IT security

The future of network-connected device security

The proliferation of poorly secured network-connected devices has prompted the UK government to publish new best practice guidelines. Do these go far enough? Continue Reading

By

• Peter Ray Allison

‘Open-minded’ DVSA cuts cost of MOT testing

Government agency harnesses customised open source platform to ensure data security while cutting costs and plans to extend its MOT testing capability to do the same for drivers’ theory tests Continue Reading

By

• Christian Annesley

Financial institutions’ data at risk despite security spending

Despite increased spending on cyber security, digital transformation and advanced attacks mean financial institutions’ data is still at risk, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Testing applications in production vs. non-production benefits

To ensure proper application security testing, production and non-production systems should both be tested. In this tip, expert Kevin Beaver weighs the pros and cons. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Security Think Tank: Basic steps to countering malware comms

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure they detect such methods and that all C&C systems are removed, including "sleepers" designed to be activated at a future date Continue Reading

By

• Petra Wenham

100 million Quora.com user details exposed

Question-and-answer site is the latest organisation to admit a breach of users’ personal data, with industry commentators calling out credential theft as a top cause of such breaches Continue Reading

By

• Warwick Ashford, Senior analyst

Liberty heads for judicial review over Investigatory Powers Act

The UK's powers to conduct supsicionless bulk surveillance on individuals and organisations face a legal challenge in the high court next year Continue Reading

By

• Bill Goodwin, Computer Weekly

Security Think Tank: Combine tech, process and people to block malware comms

As attackers begin to use multiple command and control systems to communicate with backdoors and other malware, how can organisations ensure that they detect such methods and that all C&C systems are removed, including "sleepers" designed to be activated at a future date. Continue Reading

By

• Maxine Holt, Omdia

Digital identity market welcomes plan to hand Gov.uk Verify to private sector

Players in the UK digital identity community welcome the clarity over the future of Verify, but question marks remain over prospects for government ID system Continue Reading

By

• Bryan Glick, Editor in chief

BT announces new head of security business

BT has appointed a former law enforcement officer and BT investigator as the new head of its security business Continue Reading

By

• Warwick Ashford, Senior analyst

UK government commits to opening up data in bid to push adoption of AI

Opening up data is vital to government plans to push adoption of artificial intelligence across all sectors of the UK economy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Police investigations into cyber crime up 14% in a year

Officers forced to follow up over 2,500 complaints of Instagram, Facebook, email and website hacking, and Bitcoin ransom, despite a rise in violent crime, report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Brexit and digital identity – avoiding future restrictions on digital trade

The UK has been a major contributor to European efforts to establish cross-border digital identities. Governments need to ensure that Brexit does not introduce unwanted restrictions that harm digital trade Continue Reading

By

• Gillan Ward, ID Crowd

Cyber crime most significant harm in UK, says top cyber cop

Cyber crime is the most significant harm in the UK, according to the cyber lead at the City of London Police, which is the national lead for online crime Continue Reading

By

• Warwick Ashford, Senior analyst

Marriott data breach highlights basic failings

A breach of a guest reservation database of the Starwood division of the Marriott International hotel group highlights basic personal data protection failures Continue Reading

By

• Warwick Ashford, Senior analyst

WannaCry borderline national cyber emergency

The May 2017 WannaCry attack, which disrupted services at one-third of NHS trusts and more than 600 primary care organisations is the closest the UK has come to a national cyber emergency, says the NCSC Continue Reading

By

• Warwick Ashford, Senior analyst

E-commerce sites warned of heightened DDoS threat

E-commerce sites are being urged to ensure that they have adequate DDoS protection ahead of the vital holiday trading season after attacks ramped up on Black Friday and Cyber Monday Continue Reading

By

• Warwick Ashford, Senior analyst

UK cyber security strategy making ‘good progress’

The National Cyber Security Strategy is making good progress, but there is much left to be done, according to a Cabinet Office official Continue Reading

By

• Warwick Ashford, Senior analyst

120,000 police officers to receive cyber security training

Cisco is partnering with UK police forces to offer cyber security training through the Cisco Networking Academy Continue Reading

By

• Alex Scroxton, Security Editor

Cyber resilience lacking due to apathy of UK leaders

An unwillingness to accept that cyber is a real threat to critical national infrastructure by UK political and business leaders has resulted in a lack of resilience, says security industry veteran Continue Reading

