IT security

Cloud repatriation: Five reasons to repatriate data from cloud

We look at key drivers of cloud repatriation, including cost, compliance, issues around latency and data gravity, reversing poorly planned moves to the cloud, and supplier failure Continue Reading

By

• Stephen Pritchard

GovTech to enhance Government on Commercial Cloud

GCC 2.0 will include improvements in user onboarding and provide single credential access to public cloud services and engineering tools, among other areas Continue Reading

By

• Aaron Tan, TechTarget

One-fifth of NCSC-supported cyber incidents linked to Covid-19

National Cyber Security Centre has helped to thwart multiple cyber incidents that could have seriously disrupted the UK’s response to the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

What are 3 best practices for storage encryption at rest?

Consider the fine print of encrypting data at rest. For example, access control permissions can make or break a storage encryption plan. Continue Reading

By

• Brien Posey

Security Think Tank: SASE – more than the sum of its parts?

Airbus Cybersecurity’s Paddy Francis asks what makes an integration of the various components of SASE more the sum of their parts, and what are the benefits and pitfalls? Continue Reading

By

• Paddy Francis

How cosmetics retailer Lush made over its approach to authentication

Evolving approaches to IT at cosmetics retailer Lush meant the organisation’s previous approach to authentication was no longer up to scratch. Find out how it overcame this hurdle Continue Reading

How cosmetics retailer Lush authenticates with ease

In this week’s Computer Weekly, we find out how Lush has modernised user authentication, governed by a desire to care for customer data. We also talk to the chief data officer at Nasa about data as a strategic asset, and the ground of better decision-making. And we foreground a call for the government and the Post Office to compensate victims of the Horizon computer system without delay. Read the issue now. Continue Reading

UK government proposes new rules for digital supply chain security

Proposals could see IT service providers legally required to adhere to the NCSC’s Cyber Assessment Framework, among other things Continue Reading

By

• Alex Scroxton, Security Editor

virus hoax

A virus hoax is a false warning about a computer virus. Continue Reading

By

• Katie Terrell Hanna

Government bodies refuse FOI requests on basis of misleading database search times, says academic

The Information Commissioner’s Office tells tribunal it would need to bring in external experts to search data using an Excel spreadsheet Continue Reading

By

• Bill Goodwin, Computer Weekly

Security Think Tank: What to find out before investing in SASE

Petra Wenham of the BCS shares her thoughts on what organisations need to consider as they investigate whether or not to invest in secure access service edge technology Continue Reading

By

• Petra Wenham

New law needed to rein in AI-powered workplace surveillance

MPs and peers call for new legislation to regulate the growing use of artificial intelligence in the workplace, which is being used to surveil workers’ performance and behaviour Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Oversight of biometrics and surveillance should not go to ICO

Biometrics and surveillance camera commissioner Fraser Sampson has panned the UK government’s proposed plan to absorb the functions of those roles under the remit of the information commissioner Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

BT applies Covid-19 R number modelling to threat response

A prototype cyber security tool developed at BT uses epidemiological principles to detect and respond to cyber threats Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2022: APAC enterprises invest in digital future

Nearly two-thirds of enterprises in Asia-Pacific plan to increase their IT budgets next year in areas such as cloud computing and cyber security to secure their digital future Continue Reading

By

• Aaron Tan, TechTarget

AT&T launches a managed SASE offering with Cisco

AT&T aims its latest managed SASE service at enterprises using Cisco hardware. The offering's features range from firewall and secure web gateway functionality to DNS layer security. Continue Reading

By

• Madelaine Millar, TechTarget

HPE’s Aruba networking unit hit by cyber attack

Undisclosed threat actor compromised data buckets used to run the Aruba Central cloud environment using a stolen access key Continue Reading

By

• Alex Scroxton, Security Editor

Finance ombudsman overturns more than three-quarters of bank decisions on APP fraud

The financial services ombudsman is siding with customers in over 75% of complaints against banks that refuse to repay losses to authorised push payment fraud Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Scale of crime-as-a-service economy a growing concern, say researchers

The cyber criminal underground continues its evolution towards a service-based economy Continue Reading

By

• Alex Scroxton, Security Editor

The ICO is right to push back against government meddling

Some criticisms of the ICO are justified, but the answer to that is not to give Whitehall more oversight over the data protection regulator, argues legal expert Edward Machin Continue Reading

