IT security

CyberUK, bees and datacentres, Red Cross digital mapping – Computer Weekly Downtime Upload podcast

In this episode of the Computer Weekly Downtime Upload podcast, Caroline Donnelly and Brian McKenna are joined by Alex Scroxton, security editor, to discuss CyberUK, bees and datacentres, and the British Red Cross’ use of digital mapping to combat Covid-19 Continue Reading

By

• Alex Scroxton, Security Editor
• Caroline Donnelly, Senior Editor, UK
• Brian McKenna, Senior Analyst, Business Applications

Lack of developer attention to cloud security prompts alerts

The personal data of over 100 million Android users may have been put at risk through a variety of cloud service misconfigurations Continue Reading

By

• Alex Scroxton, Security Editor

ethical hacker

An ethical hacker, or white hat hacker, is an information security expert authorized by an organization to penetrate computing infrastructure to find security vulnerabilities a malicious hacker could exploit. Continue Reading

By

• Garry Kranz
• Linda Rosencrance
• Michael Cobb

hacktivism

Hacktivism is the act of misusing a computer system or network for a socially or politically motivated reason. Continue Reading

By

• Ben Lutkevich, Site Editor
• Madelyn Bacon, TechTarget

Create a remote access security policy with this template

The expansion of remote work has created complicated security risks. Get help developing and updating a remote access security policy. Download our free template to get started. Continue Reading

By

• Paul Kirvan

Pandemic tech use heightens consumer privacy fears

Report on consumer attitudes to privacy finds evidence of a “heightened sense of fear” as digital footprints expand inexorably Continue Reading

By

• Alex Scroxton, Security Editor

Malicious scans for at-risk systems start minutes after disclosure

Statistics collated by Palo Alto Networks reveal malicious actors begin scanning the internet for systems at risk of new CVEs within minutes Continue Reading

By

• Alex Scroxton, Security Editor

Throwback Thursday: Even data fragmentation has gone virtual

If there’s one thing that our report Storage Anywhere and Everywhere from eight years ago reminds us, it’s that the risks of uncontrolled data growth are nothing new. As our contribution to the bit ... Continue Reading

By

• Bryan Betts, Freeform Dynamics

HP taps micro virtual machines in endpoint security

HP’s Wolf Security technology stack uses an endpoint security controller to run computing tasks in micro virtual machines so that any potential malware can be isolated and contained Continue Reading

By

• Aaron Tan, TechTarget

UK government publishes framework on automated decision-making

The framework focuses on making the use of algorithms and automated decision-making systems within the public sector more ethical, transparent and accountable Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Reports of stolen Irish health service data being leaked online

Leaking of deeply confidential and personal information on patient healthcare marks a new low for the criminal Conti gang Continue Reading

By

• Alex Scroxton, Security Editor

Barclays first bank to publish online scam refund details

All banks must be transparent about the proportion of victims of authorised push payment fraud they refund, says consumer rights organisation Which? Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Flexxon bakes AI into SSDs to fight unknown threats

Singapore-based Flexxon has developed a solid-state drive that uses artificial intelligence to fend off malware and other unknown threats Continue Reading

By

• Aaron Tan, TechTarget

From Talk to Action - Joining up Cyber, Resilience, Fraud and On-line Safety Skills.

The current pipeline supplies less than half the demand. Most of that demand is not for full-time professionals with technical skills. It is for those with the people skills to manage business risk ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Microsoft EU Data Boundary dubbed ‘smoke and mirrors’

Data protection experts claim Microsoft’s decision to create an EU Data Boundary is a tacit admission that it routinely transfers and processes the personal data of European citizens outside the bloc Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Government response to National Data Strategy consultation depicts data as ‘asset, not threat’

Government responds to consultation with a promise of delivery, putting an emphasis on data as an asset, not a threat, and finding respondents keen on levelling up Continue Reading

By

• Brian McKenna, Senior Analyst, Business Applications

Cisco acquires Kenna Security amid security expansion

Cisco announces a new acquisition alongside service enhancements around XDR and SASE in support of its security customers Continue Reading

By

• Alex Scroxton, Security Editor

Irish High Court dismisses legal bid by Facebook over EU-US data transfers

Latest twist in long-running legal battle sees Facebook lose legal bid to prevent the Irish Data Protection Commissioner suspending its transfer of data about European citizens to the US Continue Reading

By

• Bill Goodwin, Computer Weekly

Australian budget lends support to digital economy

Australia’s A$1.2bn Digital Economy Strategy ticks most of the right boxes, but some industry experts say areas such as broadband infrastructure and artificial intelligence are still underfunded Continue Reading

