Hackers and cybercrime prevention

Security Think Tank: Severing C&C comms is key, but complex

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure that they detect such methods and that all C&C systems are removed, including “sleepers” designed to be activated at a future date? Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

Mac malware makes debut in top 10 list

Mac malware appears in the WatchGuard top 10 malware list for first time, and 6.8% of major websites still use an insecure SSL protocol, according to the firm’s latest internet security report Continue Reading

By

• Warwick Ashford, Senior analyst

Trusted nodes: The next generation in quantum key distribution

QKD is a form of protection against interception by quantum computers, but cost and technical limitations have made the technology impractical. Could trusted nodes make all the difference? Continue Reading

Large disparity in NHS cyber skills and training spend

Despite government pledges to up cyber security spending across the NHS, there are still huge disparities in cyber security skills and spending on cyber security training, FoI requests reveal Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Firms neglect DNS security at their peril

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure that they detect such methods and that all C&C systems are removed, including “sleepers” designed to be activated at a future date? Continue Reading

By

• Simon McCalla, Nominet

UK businesses feel let down by government on cyber security

Government needs to provide more support around cyber security issues in 2019, according to the majority of UK IT leaders polled Continue Reading

By

• Warwick Ashford, Senior analyst

Half of business leaders unaware of BPC cyber attacks

Half of management teams polled in 12 countries, including the UK, are unaware of business process compromise (BPC) attacks Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Three steps to detect malware comms

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure that they detect such methods and that all C&C systems are removed, including “sleepers” designed to be activated at a future date? Continue Reading

By

• Bruce Beam , (ISC)²

Security Think Tank: How to tool up to catch evasive malware comms

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure that they detect such methods and that all C&C systems are removed, including “sleepers” designed to be activated at a future date? Continue Reading

By

• Paddy Francis

Fileless malware surge, warns Malwarebytes report 

Data from millions of consumers reveals an uptick in fileless malware and other new-generation malware that calls for a new cyber security approach, report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

China demands release of arrested Huawei CFO

The Chinese government has called for the release of Huawei chief financial officer Meng Wanzhou, who was detained in Canada at the weekend Continue Reading

By

• Alex Scroxton, Security Editor

Adobe releases Flash patch for zero-day exploit

Emergency security update released for zero-day vulnerability that is being exploited in the wild via a Microsoft Office document, according to researchers Continue Reading

By

• Warwick Ashford, Senior analyst

Drawing the line for cyber warfare

With alleged Russian meddling in elections and the state-backed attack on Iran’s nuclear programme, it is becoming difficult to define the boundaries of cyber warfare Continue Reading

By

• Phil Wilcox

Security Think Tank: Situational awareness underpins effective security

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure they detect such methods and that all C&C systems are removed, including ‘sleepers’ designed to be activated at a future date? Continue Reading

By

• Mike Gillespie

Symantec unveils AI-based protection for critical infrastructure

Cyber security firm has unveiled what it claims to be the industry’s first neural network to protect critical infrastructure from USB-borne malware attacks Continue Reading

By

• Warwick Ashford, Senior analyst

Nominet brings security expertise and tech to market

The .uk domain registry is to bring its DNS expertise and technology developed for the NCSC to market to address cyber security ‘blindspot’ Continue Reading

By

• Warwick Ashford, Senior analyst

Phishing at centre of cyber attack on Ukraine infrastructure

Phishing is one of the key tools used by cyber attackers against critical national infrastructure (CNI), as highlighted by attacks on telecommunications in Ukraine Continue Reading

By

• Warwick Ashford, Senior analyst

The future of network-connected device security

The proliferation of poorly secured network-connected devices has prompted the UK government to publish new best practice guidelines. Do these go far enough? Continue Reading

By

• Peter Ray Allison

‘Open-minded’ DVSA cuts cost of MOT testing

Government agency harnesses customised open source platform to ensure data security while cutting costs and plans to extend its MOT testing capability to do the same for drivers’ theory tests Continue Reading

By

• Christian Annesley

Financial institutions’ data at risk despite security spending

Despite increased spending on cyber security, digital transformation and advanced attacks mean financial institutions’ data is still at risk, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Basic steps to countering malware comms