By

• Edward Machin

CW Benelux: Dutch IT company rips up the HR rule book for better work-life balance

One Dutch tech firm has used learnings from the pandemic to rip up its HR rule book and implement an official work-from-home policy. In fact, Infolearn has gone further than hybrid working, with a personal mobility budget for staff and a four-day working week, all with retention of full-time salary. Also in this issue, read how Dutch education administrators appear to be underestimating the threat of cyber crime. Continue Reading

Bank of England loses 161 computing devices in three years

Bank cannot account for phones, laptops and tablets that have gone missing over the past three years Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Lloyd v Google Supreme Court verdict brings end to privacy class actions against big tech in UK

A ruling by the Supreme Court has left it financially unviable for individuals to bring class actions in the UK against big tech companies for privacy breaches Continue Reading

By

• Bill Goodwin, Computer Weekly

Zero trust: Now is the time

The cyber security industry has been talking about a zero-trust approach to security for just over a decade, but now it’s time to move towards full implementation because it is more appropriate than ever, and it is rapidly gaining support from suppliers Continue Reading

By

• Warwick Ashford, Senior analyst

Dutch education administrators underestimate threat of cyber crime

 Continue Reading

The Netherlands still lacks digital resilience, says report

 Continue Reading

November Patch Tuesday drop fixes bugs in Excel, Exchange Server

Another relatively light Patch Tuesday drop from Microsoft addresses 55 vulnerabilities, two of them already being exploited Continue Reading

By

• Alex Scroxton, Security Editor

EU artificial intelligence regulation risks undermining social safety net

Europe’s proposed artificial intelligence regulation will not adequately protect people from European governments' increasing use of the technology in social security decisions and resource allocation, says Human Rights Watch Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Digital surveillance of remote workers may increase enterprise risk

From productivity tools to security threats, we explore how digital surveillance is forcing remote workers towards shadow IT Continue Reading

By

• Matthew Staff

How to manage endpoint security in a hybrid work environment

The future of the workplace is clearly hybrid, but this has untold implications around endpoint security. How can businesses overcome these? Continue Reading

By

• Nicholas Fearn

Yoti develops age estimation algorithm for under-13s

Age estimation technology developed by Yoti is being pitched as a way of helping social media platforms and other online businesses protect younger internet users from harm Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

The Secret IR Insider’s Diary – this is not a fashion show

In the latest pages taken from their diary, the Secret IR Insider reveals why organisations should be worried about every threat, not just the latest and greatest Continue Reading

By

• The Secret IR Insider, Check Point

Security Assertion Markup Language (SAML)

Security Assertion Markup Language (SAML) is an open standard for sharing security information about identity, authentication and authorization across different systems. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

US seeks to extradite REvil affiliate who attacked Kaseya

US Department of Justice unseals charges against a Ukrainian national accused of being behind the summer 2021 REvil ransomware attack on Kaseya Continue Reading

By

• Alex Scroxton, Security Editor

How a cloud-first strategy helped save animals in the pandemic

In this week’s Computer Weekly, we talk to the RSPCA about how its cloud-first strategy helped to save animals throughout the pandemic. Data warehouses have been part of the IT landscape for 30 years – but are they now old technology, and what’s next? And we assess how Brexit has affected risk and resilience in the datacentre. Read the issue now. Continue Reading

REvil associates arrested in international ransomware crackdown

Two individuals suspected of conducting 5,000 REvil ransomware attacks were arrested by Romanian police last week as an international crackdown on the crime gang gathers pace Continue Reading

By

• Alex Scroxton, Security Editor

Gig economy workforce nearly trebles over five years

Over four million people in England and Wales now work for gig economy platforms at least once a week, marking a nearly threefold increase since 2016 Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Watching me, watching you – challenging the rise of digital surveillance at work

Unprecedented levels of digital monitoring at work is embedding a culture of surveillance, despite workers’ opposition to the practices, says Prospect Union Continue Reading

By

• Andrew Pakes, Prospect Union

How cosmetics retailer Lush made over its approach to authentication

Evolving approaches to IT at cosmetics retailer Lush meant the organisation’s previous approach to authentication was no longer up to scratch. Find out how it overcame this hurdle Continue Reading

By

• Alex Scroxton, Security Editor

Shock horror... Humans used for security validation instead of AI/M-L!