By

• Stephen Withers

Colonial Pipeline ransomware attack has grave consequences

The ramifications of a major ransomware attack against a US fuel pipeline operator could spread far and wide Continue Reading

The real-life consequences of ransomware attacks

In this week’s Computer Weekly, after a ransomware attack shut a major US oil pipeline, we examine the real-life consequences for organisations facing similar threats. We ask the experts for their top tips in reducing datacentre running costs. And we hear how data science skills are helping government make better decisions. Read the issue now. Continue Reading

Conti ransomware syndicate behind attack on Irish health service

More details continue to emerge of the significant ransomware attack on Ireland’s HSE Continue Reading

By

• Alex Scroxton, Security Editor

NCSC study to probe disability and neurodiversity in cyber

National Cyber Security Centre and KPMG have launched a new diversity study aiming to capture benchmarks on disability and neurodiversity in cyber Continue Reading

By

• Alex Scroxton, Security Editor

Government seeks input on supply chain security

Amid concerns that too few companies are addressing vulnerabilities in their supply chain, DCMS is opening a consultation on new measures to enhance security Continue Reading

By

• Alex Scroxton, Security Editor

Colonial Pipeline paid $5m ransom, reports say

Colonial Pipeline may have paid a significant ransom within hours of being attacked, it has emerged, but it’s unlikely the story ends here Continue Reading

By

• Alex Scroxton, Security Editor

cipher block chaining (CBC)

Cipher block chaining (CBC) is a mode of operation for a block cipher -- one in which a sequence of bits are encrypted as a single unit, or block, with a cipher key applied to the entire block. Continue Reading

By

• TechTarget Contributor

Irish health service hit by major ransomware attack

IT systems in hospitals across Ireland have been switched off following a significant ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Dutch police used deep learning model to predict threats to life

Dutch police developed a deep learning model in their EncroChat investigation to predict which messages contain serious threats to life Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor
• Bill Goodwin, Computer Weekly

The shape of fraud and cyber crime: 10 things we learned from 2020

While a pandemic-driven increase in cyber crime and an exacerbation of existing fraud trends were, to a large extent, to be expected, the LexisNexis Risk solutions UK cybercrime report 2020 still contained a few surprises Continue Reading

By

• Neira Jones

Okta and Auth0 to expand APAC coverage

Okta’s acquisition of rival Auth0 will enable both companies to expand their footprint in the Asia-Pacific region as demand for identity management services soars amid the pandemic Continue Reading

By

• Aaron Tan, TechTarget

NHSX data strategy due in ‘a few weeks’

NHSX director of policy and strategy Simon Madden says the long-awaited strategy is expected to “trigger huge debates” on issues such as access, choice and transparency, and will be published in draft form shortly to allow for consultation Continue Reading

By

• Lis Evenstad

Publishing exploit code does more harm than good, says report

Disclosing exploit code before patches are available gives malicious actors a ‘massive’ head-start, says Kenna Security Continue Reading

By

• Alex Scroxton, Security Editor

Biden beefs up public-private security cooperation

Joe Biden has signed a new Executive Order to harden US cyber security and government networks, with an emphasis on information sharing Continue Reading

By

• Alex Scroxton, Security Editor

CW Benelux: Netherlands university launches centre of expertise in applied AI

Amsterdam University of Applied Sciences has launched a centre of expertise in applied artificial intelligence, and students from all faculties of the university will learn how to apply AI in their field of study. Also in this issue, read why a training ‘roadmap’ is needed to get Netherlands police officers up to speed with tackling cyber crime. Continue Reading

Refuge launches tech safety site for domestic abuse victims

Created with the help of survivors, Refuge’s resource site offers guidance on protecting yourself from tech-enabled domestic abuse Continue Reading

By

• Alex Scroxton, Security Editor

CISOs weathered the pandemic well, but at personal cost

Over 80% of CISOs think their existing security capabilities stayed strong during the worst of the Covid-19 pandemic, but now face stress and burnout on an unheard-of scale Continue Reading

By

• Alex Scroxton, Security Editor

Verizon DBIR underscores year of unprecedented cyber challenge

Verizon 2021 Data Breach Investigations Report draws predictable conclusions as the impact of the Covid-19 pandemic continues to be felt Continue Reading

By

• Alex Scroxton, Security Editor

UK government publishes Online Safety Bill draft

Bill builds on previous commitments by the government, which has added new measures to uphold democracy and freedom of speech while making tech giants more accountable Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Inside DarkSide: Researchers share intel on break-out cyber gang

