Identity and access management products

New (ISC)² cyber careers schemes go live

(ISC)² has opened up two new global cyber careers schemes to applicants to try to help organisations fill 2.7 million vacant roles worldwide Continue Reading

By

• Alex Scroxton, Security Editor

Norway has NOK200m plan to bolster cyber defences

Norway is investing heavily in its cyber defences amid heightened threat from Russia Continue Reading

By

• Gerard O'Dwyer

IAM house Okta confirms 0ktapus/Scatter Swine attack

Following last week’s disclosureby Group-IB researchers of a major phishing campaign, Okta has warned its customers to be on their guard Continue Reading

By

• Alex Scroxton, Security Editor

LastPass breach limited in scale and well-managed, say experts

A breach of LastPass’s developer environment does not seem to have affected users of the password management service, but it may still be time for a credential reset Continue Reading

By

• Alex Scroxton, Security Editor

One Login digital identity project makes headway

Government services are lining up to work with the GDS on its One Login digital identity system, according to its director of digital identity, Natalie Jones Continue Reading

By

• Lis Evenstad

Criminal 0ktapus spoofed IAM firm in massive phishing attack

Researchers at Group-IB have published research on a major phishing campaign that ensnared victims at the likes of Cloudflare and Twilio Continue Reading

By

• Alex Scroxton, Security Editor

Millions of Plex users may be at risk in password breach

Up to half of Plex’s 30 million users may have had their personal data stolen by an unknown threat actor Continue Reading

By

• Alex Scroxton, Security Editor

NCSC shares cyber guidance for large infrastructure builds

Balfour Beatty and McAlpine are among the large construction firms to have input into latest NCSC guidance for ensuring the security of major infrastructure projects Continue Reading

By

• Alex Scroxton, Security Editor

Google employees demand end to collection of abortion data

In the wake of the US Supreme Court rolling back abortion rights, Google employees are calling on the company to stop collecting abortion-related data, so that it can never be shared with police Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Cozy Bear targets MS 365 environments with new tactics

Cozy Bear, or APT29, is trying out new tricks as it seeks access to its targets’ Microsoft 365 environments Continue Reading

By

• Alex Scroxton, Security Editor

Inside Singapore’s national digital identity journey

Singapore’s national digital identity system has evolved from providing single sign-on to e-government services to pandemic-related and digital document capabilities in recent years Continue Reading

By

• Aaron Tan, TechTarget

Growing MFA use spurs ‘pass-the-cookie’ attacks

The exploitation of stolen session cookies by cyber criminals is once again back on the agenda, thanks to the growing popularity of multifactor authentication tools Continue Reading

By

• Alex Scroxton, Security Editor

Cisco averts cyber disaster after successful phishing attack

A potentially serious cyber attack on Cisco’s systems that began after a threat actor successfully exploited an employee’s carelessly secured credentials was thwarted without major damage Continue Reading

By

• Alex Scroxton, Security Editor

UK to surveil convicted migrants with facial recognition

A Home Office scheme to biometrically scan the faces of convicted migrants who have already carried out punishments has come under fire from privacy and human rights groups for being discriminatory Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Cyber insurance getting harder to obtain

Organisations looking to shore up their security postures face more and more barriers to obtaining cyber insurance Continue Reading

By

• Alex Scroxton, Security Editor

UK has biggest card fraud problem in Europe

Social Market Foundation calls on the UK to get a grip on its huge problem with bank card fraud in Europe Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

SBRC to administer NCSC training across Scotland

The Scottish Business Resilience Centre has been awarded a £500,000 contract to extend cyber resilience training across more than 250 at-risk organisations Continue Reading

By

• Alex Scroxton, Security Editor

UK safety tech sector sees strong revenue and employment growth

Safety tech is now one of the fastest-growing sectors in the UK tech industry, with jumps in revenue, investment and employment Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

NCSC startups scheme turns focus to operational technology, SME security

NCSC for Startups initiative turns its focus to supporting innovation around securing operational technology and addressing the challenges facing small businesses Continue Reading

By

• Alex Scroxton, Security Editor

Cyber security training ‘boring’ and largely ignored

Two-thirds of employees don’t bother to pay attention to cyber security training – and the fault does not lie with them Continue Reading

By

• Alex Scroxton, Security Editor

Visibility and proactive stance needed to secure OT systems

Critical infrastructure operators need to have more visibility into their IT and operational technology environment, and take a more active stance to fend off sophisticated adversaries, expert says Continue Reading

By

• Aaron Tan, TechTarget

NCSC seeks community input for Cyber Advisor service

The NCSC is proposing to establish a new Cyber Advisor service to train up experts in security guidance, and is inviting interested parties to come forward Continue Reading

(ISC)² expands entry-level cyber programme after UK success

Flush with success from a UK certification programme, reaching 100k in the UK, (ISC)² now wants to provide free security certification to a million people worldwide Continue Reading

By

• Alex Scroxton, Security Editor

How NEC is transforming its business

While NEC is known for its public safety systems, the company has been expanding into new areas including e-government, financial services and customer experience in Asia-Pacific Continue Reading