As a judge on the Tech Trailblazers awards, I can assure you of two security-related actuality wotsits: The onslaught of security start-ups is anything but slowing down; this year has seen a record ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Splunk’s cloud shift is paying off in APAC

Splunk’s Asia-Pacific business is growing faster than the rest of the company, but it’s not resting on its laurels Continue Reading

By

• Aaron Tan, TechTarget

Technology spending reaches record levels, fuelling jobs boom

Spending on IT has reached its highest levels for a decade but a shortage of skilled IT professionals could dampen growth Continue Reading

By

• Bill Goodwin, Computer Weekly

Immutable snapshots aim to neutralise ransomware

Snapshots – usually immutable anyway – get functionality to stop ransomware intruders moving or deleting snapshots, so customers know they have clean copies of data to restore from Continue Reading

By

• Antony Adshead, Storage Editor

cross-site scripting (XSS)

Cross-site scripting (XSS) is a type of injection attack in which a threat actor inserts data, such as a malicious script, into content from otherwise trusted websites. Continue Reading

By

• Ben Lutkevich, Site Editor
• Linda Rosencrance

cache poisoning

Cache poisoning is a type of cyber attack in which attackers insert fake information into a domain name system (DNS) cache or web cache for the purpose of harming users. Continue Reading

By

• Rahul Awati

US offers $10m reward for intel on DarkSide ransomware gang

US government puts up a $10m reward for information on the DarkSide ransomware gang, the group that attacked Colonial Pipeline six months ago Continue Reading

By

• Alex Scroxton, Security Editor

Managing supply chain risk requires new priorities, tools

Understanding that cost may not be the top driver in supply chain risk management is critical in the new normal. Learn why and what technologies can help. Continue Reading

By

• Diann Daniel, Executive Editor

vulnerability disclosure

Vulnerability disclosure is the practice of reporting security flaws in computer software or hardware. Continue Reading

By

• Katie Terrell Hanna
• Linda Rosencrance

The Netherlands works on resilience with large-scale national cyber exercise

For the Netherlands, the biggest challenge in a large-scale cyber crisis is to maintain speed while exercising due care Continue Reading

By

• Kim Loohuis

A For Automation

You might think that 3+ decades into the life of dedicated IT security products that said security landscape would be clearly defined and managed. In reality, it is anything but. The problem is not ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Spyware firm NSO and others added to US banned Entity List

US government bans target Israeli spyware makers and cyber firms in Russia and Singapore Continue Reading

By

• Alex Scroxton, Security Editor

Facebook self-imposes facial recognition moratorium

Facebook and Meta have committed to halting their use of facial recognition technology and deleting the biometric data of more than a billion people by the end of 2021, but will retain the underlying algorithms and software for potential use in future products Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

UK’s Labour Party hit by third-party data breach

Data on Labour Party members was recently compromised in an apparent cyber attack on a third-party data processor Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: SASE – marketing buzz or the future of security?

SASE architectures promise to prevent multiple types of cyber attacks, but deciding whether SASE is right for your organisation will require understanding whether SASE is a fit for your use cases in IT Continue Reading

By

• Martin Kuppinger, KuppingerCole

Report on Compliance (ROC)

A Report on Compliance (ROC) is a form that must be completed by all Level 1 Visa merchants undergoing a PCI DSS (Payment Card Industry Data Security Standard) audit. Continue Reading

By

• Paul Kirvan

BlackMatter ransomware crew shuts down, leaves victims in a bind

The BlackMatter ransomware gang appears to be winding down its activities, possibly due to pressure from law enforcement Continue Reading

By

• Alex Scroxton, Security Editor

Adelaide healthcare network digitises manual processes

The Central Adelaide Local Health Network has digitised manual processes in more than 20 speciality areas to improve patient experience and alleviate the workloads of frontline staff Continue Reading

By

• Aaron Tan, TechTarget

Electronic waste excluded from COP26 agenda

Data sanitation industry group calls on UK government to add electronic waste to the climate summit’s agenda Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Convicted Silk Road admin stripped of £500k in crypto earnings

Jailed Silk Road administrator Thomas White, aka Cthulhu, has been ordered to hand over more than £490,000 of illicit earnings Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Optimising privacy, post-GDPR

Airbus CyberSecurity CTO Paddy Francis explores the impact of regulation on data protection, and how it has changed how one goes about optimising data privacy in the enterprise Continue Reading