By

• Warwick Ashford, Senior analyst

CIO interview: Stephen Docherty on NHS data sharing

The Cambridge Analytica scandal raised awareness about privacy. Stephen Docherty, CIO of South London and Maudsley NHS Trust, explains why Continue Reading

By

• Cliff Saran, Managing Editor

FCA deeply concerned as no end in sight for IT failures in banking

The FCA has reported a massive increase in the number of banking IT failures in the UK and admitted there is no end in sight Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Businesses failing to win consumer trust

Businesses are still largely failing to win the trust of consumers to keep their personal data safe as data breaches continue to make headlines Continue Reading

By

• Warwick Ashford, Senior analyst

How bring-your-own-land attacks are challenging enterprises

FireEye researchers developed a new technique called bring your own land, which involves attackers creating their own tools. Discover more about how this works with Nick Lewis. Continue Reading

By

• Nick Lewis

York teen crowned 2018 UK cyber security champion

Teenager beat off competition from 41 other cyber security enthusiasts from across the UK, and six from Singapore, in the UK Cyber Security Challenge final Continue Reading

By

• Warwick Ashford, Senior analyst

ICO fines Uber £385,000 for data protection failings

Like Facebook, Uber has escaped a potentially much higher fine for data protection failings because the 2016 breach that affected millions of UK customers is not covered by the GDPR Continue Reading

By

• Warwick Ashford, Senior analyst

GDPR is encouraging UK IT directors to pay cyber ransoms

As predicted ahead of the General Data Protection Regulation enforcement deadline, research shows that fear of fines under the new laws is making some firms more likely to pay cyber ransoms Continue Reading

By

• Warwick Ashford, Senior analyst

Take the pain out of software patching

In this week’s Computer Weekly, we look at one of the oldest pain points for IT departments – software patching – and ask how to make it less complex across the enterprise. We examine the rise of Kubernetes, the open source container orchestration system that’s gathering popularity for cloud-native applications. And we look at the issues around storage strategy to support a multicloud environment. Read the issue now. Continue Reading

Unprecedented actions by Commons committee augur badly for Facebook

House of Commons’ serjeant-at-arms effectively arrested the CEO of a US software company and frogmarched him to Parliament, where he was told he would be imprisoned if he failed to hand over papers on Facebook Continue Reading

By

• Kevin Cahill

Interview: Roger Taylor, chair, Centre for Data Ethics and Innovation

Chair of the new Centre for Data Ethics and Innovation says collaboration is vital for developing effective frameworks to manage the proliferation of AI and data-driven technologies Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Black Friday On My Mind

Ah – tomorrow – the dreaded Black Friday, yet another unwanted import from Trumpland. But, JASK – already previously subjected here to the blogging treatment – has some security advice to offer as ... Continue Reading

By

• Steve Broadhead, Broadband Testing

ICO finds Metropolitan Police's Gangs Matrix seriously breaches data protection laws

A year-long ICO investigation has highlighted major problems with how the Metropolitan Police handles and shares the personal data of individuals on its Gangs Matrix Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

IT sector advises Swedish government on elections and voting system

 Continue Reading

CW Nordics: Swedish IT sector advises on election security

The security measures assembled and implemented around the 2018 election in Sweden were devised in consultation with leading actors within the country’s private IT sector. Also read about how Denmark’s ambition to become a leading ocation for hyperscale datacentres is gaining momentum, and why Estonia wants to recruit IT professionals from the UK. Continue Reading

IBM pushes boundaries of AI, but insists companies take an ethical approach

Researchers at IBM are pushing the boundaries of what artificial intelligence and machine learning can do, but remain wary of the ethical implications that accompany the proliferation of this technology Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How voice biometrics catches fraudsters

Telephone banking is often seen as the forgotten channel in multi-channel banking, something that fraudsters are now exploiting Continue Reading

By

• Cliff Saran, Managing Editor

Dutch audit finds Microsoft Office leaks confidential data

The diagnostics Microsoft Office collects from users should be a source of concern for any government CISO, according to a DPIA audit Continue Reading

By

• Cliff Saran, Managing Editor

Police challenged over refusal to disclose files on WikiLeaks staff

Lawyers will challenge the Metropolitan Police Service today to confirm or deny whether it holds correspondence with US law enforcement about three WikiLeaks staff – including two UK citizens – in a freedom of information tribunal Continue Reading

By

• Bill Goodwin and Niels Ladefoged

Government lacks cyber resilience leadership, according to MPs

The government lacks political leadership and urgency in dealing with cyber threats, according to Joint Committee on National Security Strategy, calling for a minister in charge of delivering cyber resilience Continue Reading

By

• Lis Evenstad

Credit card fraud in ANZ showing no signs of abating

The value of fraudulent transactions more than doubled that of legitimate purchases during the third quarter this year Continue Reading

By

• Beverley Head

Three factors marginalising the CISO role

Chief information security officers are typically marginalised due to three factors, and de-coupling the technical and managerial aspects of the job will enable empowerment, says consultant Continue Reading

By

• Warwick Ashford, Senior analyst

What are today's top 3 network security challenges?

