IT security

Downstream breaches of Capita customers spreading

As many as 90 organisations that used Capita services have now reported data breaches arising from various security incidents at the outsourcer Continue Reading

By

• Alex Scroxton, Security Editor

Can the UK cash in on chips?

In this week’s Computer Weekly, the UK government has committed £1bn to the semiconductor sector – but can it ever compete with the US and China? The potential of 5G networking could transform manufacturing – we examine the implications. And we talk to the global CIO at cloud storage provider Box about plans to incorporate AI and machine learning. Read the issue now. Continue Reading

Driving secure-by-design principles

Errors can and will occur in code – the key is to minimise the impact and ensure you streamline remediation Continue Reading

By

• Cliff Saran, Managing Editor

How do you tackle Data Diarrhoea?

We now face the most lethal of situations - secure (if properly used)  technologies in the hands of insecure people.  Continue Reading

By

• Philip Virgo, Winsafe Ltd

Cisco joins growing Manchester cyber security hub

Networking kingpin signs up to Greater Manchester Digital Security Hub to support centre’s work on security resilience and skills Continue Reading

By

• Alex Scroxton, Security Editor

Bumbling IT security analyst convicted of blackmail offences

A Hertfordshire man has been convicted of blackmail and other offences after piggybacking on an in-progress ransomware attack to try to defraud his employer, but failing to cover his tracks in any meaningful way Continue Reading

By

• Alex Scroxton, Security Editor

Five key steps where there is a risk of fraud investigation

When fraud investigators come knocking, there are some important ways in which management and senior IT professionals can make sure their company is best protected. Continue Reading

By

• Caroline Day and Phil Taylor

Security Think Tank: Why “secure coding” is neither

Ensuring the security of code is just one element of a complex software lifecycle and risk management process that people need to think about more holistically, says Ed Moyle Continue Reading

By

• Ed Moyle, Drake Software

Cabinet Office publishes response to data sharing for digital ID consultation

The majority of respondents to government’s consultation on data sharing for digital identity are critical to the plans and concerned about data privacy, but Whitehall’s response says many of the responses ‘were driven by anti-digital commentaries’ Continue Reading

By

• Lis Evenstad

Alert over Chinese cyber campaign targeting critical networks

A Chinese threat actor known as Volt Typhoon has been observed infiltrating CNI networks in a cyber espionage campaign, according to intelligence Continue Reading

By

• Alex Scroxton, Security Editor

Almost all ransomware attacks target backups, says Veeam

Some 93% of ransomware attacks go for backups and most succeed, with 60% of those attacked paying the ransom, according to a Veeam survey Continue Reading

By

• Antony Adshead, Storage Editor

Kuwait bank introduces biometric payments card

Middle East bank launches payment cards with fingerprint sensor technology embedded Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Two-thirds of all 2022 breaches resulted from spear phishing

Research by Barracuda Networks has found that, despite the low volume of spear-phishing attempts, the attacks are highly successful and have major consequences Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Cohesity Turing aims AI tools at backup and ransomware

Backup supplier continues to enrich its ecosystem with more artificial intelligence for backup and ransomware, with chat-like reporting functions and new security partners in its alliance Continue Reading

By

• Antony Adshead, Storage Editor

How to secure your software supply chain

In this week’s Computer Weekly, our latest buyer’s guide looks at secure coding, and kicks off by examining the challenges of securing your software supply chain. Cyber law enforcement leaders are calling on firms to end the secrecy around ransomware attacks. And we find out how facial recognition technology is being adopted by retailers. Read the issue now. Continue Reading

Let’s open up and put an end to secrecy and cover-ups in ransomware attacks

The NCSC and the ICO are calling for organisations to bite the bullet and be more open about cyber security and ransomware incidents, and the community is firmly behind them Continue Reading

Securing your software supply chain

Organisations need to have a thorough understanding of software components and build security controls into development lifecycles to shore up the security of their software supply chains. Continue Reading