What the Budget means for UK technology

In this week’s Computer Weekly, we look through the Chancellor’s Autumn Budget and Spending Review to find what it means for the UK tech sector. As COP26 starts, we assess the green credentials of the IT industry. And we hear one CTO’s experiences of learning the privacy lessons of GDPR. Read the issue now. Continue Reading

Businesses and governments urged to take action over Trojan Source supply chain attacks

Businesses and governments have been put on alert to guard against Trojan Source hacking attacks Continue Reading

By

• Bill Goodwin, Computer Weekly

MPs and Lords grill Facebook over online safety efforts

Facebook answers British lawmakers’ questions about the social media giant’s efforts to ensure the safety of its users, as part of legislative security of the government's proposed online safety bill Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Is SASE mere vendor hype? It’s more nuanced than that

There’s no doubt that SASE is being overhyped, but nevertheless the concept holds value that security teams should not discount, according to PA Consulting analysts Continue Reading

By

• Toby Sibley, William Blackwell, Farrukh Ahmad

shoulder surfing

Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Continue Reading

By

• Katie Terrell Hanna

GDS secures up to £400m funding for One Login digital identity project

HM Treasury agrees to spending review bid from Cabinet Office to create the new single sign-on system for government over the next three years Continue Reading

By

• Bryan Glick, Editor in chief

Online Safety Bill puts user protection onus on platform providers

The Online Safety Bill will place new duties and responsibilities on online platforms accessible from the UK, but as it currently stands, it contains several grey areas Continue Reading

By

• Peter Ray Allison

Facebook rebrands to Meta amid continuing controversies

Facebook has changed its corporate name to Meta to support its work on the next generation of “social technologies”, but concerns around trust and privacy persist Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

data at rest

Data at rest is a term that is sometimes used to refer to all data in computer storage while excluding data that is traversing a network or temporarily residing in computer memory to be read or updated. Continue Reading

By

• Ben Lutkevich, Site Editor

Changing the rules against cyber attacks

UKRI’s John Goodacre reveals how projects supported by the Digital Security by Design Challenge aim to improve cyber security resilience, beginning with the very fundamentals of computing Continue Reading

By

• John Goodacre

CIA sought revenge against Julian Assange over hacking tool leaks, court hears

The CIA discussed kidnapping Julian Assange after WikiLeaks published thousands of documents revealing its arsenal of hacking tools, defence lawyers tell a London court Continue Reading

By

• Bill Goodwin, Computer Weekly

Illegal state surveillance in Africa ‘carried out with impunity’

Analysis of surveillance laws and practices in six African countries finds that existing privacy laws are failing to protect citizens from illegal digital surveillance, which is being facilitated and enabled by global tech companies Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How ransomware crews pile on the pressure to get victims to pay

Sophos researchers share some of the more common tactics ransomware gangs use to pressurise their victims into paying up Continue Reading

By

• Alex Scroxton, Security Editor

‘No-one extradited from UK to US has committed suicide,’ US tells court in Assange appeal

US government claims that a district judge has given WikiLeaks founder Julian Assange a ‘trump card’ to avoid extradition   Continue Reading

By

• Bill Goodwin, Computer Weekly

Government commits millions to security investment

Spending Review adds more than £750m of funding to improve cyber security resilience across government Continue Reading

By

• Alex Scroxton, Security Editor

Cyber sector growth exacerbating skills shortage

Data from security association (ISC)² shows demand for cyber pros is still outpacing supply as the sector continues an upward growth trajectory Continue Reading

By

• Alex Scroxton, Security Editor

DarkMarket takedown results in 150 arrests

A coordinated operation by law enforcement has seen 150 taken into custody amid allegations of buying or selling illicit goods on the dark web Continue Reading

By

• Alex Scroxton, Security Editor

Cyber experts on how to nobble a Nobelium attack

A recent spate of attempted Nobelium cyber attacks were mostly unsuccessful, but serve as a reminder to pay attention to some more fundamental aspects of security Continue Reading

By

• Alex Scroxton, Security Editor

encryption key

In cryptography, an encryption key is a variable value that is applied using an algorithm to a string or block of unencrypted text to produce encrypted text or to decrypt encrypted text. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Managing cyber risk by integrating supply chains

