breach incidents appears to conflict with anecdotal evidence that suggests the opposite. Continue Reading

UK poor cyber security practice undermining controls

UK firms investing in the latest cyber security products and services risk this being undermined by poor security practices, a survey reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Lateral phishing used to attack organisations on global scale

Lateral phishing is a growing type of account takeover that has enabled attackers to target more than 100,000 people by hijacking just 154 email accounts Continue Reading

By

• Warwick Ashford, Senior analyst

Most security pros still concerned about public cloud security

Despite accelerated adoption of public cloud services by companies keen to benefit from increased efficiency, scalability and agility, most security professionals have reservations Continue Reading

By

• Warwick Ashford, Senior analyst

Suspected malicious MS Office tool maker arrested

Dutch police have arrested a man suspected of producing and selling toolkits to create malicious Microsoft Office documents Continue Reading

By

• Warwick Ashford, Senior analyst

Vulnerable firmware in enterprise server supply chain

Researchers are warning of vulnerabilities in firmware from a third-party supplier that put some servers from Lenovo, Gigabyte and six other manufacturers at risk Continue Reading

By

• Warwick Ashford, Senior analyst

NCSC calls out Microsoft over Dmarc reports

The UK’s cyber security agency has called out Microsoft for seriously undermining global email security by failing to provide crucial reports from its email platforms Continue Reading

By

• Warwick Ashford, Senior analyst

Digital safety skills initiative launched against cyber crime

Security industry partners have launched an initiative aimed at raising individuals’ digital safety skills to enable them to protect themselves and their families from most common cyber attacks Continue Reading

By

• Warwick Ashford, Senior analyst

UN resolution ignores special rapporteur’s call for halt to spyware sales

UN’s Human Rights Council adopts resolution to explore the impact of new and emerging digital technologies on human rights, but the text ignores a damning report by the council’s own expert on freedom of expression Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

NCSC reports on second year of cyber defence at scale

The UK’s National Cyber Security Centre releases a report on the second year of its Active Cyber Defence programme to demonstrate its effects in the public sector and wider UK cyber ecosystem Continue Reading

By

• Warwick Ashford, Senior analyst

Organisations turn to AI in race against cyber attackers

Businesses are racing to automate their defences as hackers and nation states launch increasingly sophisticated cyber attacks Continue Reading

By

• Bill Goodwin, Computer Weekly

UK public sector needs to prioritise mobile device security

Only 10% of public service stolen and lost mobile are recovered, underlining the need for mobile-centric, zero-trust model to reduce the risk, says MobileIron Continue Reading

By

• Warwick Ashford, Senior analyst

UK boards ignoring £30bn cyber risk

Despite the danger posed by cyber attacks to mid-sized companies, boards are not prepared to manage the risk and firms are over-confident in their cyber capabilities, report finds Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Don’t dismiss the business benefits of GDPR

What strategies can infosec pros use to shift focus from GDPR fines to enabling business gains and success, changing the way data is used, and aligning data privacy with business purpose? Continue Reading

By

• Richard Hunt, Turnkey Consulting

New FinSpy versions extend surveillance capabilities

New versions of the FinSpy malware for iOS and Android smartphones have extended targeted surveillance capabilities, warn security researchers Continue Reading

By

• Warwick Ashford, Senior analyst

Windows 10 to enable passwordless sign-in

Windows 10 users will soon be able to sign in to devices without using a password to encourage the use of two-factor authentication methods to improve security Continue Reading

By

• Warwick Ashford, Senior analyst

Attacks against AI systems are a growing concern

European research group says attacks against AI systems are already occurring, difficult to identify, and could be far more common than currently understood Continue Reading

By

• Warwick Ashford, Senior analyst

RiskIQ uncovers new Magecart campaign

A fresh Magecart campaign is breaching websites on a massive scale using indiscriminate attacks exploiting misconfigured Amazon S3 buckets, say researchers Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Align compliance objectives with business goals

What strategies can information security professionals use to shift focus from GDPR fines to enabling business gains and success, changing the way data is used, and aligning data privacy with business purpose? Continue Reading

By

• Maxine Holt, Omdia

Agent Smith mobile malware hits millions of devices

New mobile malware that exploits Android vulnerabilities has infected millions of devices, security researchers have discovered Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Changing the GDPR focus to business benefit

What strategies can information security professionals use to shift focus from General Data Protection Regulation fines to enabling business gains and success, changing the way data is used, and aligning data privacy with business purpose? Continue Reading

By

• Paddy Francis

Demand for ICO help escalates in GDPR's first year

The past year has seen increased demand across all support services offered by the UK’s privacy watchdog as new data protection laws went into force Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Benefits of GDPR compliance

What strategies can information security professionals use to shift focus from General Data Protection Regulation fines to enabling business gains and success, changing the way data is used, and aligning data privacy with business purpose? Continue Reading

By

• Petra Wenham

Nearly half of firms fear cloud apps make them insecure

Survey shows more than one-third of global companies appoint a CISO in the face of data breaches, and the UK is giving CISOs more power despite making fewer appointments Continue Reading

By

• Warwick Ashford, Senior analyst

TfL launches wireless device tracking to gather Tube data

Transport for London aims to use passenger movement data to make using the London Underground a more pleasant experience Continue Reading

By

• Alex Scroxton, Security Editor

British Airways facing £183m GDPR fine

British Airways is to appeal against a record fine for infringement of data protection rules for a breach of customer data in 2018 Continue Reading

By

• Warwick Ashford, Senior analyst

IISP gains Royal Charter status

The UK finally has its first national professional body for cyber security that will be responsible for setting the standards for skills and knowledge in the industry to reduce the skills gap and increase diversity Continue Reading

By

• Warwick Ashford, Senior analyst

St John Ambulance praised for response to ransomware attack

Charity’s response to ransomware attack demonstrates that it is possible to ensure minimal disruption if properly prepared Continue Reading

By

• Warwick Ashford, Senior analyst

Security and privacy key to smart buildings and cities

Security and privacy capabilities are essential for stakeholders if they are to realise the benefits of smart buildings and cities, says expert whitepaper Continue Reading

By

• Warwick Ashford, Senior analyst

FireEye ties Microsoft Outlook exploit to Iranian hackers

US Cyber Command has issued a warning that a patched Microsoft Outlook vulnerability is being exploited by unnamed threat actors, and recommended immediate patching Continue Reading

By

• Warwick Ashford, Senior analyst

Email still top security vulnerability, survey shows

Email is still the top security vulnerability, a survey shows, but security researchers caution that switching to instant messaging is not necessarily a solution in the longer term Continue Reading

By

• Warwick Ashford, Senior analyst

APAC experts weigh in on cyber security trends

The onslaught of cyber attacks being reported each day has been a wake-up call, but experts say businesses need to be mindful of the limitations of certain security measures Continue Reading

By

• Aaron Tan, TechTarget

Sodin ransomware exploiting Windows zero-day, Kaspersky warns

Security researchers are warning that a recently discovered type of ransomware is now exploiting a zero-day Windows vulnerability, and does not require user interaction to trigger an infection Continue Reading

By

• Warwick Ashford, Senior analyst

Top VPNs secretly owned by Chinese firms

Nearly a third of top VPNs are secretly owned by Chinese companies, while other owners are based in countries with weak or no privacy laws, potentially putting users at risk, security researchers warn Continue Reading

By

• Warwick Ashford, Senior analyst

Sweden’s Protective Security Act targets cyber risks

IT suppliers must comply with tighter cyber security requirements, but are being offered help from government agencies Continue Reading

By

• Gerard O'Dwyer