Facebook owner Meta fined record €1.2 billion over EU-US data transfers

Decision could have implications for other companies using Standard Contractual Clauses to share data between Europe and the US Continue Reading

By

• Bill Goodwin, Computer Weekly

Spanish lawyers claim police hacking of EncroChat cryptophones breaches human rights law

Lawyers speaking at the Madrid Bar Association question the legality of a cryptophone hacking which has led to arrests of organised criminals in multiple countries Continue Reading

By

• Bill Goodwin, Computer Weekly
• Ter García

Navigating artificial intelligence: Red flags to watch out for

Lou Steinberg, founder of cyber security research lab CTM Insights, flags up the risks of the growing use of AI, and what organisations can do to tame the technology for good Continue Reading

By

• Pratima Harigunani

Data breaches in Australia on the rise, says OAIC

The Office of the Australian Information Commissioner reports that data breaches rose by 26% in the second half of 2022 Continue Reading

How Mimecast thinks differently about email security

CEO Peter Bauer believes a comprehensive approach towards email security has enabled it to remain relevant to customers for two decades Continue Reading

Securing your software supply chain

Organisations need to have a thorough understanding of software components and build security controls into development lifecycles to shore up the security of their software supply chains Continue Reading

CW APAC: Expert advice on security and threat intelligence

Organisations are all too aware of the importance of cyber defence. In this handbook, focused on security and threat intelligence in the Asia-Pacific region, Computer Weekly looks at the software supply chain, Mimecast’s email security, Australian data breaches and Singapore’s threat intelligence. Continue Reading

Home Office pushes for more police facial-recognition deployments

An independent report commissioned by the biometrics commissioner of England and Wales reveals that the UK policing minister is pushing for wider adoption of facial-recognition technology by police, and further criticises the government’s proposed changes to surveillance oversight Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Pentera ups ante in penetration testing

The Israeli startup, which expanded to the APAC region last year, scans for vulnerabilities and emulates cyber attacks through its automated security validation platform Continue Reading

By

• Aaron Tan, TechTarget

Executive interview: DNS designer David Holtzman discusses net security

How is it possible for criminals to lure people onto fake websites? Holtzman says it’s because DNS is fundamentally insecure Continue Reading

By

• Cliff Saran, Managing Editor

Code experiments: A Computer Weekly Downtime Upload podcast

We speak to GoDaddy CTO Charles Beadnall about how to prove an IT project works as intended Continue Reading

By

• Cliff Saran, Managing Editor

NetApp to promise ransomware warranty payout

NetApp will recover data hit by ransomware or pay a warranty, and has added entry-level SAN arrays and full access to all NetApp software across its hardware families Continue Reading

By

• Antony Adshead, Storage Editor

Scality pushes anti-ransomware features in Artesca object storage

Object storage specialist announces v2.0 of Artesca, with a heavy focus on functionality that can protect against ransomware such as object locking, sharding, backup to object etc Continue Reading

By

• Antony Adshead, Storage Editor

Why we need a secure side door for encrypted apps, not a back door  

Splitting a decryption key into multiple fragments held by 'guardians', including privacy rights group, may be an answer to policing encrypted messages Continue Reading

By

• Andersen Cheng

Security Think Tank: To secure code effectively, verify at every step

Verification at every step is an important part of ensuring your code is secure, writes Petra Wenham Continue Reading

By

• Petra Wenham

MS macro-blocking has forced cyber criminals to innovate

One year after Microsoft started blocking VBA and XL4 macros by default, the cyber criminal ecosystem has all but stopped exploiting macros in their attacks. They’re instead innovating at an unprecedented rate Continue Reading

By

• Alex Scroxton, Security Editor

How AI ethics is coming to the fore with generative AI

The hype around ChatGPT and other large language models is driving more interest in AI and putting ethical considerations surrounding their use to the fore Continue Reading