By

• Aaron Tan, TechTarget

Russia’s Cozy Bear abusing Dropbox, Google Drive to target victims

Russian APT known as Cozy Bear has become adept at quickly incorporating popular cloud storage services into its attack chain to avoid detection Continue Reading

By

• Alex Scroxton, Security Editor

How hostile government APTs target journalists for cyber intrusions

Proofpoint shares data on multiple campaigns of cyber intrusions against journalists originating from threat actors aligned to the governments of China, Iran, North Korea and Turkey Continue Reading

By

• Alex Scroxton, Security Editor

Government pauses Online Safety Bill’s progress

The government has paused the Online Safety Bill’s journey towards becoming law, amid timetable pressure Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Slippery phish wriggles around MFA protections, says Microsoft

Microsoft’s threat researchers share details of a phishing campaign that hit 10,000 organisations, against which standard multifactor authentication provides little defence Continue Reading

By

• Alex Scroxton, Security Editor

Singapore doubles down on OT security

The Cyber Security Agency of Singapore will fund 80 scholarships to groom a talent pool of operational technology security experts, among other efforts to bolster the security of critical infrastructure in the city-state Continue Reading

By

• Aaron Tan, TechTarget

SMEs lagging on multifactor authentication

Only 46% of small business owners say they have implemented multifactor authentication, and just 13% mandate its use, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Sweden and GDPR – four years on

Swedish data protection coordinator talks to Computer Weekly four years into the General Data Protection Regulation Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Latest Marriott data breach not as serious as others

Questions are again being raised over Marriott’s cyber security practices following yet another incident, but fortunately it seems limited in its scope, and the company is responding appropriately Continue Reading

By

• Alex Scroxton, Security Editor

blended threat

A blended threat is an exploit that combines elements of multiple types of malware and usually employs various attack vectors to increase the severity of damage and the speed of contagion. Continue Reading

By

• Kinza Yasar, Technical Writer

Plexal seeks new scaleups for next phase of Cyber Runway

Established security startups looking to grow and scale their operations are being invited to join the next phase of Plexal’s Cyber Runway programme Continue Reading

By

• Alex Scroxton, Security Editor

How to get the right level of cyber insurance

In this week’s Computer Weekly, we look at how the market for cyber insurance is evolving and how to avoid buying the wrong level of cover. We find out what role hydrogen technologies could play in reducing datacentre carbon emissions. And we hear how a 125-year-old bicycle maker is embracing digital innovation. Read the issue now. Continue Reading

Government rejects Lords police tech inquiry recommendations

The government has largely rejected the findings and recommendations of a House of Lords inquiry into police tech, which called for an overhaul of how police deploy artificial intelligence and algorithmic technologies Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Urgent need for new laws to govern biometrics, legal review finds

Independent review says new framework is needed to clear up legal and ethical concerns over the use of biometric data and technologies, which can impact privacy, freedom of expression and other human rights Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Uber drivers strike over pay issues and algorithmic transparency

Unionised Uber drivers take industrial action against the company over its failure to pay workers in line with a Supreme Court decision and inflation, as well as the lack of transparency around how it uses their data Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How TDCX is building a people-centric business

Every digital tool deployed by the Singapore-based services firm is aimed at augmenting the performance and experience of its employees, says TDCX’s group CIO, Byron Fernandez Continue Reading

By

• Aaron Tan, TechTarget

Microsoft Office 365 has ability to ‘spy’ on workers

Microsoft faces calls for ‘transparency’ over tools in Office 365 that allow employers to read staff emails and monitor their computer use at work Continue Reading

By

• Bill Goodwin, Computer Weekly

Dundee security research centre opens with support from SBRC

An £18m hub at Abertay University in Dundee forms the centrepiece of Scotland’s first security research cluster Continue Reading

By

• Alex Scroxton, Security Editor

Office 365 loophole may give ransomware an easy shot at your files

Researchers at Proofpoint have discovered potentially dangerous Microsoft Office 365 functionality that they believe may give ransomware a clear shot at files stored on SharePoint and OneDrive Continue Reading

By

• Alex Scroxton, Security Editor

Is digital ID still the missing link for the UK’s digital economy?

While progress has been made, the government’s proposed digital ID trust framework needs more work – and the tech industry wants to have more input Continue Reading

By

• Julian David, TechUK

$2k to access your organisation on the dark web

Dark web brokers will sell access to company networks and systems for an average of $2,000 to $4,000 Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Basic steps to secure your supply chain

When it comes to supply chain security, there are some core things you should be doing – but remember, the devil is in the detail Continue Reading

By

• Petra Wenham

Qatar bolsters cyber security in preparation for World Cup

With hackers honing their cyber weapons to target the upcoming football World Cup, Qatar is busy developing countermeasures and raising awareness Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Security Think Tank: Don’t trust the weakest link? Don’t trust any link

Your security model shouldn’t fall apart just because a part of your business, or a partner, has weak security. This is why information-centric security is a must Continue Reading