A significant shortage of cybersecurity staff, poorly configured firewalls and unmanaged end-user mobile devices are some of the top network security threats. Continue Reading

By

• Amy Larsen DeCarlo, GlobalData

How does Thanatos ransomware decryptor tool restore data?

Cisco Talos' Thanatos ransomware decryptor can recover files affected by new ransomware that won't decrypt ransomed files even when a ransom has been paid. Continue Reading

By

• Nick Lewis

UK firms in the dark around the impact of cyber attacks

UK firms have a long way to go in building the business resilience required to withstand cyber threats and other major disruptions, a study shows Continue Reading

By

• Warwick Ashford, Senior analyst

Securing the SD-WAN: The next network challenge

Every time an enterprise weighs up whether or not to try SD-WAN, security is an essential part of the picture Continue Reading

By

• Christian Annesley

Many firms still stuck in GDPR prep phase six months after its initiation

Six months after the GDPR compliance deadline, many companies are struggling to make data protection principles part of everyday business, says PwC’s GDPR and data protection lead Continue Reading

By

• Warwick Ashford, Senior analyst

Why is hiring a government chief security officer such a tricky business?

Security bosses and CIOs weigh in on why they think the government is struggling to recruit a chief security officer Continue Reading

By

• Sooraj Shah

Inside one of the world’s largest bug bounty programmes

Trend Micro’s Zero Day Initiative may be the top external supplier of software bug reporting for Microsoft and Adobe, but that does not mean it purchases every type of bug. Continue Reading

Burden of data protection rests on firms and governments

A senior executive at Singapore’s Cyber Security Agency stressed the role of corporate data governance and government regulations in raising the bar on cyber security. Continue Reading

Global IoT security standard remains elusive

Despite the lack of a global internet of things security standard, existing security frameworks are on the same page in areas such as device upgradability and data stewardship. Continue Reading

CW ASEAN: Blockchain is no ‘magic wand’ for security

Blockchain is all the rage, although the technology is so much more than just about bitcoin and cryptocurrencies. In this issue of CW ASEAN, we examine how blockchain is being applied in cyber security, and whether the technology is really as secure as claimed by its proponents. Read the issue now. Continue Reading

Australian government agency trials secure cloud service

The Digital Transformation Agency has become the first government agency in Australia to test the use of Microsoft Office 365 in a secure cloud environment. Continue Reading

Australia’s health sector reports most data breaches again

In the first full quarter since Australia’s mandatory breach disclosure scheme came into effect, healthcare providers reported the most data breaches amid controversy over the national health record system. Continue Reading

New Zealand to run national cyber security exercise

The island-nation will test the resilience of its critical infrastructure in November 2018, bringing together multiple agencies to protect assets of national significance. Continue Reading

CW ANZ: Exploring blockchain

Blockchain technology has been in the news due to its ability to provide much better security, transparency and efficiency. In this issue of CW ANZ, we look at how enterprises in ANZ are using blockchain technology to improve security and efficiency, and what it takes to spur greater adoption among ANZ enterprises. Read the issue now. Continue Reading

Keep people at the centre of risk management, says consultant

In assessing the cyber risks to a business, security professionals should start with the people in an organisation and keep them at the centre in identifying and mitigating risk, says consultant Continue Reading

By

• Warwick Ashford, Senior analyst

Enterprises lack capability against persistent cyber attacks

A report urges organisations to strengthen their cyber defence capabilities to pre-empt, detect and respond to post-breach attacks Continue Reading

By

• Warwick Ashford, Senior analyst

DeepMind won’t share patient data with Google ‘at this stage’, says company’s health boss

Amid concerns and questions around Google’s takeover of the DeepMind’s Streams app, Dominic King, the company’s health lead, promises that ‘at this stage’, nothing will change, and it won’t share any patient data with the internet giant Continue Reading