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure they detect such methods and that all C&C systems are removed, including "sleepers" designed to be activated at a future date Continue Reading

By

• Petra Wenham

100 million Quora.com user details exposed

Question-and-answer site is the latest organisation to admit a breach of users’ personal data, with industry commentators calling out credential theft as a top cause of such breaches Continue Reading

By

• Warwick Ashford, Senior analyst

Liberty heads for judicial review over Investigatory Powers Act

The UK's powers to conduct supsicionless bulk surveillance on individuals and organisations face a legal challenge in the high court next year Continue Reading

By

• Bill Goodwin, Computer Weekly

Security Think Tank: Combine tech, process and people to block malware comms

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure that they detect such methods and that all C&C systems are removed, including "sleepers" designed to be activated at a future date. Continue Reading

By

• Maxine Holt, Omdia

BT announces new head of security business

BT has appointed a former law enforcement officer and BT investigator as the new head of its security business Continue Reading

By

• Warwick Ashford, Senior analyst

Police investigations into cyber crime up 14% in a year

Officers forced to follow up over 2,500 complaints of Instagram, Facebook, email and website hacking, and Bitcoin ransom, despite a rise in violent crime, report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Cyber crime most significant harm in UK, says top cyber cop

Cyber crime is the most significant harm in the UK, according to the cyber lead at the City of London Police, which is the national lead for online crime Continue Reading

By

• Warwick Ashford, Senior analyst

Marriott data breach highlights basic failings

A breach of a guest reservation database of the Starwood division of the Marriott International hotel group highlights basic personal data protection failures Continue Reading

By

• Warwick Ashford, Senior analyst

WannaCry borderline national cyber emergency

The May 2017 WannaCry attack, which disrupted services at one-third of NHS trusts and more than 600 primary care organisations is the closest the UK has come to a national cyber emergency, says the NCSC Continue Reading

By

• Warwick Ashford, Senior analyst

E-commerce sites warned of heightened DDoS threat

E-commerce sites are being urged to ensure that they have adequate DDoS protection ahead of the vital holiday trading season after attacks ramped up on Black Friday and Cyber Monday Continue Reading

By

• Warwick Ashford, Senior analyst

UK cyber security strategy making ‘good progress’

The National Cyber Security Strategy is making good progress, but there is much left to be done, according to a Cabinet Office official Continue Reading

By

• Warwick Ashford, Senior analyst

120,000 police officers to receive cyber security training

Cisco is partnering with UK police forces to offer cyber security training through the Cisco Networking Academy Continue Reading

By

• Alex Scroxton, Security Editor

Cyber resilience lacking due to apathy of UK leaders

An unwillingness to accept that cyber is a real threat to critical national infrastructure by UK political and business leaders has resulted in a lack of resilience, says security industry veteran Continue Reading

By

• Warwick Ashford, Senior analyst

FCA deeply concerned as no end in sight for IT failures in banking

The FCA has reported a massive increase in the number of banking IT failures in the UK and admitted there is no end in sight Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

York teen crowned 2018 UK cyber security champion

Teenager beat off competition from 41 other cyber security enthusiasts from across the UK, and six from Singapore, in the UK Cyber Security Challenge final Continue Reading

By

• Warwick Ashford, Senior analyst

GDPR is encouraging UK IT directors to pay cyber ransoms

As predicted ahead of the General Data Protection Regulation enforcement deadline, research shows that fear of fines under the new laws is making some firms more likely to pay cyber ransoms Continue Reading

By

• Warwick Ashford, Senior analyst

IBM pushes boundaries of AI, but insists companies take an ethical approach

Researchers at IBM are pushing the boundaries of what artificial intelligence and machine learning can do, but remain wary of the ethical implications that accompany the proliferation of this technology Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Government lacks cyber resilience leadership, according to MPs

The government lacks political leadership and urgency in dealing with cyber threats, according to Joint Committee on National Security Strategy, calling for a minister in charge of delivering cyber resilience Continue Reading

By

• Lis Evenstad

Credit card fraud in ANZ showing no signs of abating

The value of fraudulent transactions more than doubled that of legitimate purchases during the third quarter this year Continue Reading