By

• Aaron Tan, TechTarget

Let’s put an end to secrecy and cover-ups in ransomware attacks

The NCSC and the ICO are calling for organisations to bite the bullet and be more open about cyber security and ransomware incidents, and the community is firmly behind them Continue Reading

By

• Alex Scroxton, Security Editor

What secure coding practices mean to modern cyber security

Joseph Foote of PA Consulting explores how we know the services we use most are protected, what we mean when we say 'secure coding practices', and what happens when secure coding practices are not followed? Continue Reading

By

• Joseph Foote

BT unveils secure networking service for UK business customers

UK’s leading telco teams with US cyber security company to launch secure software-defined networking service for business customers available on a managed services basis Continue Reading

By

• Joe O’Halloran, Computer Weekly

IT Priorities 2023: Budgeting for IT innovation

In spite of the economic slowdown, IT leaders are driving forward investments in IT Continue Reading

By

• Cliff Saran, Managing Editor

How Splunk is driving security automation

Splunk’s head of security in APAC talks up the company’s efforts to ease the workloads of security analysts amid lower adoption of security automation and analytics in the region Continue Reading

By

• Aaron Tan, TechTarget

Investigatory Powers Tribunal finds NCA EncroChat hacking warrants were lawful

Investigatory Powers Tribunal refers questions over whether messages obtained from the EncroChat encrypted phone network are legally admissible back to the criminal court Continue Reading

By

• Bill Goodwin, Computer Weekly

Australia to shore up cyber and digital capabilities in Budget 2023

Australia is spending more than A$2bn to strengthen cyber resilience, improve digital government services and fuel AI adoption, among other areas, in its latest budget Continue Reading

By

• Stephen Withers

AI outcry intensifies as EU readies regulation

Policymakers are battling to keep pace with AI developments, while experts warn of societal impact Continue Reading

By

• Cliff Saran, Managing Editor

CW EMEA: The future of work

In this month’s CW EMEA, we look at the future of work in Europe after the pandemic forced a change in entrenched human behaviour. For years, people talked about flexible working being the way forward, but scepticism within the management of large companies held it back. This all changed when Covid-19 began to spread out of control and governments and businesses quickly told people to work from home where possible. We also look at the increasing problem of IT failures in Dutch hospitals and how they are affecting patient care, highlighting the need to improve IT security in hospitals. Read the issue now. Continue Reading

Journalists’ confidential communications subject to unlawful spying, court hears

Campaign group Liberty and the National Union of Journalists tell Court of Appeal the government has not gone far enough to protect confidential journalist information and sources from surveillance Continue Reading

By

• Bill Goodwin, Computer Weekly

Fujitsu staff had ‘unrestricted and unauditable’ remote access to Post Office branch systems

Fujitsu engineers could make changes to Post Office branch accounts without anyone knowing Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Secure Boot vulnerability causes Patch Tuesday headache for admins

Applying the fix for a security bypass zero-day affecting the Windows Secure Boot feature will be a long process that will drag into 2024, but for good reason, says Microsoft Continue Reading

By

• Alex Scroxton, Security Editor

Black Basta ransomware attack to cost Capita over £15m

Exceptional costs arising from the March 2023 Black Basta ransomware attack on the systems of outsourcer Capita will be somewhere between £15m and £20m, the organisation says Continue Reading

By

• Alex Scroxton, Security Editor

Nebulon aims Tripline at ransomware detection in storage

Tripline claims ransomware detection from samples every 30 seconds and works in conjunction with snapshots to deliver recovery from an attack in four minutes Continue Reading

By

• Antony Adshead, Storage Editor

How datacentre operators can fend off cyber attacks

Applying zero-trust principles in the form of strong authentication controls and network segmentation can help datacentre operators to mitigate cyber threats Continue Reading

By

• Aaron Tan, TechTarget

standardization

Standardization is the process of developing, promoting and possibly mandating standards-based and compatible technologies and processes within an industry. Continue Reading