Security researchers swap information on the newly famous DarkSide ransomware gang, the group that doesn’t appear to understand what ‘being a criminal’ actually means Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 2021: NCSC encourages startups to invest in cyber

National Cyber Security Centre is launching bespoke cyber security guidance aimed at the UK’s valuable startup community Continue Reading

By

• Alex Scroxton, Security Editor

UK to fund national cyber teams in Global South

Government will commit millions of pounds to supporting vulnerable countries in establishing cyber capacity Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft fixes four critical bugs on lighter Patch Tuesday

Four critical RCE vulnerabilities put users of various Microsoft products at risk, and should be patched right away Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Why helpful bots could hurt vaccine roll-outs

Earlier this year, spikes in traffic to websites containing information about Covid-19 vaccines were attributed by Imperva to automated bots scraping data. Why is that a problem? Continue Reading

By

• Alex Scroxton, Security Editor

UK Plc invited to sign up for Early Warning of cyber incidents

The launch of the Early Warning incident notification service is among the enhancements being made by the NCSC to its service packages Continue Reading

By

• Alex Scroxton, Security Editor

NCSC cyber guidance targets cloud and home working

The NCSC’s refreshed cyber security guidance for larger organisations places particular emphasis on cloud, home working and ransomware Continue Reading

By

• Alex Scroxton, Security Editor

Collaboration key to success of UK’s Cyber Security Council

The founders of the UK’s Cyber Security Council have been setting out their plans to professionalise the cyber sector at the NCSC’s CyberUK 2021 event Continue Reading

By

• Alex Scroxton, Security Editor

Government to reform Computer Misuse Act

Home secretary Priti Patel will explore reforming the Computer Misuse Act as calls mount for the 31-year-old law to be updated to reflect the changed online world Continue Reading

By

• Alex Scroxton, Security Editor

SolarWinds CEO calls for collective action against state attacks

SolarWinds CEO tells NCSC’s CyberUK conference he is exploring the possibility of collaborating with other companies on collective cyber action against attacks backed by nation states Continue Reading

By

• Alex Scroxton, Security Editor

Swedish court finds ambiguities in hacked EncroChat cryptophone evidence

Defence lawyer claims evidence obtained by hacking the EncroChat encrypted phone network has ‘no legal’ value following Swedish appeal court ruling Continue Reading

By

• Bill Goodwin, Computer Weekly
• Sara Nkwe Assarsson

Colonial Pipeline ransomware attack has grave consequences

The ramifications of a major ransomware attack against a US fuel pipeline operator could spread far and wide Continue Reading

By

• Alex Scroxton, Security Editor

NCSC Active Cyber Defence blocks surge of pandemic scams

The NCSC responded to a surge in online scams last year as it moved to protect both the general public and critical national services during the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

APAC career guide on cloud computing

Besides having engineering chops and certifications, aspiring cloud professionals should have curiosity and soft skills to succeed in the evolving cloud computing landscape Continue Reading

By

• Aaron Tan, TechTarget

How to support a hybrid workforce

As the economy opens up, organisations are rethinking the idea of office-based work – and a more flexible approach is on the cards Continue Reading

By

• Cliff Saran, Managing Editor

Despite confusion, zero-trust journey underway for many

Zero trust is a catchy phrase with seemingly lofty goals. Uncover the reality behind one of infosec's hottest buzzphrases, and learn why it's within reach for many companies today. Continue Reading

By

• Sharon Shea, Executive Editor

One size does not fit all - current cyber security practice as revealed by the DCMS Breaches Survey

The report is an excellent snapshot but it also illustrates why most business leaders (large or small) find it so hard to take cyber security seriously until it is put into the context of their own ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

How do I get my users to pay attention to security training?

As cyber security risks grow daily, businesses must educate staff about these through cyber awareness training. But how can they ensure this is taken seriously by employees? Continue Reading

By

• Nicholas Fearn

NCSC, CISA publish new information on Russia’s Cozy Bear

New intelligence from UK and US cyber agencies suggests that APT29, or Cozy Bear, has been switching up its tactics Continue Reading

By

• Alex Scroxton, Security Editor

NCSC publishes smart city security guidelines

Guidance for local authorities, IT and cyber professionals aims to ensure the security of connected, smart city projects Continue Reading

By

• Alex Scroxton, Security Editor

session key

A session key is an encryption and decryption key that is randomly generated to ensure the security of a communications session between a user and another computer or between two computers. Continue Reading

By

• TechTarget Contributor

Cyber accreditation to improve legal standing of security pros

Institute of Cyber Digital Investigations Professionals will help incident responders and cyber investigators get the professional recognition they deserve Continue Reading