By

• Beverley Head

Three factors marginalising the CISO role

Chief information security officers are typically marginalised due to three factors, and de-coupling the technical and managerial aspects of the job will enable empowerment, says consultant Continue Reading

By

• Warwick Ashford, Senior analyst

UK firms in the dark around the impact of cyber attacks

UK firms have a long way to go in building the business resilience required to withstand cyber threats and other major disruptions, a study shows Continue Reading

By

• Warwick Ashford, Senior analyst

CW ASEAN: Blockchain is no ‘magic wand’ for security

Blockchain is all the rage, although the technology is so much more than just about bitcoin and cryptocurrencies. In this issue of CW ASEAN, we examine how blockchain is being applied in cyber security, and whether the technology is really as secure as claimed by its proponents. Read the issue now. Continue Reading

CW ANZ: Exploring blockchain

Blockchain technology has been in the news due to its ability to provide much better security, transparency and efficiency. In this issue of CW ANZ, we look at how enterprises in ANZ are using blockchain technology to improve security and efficiency, and what it takes to spur greater adoption among ANZ enterprises. Read the issue now. Continue Reading

Enterprises lack capability against persistent cyber attacks

A report urges organisations to strengthen their cyber defence capabilities to pre-empt, detect and respond to post-breach attacks Continue Reading

By

• Warwick Ashford, Senior analyst

AI-enhanced security tools necessary for today’s threats

Machine learning-enhanced tools are necessary to keep up with current threats, but are not perfect and will not solve the security skills gap problem, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst

Zero-trust security not an off-the-shelf product

The zero-trust security model is a business enabler that needs to be supported by a strategy and security architecture, analyst warns cyber security leaders Continue Reading

By

• Warwick Ashford, Senior analyst

Prepare now for quantum computers, QKD and post-quantum encryption

The predicted processing power of quantum computers is likely to make existing encryption algorithms obsolete. Quantum key distribution (QKD) is a possible solution - we investigate whether QKD is viable. Continue Reading

User behaviour analytics adding new insight

User behaviour analytics is helping to add new insights by providing the missing element in security event information management approaches, says Martin Kuppinger Continue Reading

By

• Warwick Ashford, Senior analyst

Home Office to use smartphone ID for EU Exit scheme

The Home Office will use smartphone digital identity verification to support applications for the government’s EU Exit Settlement Scheme   Continue Reading

By

• Warwick Ashford, Senior analyst

Government considering dedicated internet regulator, says digital minister

An upcoming white paper is likely to set out proposals for an internet regulator, a House of Lords committee has been told Continue Reading

By

• Alex Scroxton, Security Editor

Norway’s IT industry must tackle security vulnerabilities

Report reveals growing threat posed by “hostile foreign actors” against Norway’s IT systems and critical national infrastructure Continue Reading

By

• Gerard O'Dwyer

Firms lack responsible exec for cyber security

Narrow gap between CEO, CIO and CISO roles means no single executive function is stepping up to take responsibility for cyber security, a study shows Continue Reading

By

• Warwick Ashford, Senior analyst

GCHQ offers help to embryonic Irish cyber security organisation

Ciaran Martin head of the UK's National Cyber Security Centre, part of GCHQ, builds bridges with the Republic of Ireland's intelligence community during an official visit to Dublin Continue Reading

By

• Kevin Cahill

Post-quantum cryptography a major challenge, says expert

The crypto wars are just beginning and open systems are key to improved security in future, says cryptography expert Continue Reading

By

• Warwick Ashford, Senior analyst

Researcher urges IoT security legislation

Suppliers of internet connected devices are largely failing to improve the security of their products, exposing users to privacy risks, so there is no choice but to legislate in this area, says a researcher Continue Reading

By

• Warwick Ashford, Senior analyst

Why the tech industry needs a moral compass

Technology has unintended consequences, says Martha Lane Fox – but technologists have an opportunity to make a difference Continue Reading

By

• Cliff Saran, Managing Editor

Decentralised ID key to identity security

Enterprises need to step up protections around identity-related compromises and look to decentralised identity in the longer term to improve security, says computer scientist Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Top considerations to reduce application layer attacks