By

• Paul Kirvan

OVHcloud aims to bring Glacier-like cloud archive to Europe

OVHcloud makes Cold Archive GA with deep archive storage cheaper than AWS’s offer and all based on IBM 3592 tape hardware spread across four sites with Atempo backup Continue Reading

By

• Yann Serra, LeMagIT
• Antony Adshead, Storage Editor

passkey

A passkey is an alternative method of user authentication that eliminates the need for usernames and passwords. Continue Reading

By

• Amanda Stevens

application blacklisting (application blocklisting)

Application blacklisting --increasingly called application blocklisting -- is a network or computer administration practice used to prevent the execution of undesirable software programs. Continue Reading

By

• Robert Sheldon

Chat control: EU lawyers warn plans to scan encrypted messages for child abuse may be unlawful

Leaked legal advice warns that European ‘chat control’ proposals to require tech companies to scan private and encrypted messages for child abuse are likely to breach EU law Continue Reading

By

• Bill Goodwin, Computer Weekly

Capita pension clients told data may have leaked

Capita has told trustees of some of the pension funds for which it provides outsourced services that their customer data may have been stolen by the Black Basta ransomware operation Continue Reading

By

• Alex Scroxton, Security Editor

Santander reports increase in scams and admits fraud head was impersonated

Santander has reported an increase in impersonation scams, and admitted its own head of fraud was impersonated by a fraudster Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security Think Tank: Thinking beyond IAM in the cloud

Looking beyond IAM, there are other aspects of securing public cloud environments that admins can reasonably expect to control Continue Reading

By

• Petra Wenham

Google debuts passwordless login options for users

Launch of Google’s passkey service hailed as a great leap forward for passwordless technology Continue Reading

By

• Alex Scroxton, Security Editor

Inside BlackBerry’s cyber security playbook

BlackBerry’s president of cyber security discusses the company’s cyber security strategy and what it is doing to deliver an integrated set of capabilities for enterprises Continue Reading

By

• Aaron Tan, TechTarget

Cyber Action Plan for Wales launched

The devolved Welsh government has set out four priorities in an action plan designed to foster cyber resilience, talent and innovation across the country Continue Reading

By

• Alex Scroxton, Security Editor

TikTok fixes vulnerability that could have exposed user activity data

A potentially dangerous vulnerability in the TikTok video-sharing platform was discovered by Imperva researchers, and has now been fixed Continue Reading

By

• Alex Scroxton, Security Editor

Government anti-fraud strategy targets the tech behind the scams

The UK government’s anti-fraud strategy proposes to make it much harder for criminals to target their victims by cracking down on the exploitation of technology Continue Reading

By

• Alex Scroxton, Security Editor

Data classification tools: What they do and who makes them

Data classification is necessary for all organisations for reasons that range from simply putting data on the most cost-efficient media to ensuring legal and regulatory compliance Continue Reading

By

• Stephen Pritchard

US competition watchdog issues generative AI warning

Generative AI can be used to manipulate people into making harmful decisions, says US Federal Trade Commission in warning to firms building and using AI-powered tools Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Mystery Apple security update sparks speculation

Apple releases its first Rapid Security Response update for iPhone, iPad and Mac devices, but users are in the dark about what security problems they have fixed Continue Reading

By

• Alex Scroxton, Security Editor

Hash-based Message Authentication Code (HMAC)

Hash-based Message Authentication Code (HMAC) is a message encryption method that uses a cryptographic key in conjunction with a hash function. Continue Reading

By

• Rahul Awati

Want to get cloud IAM right? Master the fundamentals

By getting the basics right, you’re setting yourself up for success to then can build more advanced and complex functionalities on top Continue Reading

By

• Paul Lewis, Nominet

UK Cyber Security Council launches certification mapping tool

Cyber careers body aims to offer clarity for professionals seeking to advance through security certification Continue Reading