By

• Alex Scroxton, Security Editor

Securing the UK's emerging smart cities

UK councils have a huge opportunity to improve services through the use of smart city technologies - but they must avoid the cyber security risks, says the government's digital minister Continue Reading

By

• Matt Warman, Digital minister

Reddit enlists HackerOne to run public bug bounty programme

Online community platform is opening up its HackerOne bug bounty programme to any ethical hacker who cares to have a look under the bonnet Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware, supply chain attacks show no sign of abating

Security experts at Black Hat Asia 2021 discuss the state of ransomware and supply chain attacks, two of the most common attack vectors that offer high returns for threat actors Continue Reading

By

• Aaron Tan, TechTarget

kill switch

A kill switch in an IT context is a mechanism used to shut down or disable a device or program. Continue Reading

By

• TechTarget Contributor

Government urged to add scam protections to Online Safety Bill

Group of organisations calls for the government to use the Online Safety Bill to protect people from cyber scams Continue Reading

By

• Alex Scroxton, Security Editor

Scammers accidentally reveal fake Amazon review data

More than 13 million records relating to an organised fake review scam have been found on an unsecured ElasticSearch database, implicating hundreds of thousands of people in unethical behaviour Continue Reading

By

• Alex Scroxton, Security Editor

Google to introduce mandatory MFA for users

In future, holders of Google accounts will have no option but to use multifactor authentication if they want to use the firm’s services Continue Reading

By

• Alex Scroxton, Security Editor

HSBC blocks £249m in UK fraud with voice biometrics

HSBC voice recognition technology has reduced telephone banking fraud as demand for the channel increases Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Why ITAM can aid IT-fuelled business recovery

As a sense of normality returns, we look at why IT asset management is the stealth tool for clearing a path towards greater digitisation Continue Reading

By

• Cliff Saran, Managing Editor

Dysfunctional cyber, network teams disrupt digital transformation

Despite shared goals, combative and dysfunctional relationships within specialist tech teams are putting digital transformation projects at risk, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Sophos: How timely intervention stopped a ProxyLogon attack

A recent incident at an undisclosed customer sheds new light on how malicious actors exploit unpatched Microsoft Exchange servers Continue Reading

By

• Alex Scroxton, Security Editor

How GCHQ proposes to implement and use ethical AI

The rise of cyber crime and the escalating threat vectors facing the UK have led GCHQ to invest in automated threat detection and response systems to meet this challenge, as well as liaising with the private sector for the first time Continue Reading

By

• Peter Ray Allison

Deploying productivity monitoring software ethically

While software that tracks the activities of staff can be helpful to companies with a remote workforce, managers must consider employees’ concerns and privacy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Half of organisations breached via a third party in 12 months

New report highlights the risks of outsourcing key business processes without paying due care and attention to your service provider’s security Continue Reading

By

• Alex Scroxton, Security Editor

The practical steps needed to accelerate a UK digital identity ecosystem

The draft digital identity framework published by the UK government highlights the importance of learning from the private sector and existing standards to accelerate deployment and citizen adoption Continue Reading

By

• Martin Wilson, Digital Identity Net

New standard to simplify IoT device onboarding

Fido Alliance’s device onboarding protocol will automate the process of connecting internet-of-things devices to device management platforms while improving security Continue Reading

By

• Aaron Tan, TechTarget

EncroChat: Top lawyer warned CPS of risk that phone hacking warrants could be unlawful

Lord David Anderson QC warned prosecutors that there were formidable arguments against the lawfulness of a police operation to infiltrate the encrypted phone network, EncroChat Continue Reading

By

• Bill Goodwin, Computer Weekly

MPs accuse government of unduly interfering in information commissioner appointment

Cross-party group of MPs says government is influencing the appointment of a new information commissioner by explicitly seeking a candidate who will support its policy agenda, rather than regulate independently Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

End of support for Build 1909 leaves some Windows open to attack

Biannual Windows updates free IT staff from major updates, but some people prefer older builds of Windows, which leaves a gaping security hole Continue Reading

By

• Cliff Saran, Managing Editor

The case for vaccine passports: the real world versus the digital world

What are the security issues challenges presented by vaccine passports, and how should they be designed and used with ethics and privacy in mind? Continue Reading

By

• Andy Jones and Alex Jordan

Gartner SASE 2021 Roadmap - You Know It Makes Sense...