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Tim Holman, 2-sec

Cyber security high on European Commission agenda

The European Commission is recognising the growing importance of cyber security to the digital economy and is increasing funding to support research, resilience and cooperation Continue Reading

By

• Warwick Ashford, Senior analyst

Making the UK the safest place to live and work online

Government, industry and individuals all have to play their part in enhancing cyber security practices Continue Reading

By

• Cate Pye, EY

Security Think Tank: Gap, risk and business impact analysis key to application security

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Ramsés Gallego, Isaca

Security Think Tank: Three ways to safeguard against application layer vulnerabilities

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Bruce Beam , (ISC)²

DevSecOps not limited to coding, says analyst

DevSecOps is seen as a way of ensuring application security, but security leaders must understand that embedding a security culture and taking the inter-dependencies of new development frameworks into account is key, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Deploy multiple defence layers to protect data-rich applications

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Simon Persin, Turnkey Consulting

Facebook to appeal EU-US data transfer ruling in Irish Supreme Court

Facebook will appeal a decision by the Irish High Court to refer questions over the legality of EU-US data transfers to the European Court of Justice in January, as the Dublin court rejects attempt by a UK IT expert to join the case Continue Reading

By

• Bill Goodwin, Computer Weekly

Government fails in first attempt to hire chief security officer

The government’s initial recruitment campaign for the UK’s "biggest and most important security job” has been unsuccessful, Cabinet Office admits Continue Reading

By

• Lis Evenstad

Microsoft chief urges industry to focus on ethics and privacy

Businesses must focus on GDPR and ethical AI if they are to become software firms, says Microsoft CEO Satya Nadella Continue Reading

By

• Cliff Saran, Managing Editor

Security Think Tank: A three-pronged approach to application security

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Petra Wenham

Facebook emphasises security drive during third-quarter earnings call

Social media giant admits it has a lot of work to do to keep on top of security as it looks to extend payment option to Messenger Continue Reading

By

• Cliff Saran, Managing Editor

Think Tank: Application layer attack mitigation needs to start with risk analysis

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Maxine Holt, Omdia

Australia’s data breaches are a ‘sign of naiveté’

McAfee executive attributes Australia’s poor cloud security record to the lack of data protection measures amid “new and confusing” cloud configurations Continue Reading

By

• Beverley Head

Aim for long-term customer identity relationship

Consumer identity management can deliver competitive advantage, but only if businesses follow some golden rules, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Defend application layer with good security hygiene

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Mike Gillespie

Security Think Tank: Counter application layer attacks with automation

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Paddy Francis

British Airways data breach worse than thought

British Airways has admitted that up to 185,000 more people than first thought may have had personal details compromised in August’s data breach Continue Reading

By

• Alex Scroxton, Security Editor

DNS attacks cost finance firms millions of pounds a year

Average cost of recovering from a single DNS attack is $924,390 for a large financial services company, survey shows Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security Think Tank: Focus on security before app deployment

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Richard Absalom, Information Security Forum

IoT ecosystem needs to be investigated, say experts

A conference of IoT experts convened by Enisa and Europol has made key recommendations to ensure security vulnerabilities do not overshadow benefits Continue Reading

By

• Warwick Ashford, Senior analyst

Trusted nodes: The next generation in quantum key distribution

QKD is a form of protection against interception by quantum computers, but cost and technical limitations have made the technology impractical. Could trusted nodes make all the difference? Continue Reading

By

• Peter Ray Allison

Belgian startup makes a game of creating secure software code

A global tech startup has placed its research and development centre in Belgium, taking advantage of regional financial support as well as cooperations with local educational organisations Continue Reading

By

• Kim Loohuis

GandCrab decryption tool released by No More Ransom

Another decryption tool has been made available free of charge in the battle against ransomware to help victims avoid paying to release their data Continue Reading

By

• Warwick Ashford, Senior analyst

Cathay Pacific under fire over breach affecting 9.4 million passengers

Hong Kong-based airline reveals massive data breach of the most sensitive personal data of passengers five months after loss was confirmed Continue Reading

By

• Warwick Ashford, Senior analyst

Becrypt security platform helps ease cloud adoption

Becrypt’s secure operating system is driving a new service aimed at helping organisations reduce cost and increase agility in using cloud-based services and online applications Continue Reading