By

• Alex Scroxton, Security Editor

Researchers see surge in scam websites linked to coronation

Scammers and fraudsters continue to take advantage of large public events, with the coronation of King Charles III no exception Continue Reading

By

• Alex Scroxton, Security Editor

Web application firewall (WAF)

A web application firewall (WAF) is a firewall that monitors, filters and blocks Hypertext Transfer Protocol (HTTP) traffic as it travels to and from a website or web application. Continue Reading

By

• Kinza Yasar, Technical Writer

Tackling the challenges of data sovereignty in a multi-cloud world

This is a guest post by Andy Ng, vice-president and managing director for Asia South and Pacific region at Veritas Technologies The shift to public cloud adoption is alluring, driven by the ... Continue Reading

By

• Aaron Tan, TechTarget

Government is playing ‘psychic war’ in battle over end-to-end encryption

Peers hear that the UK government is being deliberately ambiguous about its plans to require technology companies to scan the content of encrypted messages Continue Reading

By

• Bill Goodwin, Computer Weekly

Tenable opens playground for generative AI cyber tools

A set of generative AI cyber tools designed to help security researchers in reverse engineering, debugging and other areas of work have been made available for the community to experiment with Continue Reading

By

• Alex Scroxton, Security Editor

SQL injection (SQLi)

A SQL injection (SQLi) is a technique that attackers use to gain unauthorized access to a web application database by adding a string of malicious code to a database query. Continue Reading

By

• Kinza Yasar, Technical Writer
• Katie Terrell Hanna
• Sarah Lewis

Google Cloud seals bug that could have led to data breaches

The Asset Key Thief vulnerability gave rise to multiple potential attack scenarios that could have impacted thousands of Google Cloud users, but has now been safely fixed Continue Reading

By

• Alex Scroxton, Security Editor

Police Scotland receive formal notice about cloud system

Scotland’s biometrics watchdog has issued Police Scotland with an information notice over its deployment of a cloud-based digital evidence system, following disclosure of major data protection concerns by Computer Weekly Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Researchers deal blow to Gootloader gang that supported REvil

Thousands of compromised WordPress blogs have been spreading the Gootloader malware for years, but eSentire’s security research team are turning the tables on the gang that played a key role in REvil ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware gang exploiting unpatched Veeam backup products

Cyber criminals with links to multiple virulent ransomware strains are exploiting a recently disclosed vulnerability in Veeam’s Backup & Replication product, threat analysts have warned Continue Reading

By

• Alex Scroxton, Security Editor

Google researchers identify hole in Intel TDX

Intel has worked with Google to figure out how to harden the TDX module in Xeon chips to boost the security of virtual machines Continue Reading

By

• Cliff Saran, Managing Editor

Cyber security and analytics propel jobs boost in Scotland’s tech sector

A tech industry survey from ScotlandIS indicates the country’s tech sector is set to grow, with cyber security as the hottest domain Continue Reading

By

• Brian McKenna, Senior Analyst, Business Applications

CISOs under-supported, under pressure, Trellix finds

The vast majority of CISOs say they are finding it difficult to get sign-off on the resources they need to do their job Continue Reading

By

• Alex Scroxton, Security Editor

Podcast: Ransomware, data protection and compliance

Ransomware is a huge and ever-present threat, but there are ways to avoid it and to mitigate its effects. We get key practical steps from Mathieu Gorge, CEO of Vigitrust Continue Reading

By

• Antony Adshead, Storage Editor

Almost three-quarters of cyber attacks involve ransomware

Data from Sophos’s annual Active Adversary Report reveals that almost three-quarters of the cyber security incidents it responded to in 2022 involved ransomware Continue Reading

By

• Alex Scroxton, Security Editor

How non-fungible tokens can be used to manage health data

Non-fungible tokens will give patients more ownership and control over their health data and improve its transparency in healthcare research, according to SingHealth clinicians Continue Reading

By

• Aaron Tan, TechTarget

Most IT staff uncomfortable deploying surveillance tech at work

The IT teams responsible for deploying and running digital surveillance in workplaces say they are uncomfortable with “extremely common” practice of spying on colleagues, research finds Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Could your employees’ use of ChatGPT put you in breach of GDPR?