By

• Lis Evenstad

Members of Parliament should back EU Withdrawal Agreement, says industry

Industry experts say the government’s EU Withdrawal Agreement is far from perfect and still requires more clarity, but call on MPs to back it, as it’s better than a No-Deal Brexit Continue Reading

By

• Lis Evenstad

It’s complicated: How enterprises are approaching IAM challenges

Identity and access management challenges are evolving with digital transformation. Computer Weekly explores some of the ways organisations are ensuring the right people gain the right access to the right resources Continue Reading

By

• Christian Annesley

AI-enhanced security tools necessary for today’s threats

Machine learning-enhanced tools are necessary to keep up with current threats, but are not perfect and will not solve the security skills gap problem, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst

Zero-trust security not an off-the-shelf product

The zero-trust security model is a business enabler that needs to be supported by a strategy and security architecture, analyst warns cyber security leaders Continue Reading

By

• Warwick Ashford, Senior analyst

Thailand’s Democrat Party holds election with blockchain

The Zcoin blockchain was used to store file hashes of voting data and identities of voting members of Thailand’s main opposition party Continue Reading

By

• Aaron Tan, TechTarget

Prepare now for quantum computers, QKD and post-quantum encryption

The predicted processing power of quantum computers is likely to make existing encryption algorithms obsolete. Quantum key distribution (QKD) is a possible solution - we investigate whether QKD is viable. Continue Reading

User behaviour analytics adding new insight

User behaviour analytics is helping to add new insights by providing the missing element in security event information management approaches, says Martin Kuppinger Continue Reading

By

• Warwick Ashford, Senior analyst

Home Office to use smartphone ID for EU Exit scheme

The Home Office will use smartphone digital identity verification to support applications for the government’s EU Exit Settlement Scheme   Continue Reading

By

• Warwick Ashford, Senior analyst

Government considering dedicated internet regulator, says digital minister

An upcoming white paper is likely to set out proposals for an internet regulator, a House of Lords committee has been told Continue Reading

By

• Alex Scroxton, Security Editor

Norway’s IT industry must tackle security vulnerabilities

Report reveals growing threat posed by “hostile foreign actors” against Norway’s IT systems and critical national infrastructure Continue Reading

By

• Gerard O'Dwyer

Firms lack responsible exec for cyber security

Narrow gap between CEO, CIO and CISO roles means no single executive function is stepping up to take responsibility for cyber security, a study shows Continue Reading

By

• Warwick Ashford, Senior analyst

GCHQ offers help to embryonic Irish cyber security organisation

Ciaran Martin head of the UK's National Cyber Security Centre, part of GCHQ, builds bridges with the Republic of Ireland's intelligence community during an official visit to Dublin Continue Reading

By

• Kevin Cahill

EU regulation set to advance single market for non-personal data

The European Union Council and Parliament have approved a regulation, to take effect in six months’ time, to ensure the free movement of non-personal data, such as IoT data, across the bloc Continue Reading

By

• Brian McKenna, Senior Analyst, Business Applications

Global, Load-Balanced Redundant Weather

I remember long ago, in an unlikely setting for a bleeding-edge test-labs – an old winery surrounded by vines where the only “blood” came from crushed grapes – yes, my old French test labs, where ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Post-quantum cryptography a major challenge, says expert

The crypto wars are just beginning and open systems are key to improved security in future, says cryptography expert Continue Reading

By

• Warwick Ashford, Senior analyst

Australia needs better cloud and data management capabilities

Use of cloud services is soaring in Australia, but a lack of cloud management skills is holding back enterprises from reaping the full benefits of the technology Continue Reading

By

• Beverley Head

Researcher urges IoT security legislation

Suppliers of internet connected devices are largely failing to improve the security of their products, exposing users to privacy risks, so there is no choice but to legislate in this area, says a researcher Continue Reading

By

• Warwick Ashford, Senior analyst

Privacy International files GDPR complaint against Oracle

General Data Protection Regulation complaints against Oracle and six other companies filed with Information Commissioner’s Office Continue Reading

By

• Brian McKenna, Senior Analyst, Business Applications

Why entropy sources should be added to mobile application vetting

NIST's 'Vetting the Security of Mobile Applications' draft discusses four key areas of general requirements. Learn how further improvements to the vetting process could be made. Continue Reading

By

• Judith Myerson

GDPR a challenge to AI black boxes

Most artificial intelligence “black boxes” do not comply with EU data protection laws and will have to be re-engineered, warns security researcher and consultant Continue Reading