By

• Warwick Ashford, Senior analyst

Choose security tools wisely to gain upper hand

The cyber threat landscape is continually changing, but staying abreast of attacker and defender innovation can help business leaders gain the upper hand, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst

Sibos 2018: ‘Black swan’ cyber event is inevitable

With security experts and bankers expecting a 9/11-style cyber event, deeper collaboration between companies and governments is necessary to identify emerging threats before they occur Continue Reading

By

• Beverley Head

Yahoo to pay at least $85m for data breach settlement

Yahoo has agreed to a settlement in a class action lawsuit on behalf of 200 million consumers affected by a data breach in 2013 Continue Reading

By

• Warwick Ashford, Senior analyst

Interview: Steve Grobman, McAfee CTO shares his views on some burning security questions

Cyber security technology innovator and veteran Steve Grobman shares his views on adversarial artificial intelligence, post-quantum cryptography and security for next-gen tech Continue Reading

By

• Warwick Ashford, Senior analyst

McAfee CTO raises concerns about election cyber security

The security industry needs to look at the security of election processes around the world as well as the security of voting and counting machines, says McAfee CTO Continue Reading

By

• Warwick Ashford, Senior analyst

Kaspersky advances plans to encourage women into cyber

Cyber security provider Kaspersky Lab has partnered with several other organisations to try to encourage more women into cyber Continue Reading

By

• Clare McDonald, Business Editor

McAfee combining threat intel with AI

Simulations show that threat intelligence and artificial intelligence is a powerful combination, according to McAfee’s technology head Continue Reading

By

• Warwick Ashford, Senior analyst

Learn lessons from attacks, says McAfee investigations chief

Organisations should use every cyber attack as an opportunity to learn, identify weaknesses and improve security posture, according to McAfee’s head of cyber investigations Continue Reading

By

• Warwick Ashford, Senior analyst

McAfee researchers uncover ‘significant’ espionage campaign

Researchers discover campaign targeting South Korea, the US and Canada with links to eight-year-old source code from a threat group that has been dormant for five years Continue Reading

By

• Warwick Ashford, Senior analyst

Time to implement new cyber security protections, says McAfee CEO Chris Young

Convergence of threats and technologies and an increasingly complex regulatory environment are driving the need to implement new cyber security protections, says McAfee chief Continue Reading

By

• Warwick Ashford, Senior analyst

APAC security spending tipped to reach new highs

Security services will be the largest and fastest-growing slice of the overall security pie in the Asia-Pacific region Continue Reading

By

• Aaron Tan, TechTarget

Detail of Dutch reaction to Russian cyber attack made public deliberately

Four Russian intelligence officials were expelled from the Netherlands after an attempted hack on the global chemical weapons watchdog. The Dutch government has been open about the detail. Continue Reading

Drilling into AI at Shell

In this week’s Computer Weekly, we find out how oil giant Shell is using artificial intelligence and machine learning to boost workforce safety and productivity. We analyse the attempted Russian cyber attack revealed by the Dutch government. And we look at how blockchain is being used in the food and drink industry to improve supply chain management. Read the issue now. Continue Reading

Zero-trust security model gaining traction

The zero-trust model of security is finally gaining traction as security professionals tap into new tools and executive buy-in to support this approach in an effort to improve security posture and practices Continue Reading

By

• Warwick Ashford, Senior analyst

UK faces 10 cyber attacks a week as hostile states step up hacking, says NCSC

The UK’s National Cyber Security Centre has thwarted more than 1,600 attacks over the past two years – many by hostile nation states Continue Reading

By

• Bill Goodwin, Computer Weekly

Cost of WannaCry attack to NHS set at £92m

Department for Health and Social Care estimates the immediate cost of the May 2017 WannaCry attack on the NHS was £92m, and says it will have spent about £275m on improvements to its cyber security infrastructure by the end of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

IoT firms sign up to UK security code of practice

Internet of things technology firms have begun signing up to a UK code of practice to strengthen the security of internet-connected devices. The code is expected to form the basis of an international standard Continue Reading

By

• Warwick Ashford, Senior analyst