As observed before in this blog, few of Gartner’s ‘inventions’ have caught on as quickly as SASE – Secure Access Service Edge. From traditional firewall vendors to declared SASE specialists, ... Continue Reading

By

• Steve Broadhead, Broadband Testing

G7 countries to cooperate on digital regulation

Digital and technology ministers outline their agenda for how technology can be used to facilitate the post-Covid recovery, signalling closer collaboration in key areas of the digital economy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Northern Ireland pilots security training plan for 16-25s

Pilot scheme in Northern Ireland aims to widen access to cyber security careers Continue Reading

By

• Alex Scroxton, Security Editor

How to tackle intellectual property crime

Crimes against intellectual property are big business for organised crime groups, commercial competitors and foreign states alike. In the first of a series of legal columns, David Cowan offers a practical approach Continue Reading

By

• David Cowan, National University of Ireland, Maynooth

Covid-19 security challenges leave bank customers at risk

Challenges arising from the pandemic have left gaping holes in banking security, putting consumers at risk of fraud Continue Reading

By

• Alex Scroxton, Security Editor

Recruiters can’t afford to hold out for cyber ‘unicorns’

The perfect security candidate is hard to find, so hiring policy needs to be more pragmatic Continue Reading

By

• Alex Scroxton, Security Editor

Office 365 compromise likely led to Merseyrail ransomware attack

Compromise of Merseyrail employee data seems to have begun after a key email account was hacked Continue Reading

By

• Alex Scroxton, Security Editor

NHS App to serve as vaccine passport for foreign holidays

Existing NHS App will have vaccine passport functionality added to it, transport secretary confirms Continue Reading

By

• Alex Scroxton, Security Editor

Backup failure: Four key areas where backups go wrong

We look at the key ways that backups can fail – via software issues, hardware problems, trouble in the infrastructure and good old human error – and suggest ways to mitigate them Continue Reading

By

• Antony Adshead, Storage Editor

Applying web application reconnaissance to offensive hacking

Learn how to apply web application reconnaissance fundamentals to improve both offensive and defensive hacking skills in an excerpt of 'Web Application Security' by Andrew Hoffman. Continue Reading

By

• Katie Donegan, Social Media Manager

Collaboration is key to a secure web application architecture

Author Andrew Hoffman explains the importance of a secure web application architecture and how to achieve it through collaboration between software and security engineers. Continue Reading

By

• Katie Donegan, Social Media Manager

UK supermarkets to trial age estimation tech for alcohol purchases

Biometric age estimation technology developed by Yoti to be tested in UK supermarkets for alcohol purchases as part of government-led digital identities initiative Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Total cost of ransomware attack heading towards $2m

Sophos’ latest study finds that ransomware attacks are proving increasingly disruptive to their victims’ finances Continue Reading

By

• Alex Scroxton, Security Editor

Leaky Azure storage account puts software developer IP at risk

Source code for multiple products was left exposed in an unsecured Microsoft Azure cloud storage account, say researchers, but attributing responsibility for the error has proved difficult Continue Reading

By

• Alex Scroxton, Security Editor

Why we need to reset the debate on end-to-end encryption to protect children

Private messaging is the front line of abuse, yet E2EE in its current form risks engineering away the ability of firms to detect and disrupt it where it is most prevalent Continue Reading

By

• Andy Burrows, NSPCC

Apple OS updates patch multiple security holes

The much-heralded release of the privacy-centric iOS 14.5 also brings patches for multiple CVEs, and users of Apple smartphones, tablets and notebooks are best advised to update as soon as possible Continue Reading

By

• Alex Scroxton, Security Editor

Uber drivers’ resistance and the gig economy – Computer Weekly Downtime Upload podcast

In this episode of the Computer Weekly Downtime Upload podcast, Caroline Donnelly and Brian McKenna are joined by Sebastian Klovig Skelton to discuss the legal campaign by Uber drivers for the right to be recognised as workers Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor
• Caroline Donnelly, Senior Editor, UK
• Brian McKenna, Senior Analyst, Business Applications

North London school wins NCSC girls’ cyber challenge

Highgate School in North London is the winner of this year’s CyberFirst Girls security competition Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Making sense of outbound email security

Screening inbound emails is an accepted part of an organisation’s security posture, but the topic of securing outbound traffic is less often discussed. Zivver’s Rick Goud is on a mission to change this Continue Reading

By

• Alex Scroxton, Security Editor

Justice at last in Post Office IT scandal

In this week’s Computer Weekly, 12 years after we broke the story, victims of the Post Office IT scandal finally have their criminal convictions overturned. We take a virtual tour of a Microsoft datacentre and meet a server called ‘Mega-Godzilla Beast’. And we find out how technology is transforming Nationwide Building Society. Read the issue now. Continue Reading