By

• Warwick Ashford, Senior analyst

Increasing value of personal data a 21st century challenge

The increasing value of personal data presents the challenge of managing a personal data economy, says identity and security expert Continue Reading

By

• Warwick Ashford, Senior analyst

Singapore’s SunMoon uses blockchain to trace apples

Fruit and vegetable distributor has implemented a blockchain platform that enables consumers and suppliers to trace the origin of Fuji apples – with other fruits to follow Continue Reading

By

• Aaron Tan, TechTarget

Why the tech industry needs a moral compass

Technology has unintended consequences, says Martha Lane Fox – but technologists have an opportunity to make a difference Continue Reading

By

• Cliff Saran, Managing Editor

Decentralised ID key to identity security

Enterprises need to step up protections around identity-related compromises and look to decentralised identity in the longer term to improve security, says computer scientist Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Top considerations to reduce application layer attacks

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Tim Holman, 2-sec

Cyber security high on European Commission agenda

The European Commission is recognising the growing importance of cyber security to the digital economy and is increasing funding to support research, resilience and cooperation Continue Reading

By

• Warwick Ashford, Senior analyst

APAC firms warm up to SD-WAN to solve networking woes

A third of enterprises in the APAC region have already deployed SD-WAN at most of their sites, while 55% are in the process of doing so, a study shows Continue Reading

By

• Aaron Tan, TechTarget

Information commissioner calls for stricter regulation on political use of data

Information commissioner Elizabeth Denham’s investigation into the use of data in elections and campaigns, finds "a disturbing disregard for voters’ personal privacy" Continue Reading

By

• Lis Evenstad

How testing perspectives helps find application security flaws

Application security testing requires users to test from all the right perspectives. Discover testing techniques that help find application security flaws with expert Kevin Beaver. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Start preparing for post-quantum data protection

Organisations that need to retain sensitive information for long periods of time need to start preparing for the post-quantum era, according to an IBM security architect Continue Reading

By

• Warwick Ashford, Senior analyst

Making the UK the safest place to live and work online

Government, industry and individuals all have to play their part in enhancing cyber security practices Continue Reading

By

• Cate Pye, EY

Security Think Tank: Gap, risk and business impact analysis key to application security

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Ramsés Gallego, Isaca

VMware takes layered approach to securing datacentres

From securing workloads to segmenting the network, VMware’s architecture is using AppDefence and NSX for intrinsic datacentre security Continue Reading

By

• Cliff Saran, Managing Editor

Banking sector leading CIAM innovation, say Big Four

Maturity in consumer identity and access management (CIAM) differs from sector to sector, with the banking sector taking the lead in terms of innovation, according to the Big Four accounting firms Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Three ways to safeguard against application layer vulnerabilities

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Bruce Beam , (ISC)²

The Bond of Intelligence at Oracle Open World

Oracle Open World 2018 seems a world away. Especially, when you have had a few days’ furlough in between. Mark Hurd’s second keynote at OOW convoked a common room of former spies from the US and UK ... Continue Reading

By

• Brian McKenna, Senior Analyst, Business Applications

DevSecOps not limited to coding, says analyst

DevSecOps is seen as a way of ensuring application security, but security leaders must understand that embedding a security culture and taking the inter-dependencies of new development frameworks into account is key, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Deploy multiple defence layers to protect data-rich applications

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Simon Persin, Turnkey Consulting

Facebook to appeal EU-US data transfer ruling in Irish Supreme Court

Facebook will appeal a decision by the Irish High Court to refer questions over the legality of EU-US data transfers to the European Court of Justice in January, as the Dublin court rejects attempt by a UK IT expert to join the case Continue Reading

By

• Bill Goodwin, Computer Weekly

Radisson hotel group could be GDPR test case

Privacy watchers say the breach of personal data of members of the Radisson Hotel Group’s loyalty scheme could be an interesting test case for how the GDPR will be applied Continue Reading

By

• Warwick Ashford, Senior analyst

Government fails in first attempt to hire chief security officer

The government’s initial recruitment campaign for the UK’s "biggest and most important security job” has been unsuccessful, Cabinet Office admits Continue Reading

By

• Lis Evenstad

Key elements to success in consumer identity management

Success in consumer identity management is not just about getting the technology right, it is also about keeping in mind the consumer needs, preferences and concerns, says KuppingerCole Continue Reading

By

• Warwick Ashford, Senior analyst