Following Italy's run-in with OpenAI’s ChatGPT, legal expert Richard Forrest emphasises the necessity for additional scrutiny while using AI tools in a work environment, and practical guidance on doing so safely Continue Reading

By

• Richard Forrest

Security Think Tank: Going beyond IAM for cloud security

Managing access and privilege across complex and powerful cloud tooling is not a straightforward task; but there are some key considerations that can help security teams stay on top of identities in the cloud Continue Reading

By

• Becky Gelder, Turnkey Consulting

UK biometrics watchdog questions police cloud deployments

The UK biometrics commissioner has warned that policing and justice bodies must be able to demonstrate ‘immediately and unequivocally’ that their cloud deployments are lawful Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

CyberUK 23: New advice on smart city security issued

The NCSC and key allies have drawn up new guidance to help communities balance the cyber security risks involved with creating smart cities Continue Reading

By

• Alex Scroxton, Security Editor

Prototype cyber tech has revolutionary potential

The so-called CHERI protection model developed at the University of Cambridge is showing great promise for future cyber security technologies Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill could pose risk to encryption technology used by Ukraine

CEO of encrypted messaging service Element says Online Safety Bill could pose a risk to the encrypted comms systems used by Ukraine Continue Reading

By

• Bill Goodwin, Computer Weekly

Bumblebee malware flies on the wings of Zoom and ChatGPT

Bumblebee malware, often used as a stepping stone to ransomware, is now spreading via trojanised installers for popular software applications Continue Reading

By

• Alex Scroxton, Security Editor

UK Emergency Alert Test sparks cyber fraud warning

Fraudsters and scammers are likely to use the upcoming test of the UK's new mobile Emergency Alert system as bait in their attacks, while misinformation and conspiracy theories spread Continue Reading

By

• Alex Scroxton, Security Editor

Beyond Web 2.0: A Computer Weekly Downtime Upload podcast

Like others who have developed technology that powers the internet, David Holtzman, chief strategist at decentralised cyber security network Naoris Protocol, has an unusual background Continue Reading

By

• Cliff Saran, Managing Editor

3CX incident may be world’s first double supply chain attack

It’s supply chain attacks all the way down as Mandiant publishes information suggesting that the 3CX software supply chain compromise was initiated via a prior software supply chain compromise Continue Reading

By

• Alex Scroxton, Security Editor

Good Friday Agreement key to growth of Northern Ireland cyber hub

Now 25 years since the historic Good Friday Agreement ended the Troubles, Northern Ireland has become a flourishing centre of cyber security excellence and has ambitions to grow further Continue Reading

By

• Alex Scroxton, Security Editor

New GovAssure cyber regime launches across UK government

An enhanced cyber security regime is being put in place to better protect UK government IT systems from growing threats Continue Reading

By

• Alex Scroxton, Security Editor

Capita customer data was stolen in March ransomware attack

Capita says it has uncovered evidence of data exfiltration from a small proportion of its server estate following a cyber attack at the end of March Continue Reading

By

• Alex Scroxton, Security Editor

Are tech vendors pulling their weight on fixing fragmented IT?

Many organisations have silo’d data and fragmented IT systems, but how much of this is due to the actions of IT vendors? Do vendors too often chase a quick buck, selling point solutions that don’t ... Continue Reading

By

• Bryan Betts, Freeform Dynamics

CyberUK 23: Ukraine offers masterclass in withstanding cyber war

Russian cyber activity has seen an unprecedented evolution in scale and pace over the past year, but Ukraine’s resilience has enabled it to mount a masterful response, says the NCSC Continue Reading

By

• Alex Scroxton, Security Editor