In this week’s Computer Weekly, our latest Buyer’s Guide examines the security and IT integration challenges of modern supply chains, especially post-pandemic – while we also talk to the CEO of software provider SolarWinds about how the company overcame its huge supply chain attack. And we look at how a small town in Lancashire was chosen as the HQ for the UK’s new National Cyber Force. Read the issue now. Continue Reading

Lacework expands into ANZ, eyes APAC market

DevSecOps supplier Lacework’s expansion into Australia and New Zealand will pave the way for a broader move into the Asia-Pacific region Continue Reading

By

• Aaron Tan, TechTarget

How Samlesbury, Lancashire became the home of the National Cyber Force

 Continue Reading

The Security Interviews: How SolarWinds came through its darkest hour

 Continue Reading

Managing cyber risk through integrated supply chains

 Continue Reading

At last, the UK has a mass-market digital identity system - now let's use it

Great news for all those who have followed the troubles and travails of digital identity in the UK for the past couple of decades. Finally, we have a digital ID system, developed in the public ... Continue Reading

By

• Bryan Glick, Editor in chief

Attempted hack causes Tesco website outage

Retailer’s website and app back after attempted hack caused problems over the weekend Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Multi-government operation targets REvil ransomware group

REvil has been forced offline by a multi-government hacking operation, marking the second time in 2021 that the group has gone dark Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

MEPs vote to expand Europol data mandate

The European Parliament has voted in favour of expanding Europol’s mandate to process data and develop AI tools, but critics claim it contradicts a previous vote which opposed using new technologies to predict crime Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Airport operator MAG boosts threat visibility with hybrid SOC

With budget concerns weighing heavy during the pandemic, Manchester Airports Group ditched an impending capex-heavy cyber investment in favour of a hybrid managed/in-house approach. Learn more about its experience Continue Reading

By

• Alex Scroxton, Security Editor

script kiddie

Script kiddie is a derogative term that computer hackers coined to refer to immature, but often just as dangerous, exploiters of internet security weaknesses. Continue Reading

By

• Ben Lutkevich, Site Editor

APAC organisations warm to zero trust

Two-thirds of APAC organisations have a zero-trust strategy even as they grapple with the lack of skills and other organisational challenges, study finds Continue Reading

By

• Aaron Tan, TechTarget

US intelligence agencies issue advisory on BlackMatter gang

Joint advisory on ransomware gang warns about potential of further attacks on critical infrastructure providers Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

LightBasin hackers breach 13 telcos in two years

Hackers have obtained an undisclosed volume of subscriber information and call metadata in a sustained campaign against telecommunications firms Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Police IT buyers should compel suppliers to prove AI claims

House of Lords told that UK law enforcement bodies should use their position as buyers to compel private sector suppliers to divulge more information about how their AI-powered technologies work Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Back on the office network: What are the risks for mobile users?

Many people are returning to offices and bringing their mobile devices with them. What are the cyber security implications of this? Continue Reading

By

• Nicholas Fearn

Time to take a step back on police use of facial recognition

We’ve all seen the detective shows on TV. The cops find a CCTV picture of the likely “perp”. The put-upon junior detective is tasked with wading through a database of photos in the hope of finding ... Continue Reading

By

• Bryan Glick, Editor in chief

How Samlesbury, Lancashire became the home of the National Cyber Force

The National Cyber Force, a new branch of the military, is gearing up to fight battles in cyber space from the fields of Lancashire. Its presence is expected to bring a high-tech renaissance to the region Continue Reading

By

• Bill Goodwin, Computer Weekly

DCMS appoints Plexal to drive telecoms diversity strategy

Government chooses UK innovation company to understand and develop the role of SMEs in the telecoms market with particular reference to how to create a diverse market that supports the creation of home-grown, sovereign technology Continue Reading

By

• Joe O’Halloran, Computer Weekly

No easy fix for vulnerability exploitation, so be prepared

Vulnerability management and disclosure is a tricky business with ethical and business ramifications for software vendors, CISOs and ethical hackers alike – and CISOs sit right in the middle of this Continue Reading

By

• Andrew Morris, Turnkey Consulting

Uniform Resource Identifier (URI)

A Uniform Resource Identifier (URI) is a character sequence that identifies a logical (abstract) or physical resource -- usually, but not always, connected to the internet. A URI distinguishes one resource from another. Continue Reading

By

• Rahul Awati
• Fred Churchville, TechTarget