By

• Tim Holman, 2-sec

Researchers find eight CVEs in single building access system

A series of eight vulnerabilities in Carrier LenelS2 building access panels could enable malicious actors to obtain physical access to their targets Continue Reading

By

• Alex Scroxton, Security Editor

Trade body calls for public-private sector collab on digital ID

TechUK has published a report outlining 10 key recommendations it believes are urgently needed to enable the rapid creation of an effectively regulated digital identity marketplace Continue Reading

By

• Alex Scroxton, Security Editor

Attack of the clones: the rise of identity theft on social media

The proliferation of social media has resulted in the rise of identity theft on these platforms, with accounts copied for fraudulent or malicious purposes. What can be done to mitigate it? Continue Reading

By

• Peter Ray Allison

Ransomware volumes grew faster than ever in 2021

Verizon’s annual DBIR assessment of the security landscape highlights an unprecedented boom in ransomware volumes, to the surprise of nobody Continue Reading

By

• Alex Scroxton, Security Editor

Deliveroo accused of ‘soft union busting’ with GMB deal

Smaller grassroots unions have criticised Deliveroo and GMB for making a “hollow” deal that will ultimately undermine workers’ self-organising efforts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Red teaming will be standard in Dutch governmental organisations by 2025

The Dutch government wants to include the testing of the digital security of systems, processes and people – also known as red teaming – in all of its governmental organisations’ test planning and budgeting by 2025 at the latest Continue Reading

By

• Kim Loohuis

Security Think Tank: Your path to understanding attack paths

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Paddy Francis

Nationwide stops thousands more attempted frauds with Strong Customer Authentication

Nationwide Building Society is blocking an additional 2000 attempted online shopping frauds a month through extra checks Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

NHS email accounts hijacked for phishing campaign

Microsoft credentials targeted in phishing operation using hijacked NHSMail accounts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Five TLS comms vulnerabilities hit Aruba, Avaya switching kit

Five new vulnerabilities in the implementation of transport layer security communications leave several popular switches vulnerable to remote code execution Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

man-in-the-middle attack (MitM)

A man-in-the-middle (MitM) attack is a type of cyber attack in which the attacker secretly intercepts and relays messages between two parties who believe they are communicating directly with each other. Continue Reading

By

• Kinza Yasar, Technical Writer
• Michael Cobb

Manufacturer sues JPMorgan after cyber criminals stole $272m

Manufacturer files lawsuit alleging that US bank failed to inform it of suspicious transaction activity Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Log4Shell, ProxyLogon, ProxyShell among most exploited bugs of 2021

These 15 CVEs were the most commonly exploited last year, and if you haven’t mitigated against them, now is the time Continue Reading

By

• Alex Scroxton, Security Editor

Did HMRC really 'lock taxpayers out' from their online accounts?

Did HM Revenue & Customs (HMRC) really “lock taxpayers out” from their online accounts, as The Guardian has claimed? It’s a situation that arose from a predictable and – according to HMRC – ... Continue Reading

By

• Bryan Glick, Editor in chief

The latest salary trends for IT professionals

In this week’s Computer Weekly, the results of our annual salary survey show pay returning to pre-pandemic levels and work-life balance a growing consideration. As sustainability becomes a critical issue, we look at how datacentres can meet emissions targets. And we find out how IT leaders can help protect children online. Read the issue now. Continue Reading

US mobile network emerges as latest Lapsus$ victim

Lapsus$ extortion gang hit T-Mobile and attempted to perform SIM-swapping attacks and code theft Continue Reading

By

• Alex Scroxton, Security Editor

How Adnovum is leveraging its Swiss roots

Software company Adnovum is leveraging its strengths in identity and access management and its Swiss heritage as it expands into new markets and areas such as zero-trust security Continue Reading

By

• Aaron Tan, TechTarget

UAE bolsters cyber security

The United Arab Emirates has successfully improved its security posture amid mounting cyber threats Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Finance regulator identifies challenger bank financial crime weaknesses

Financial Conduct Authority review finds challenger banks need to do more to prevent their platforms being used to commit financial crime, such as money laundering Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Five Eyes in new Russia cyber warning

Latest cross-body alert warns of Russian threat to utilities and other core elements of national infrastructure Continue Reading

By

• Alex Scroxton, Security Editor

Impact of Lapsus$ attack on Okta less than feared

Okta’s investigation into Lapsus$ breach of its systems via a Sitel workstation has concluded that the impact was significantly less than the maximum potential Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC: Trend Watch: Cyber security

Protection from malicious actors has become a critical consideration for organisations in recent years. In this handbook, focused on cyber security in the Asia-Pacific region, Computer Weekly looks at how to minimise edge security risks, India’s rise in cyber security revenues, Check Point’s sales force and partner ecosystem processes, and Trellix’s decision to democratise XDR access Continue Reading

One-third of scams that hit TSB are impersonation fraud

TSB reports an increase in fraudsters impersonating trusted organisations to trick consumers into making payments to them Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

WLAN Authentication and Privacy Infrastructure (WAPI)

WLAN Authentication and Privacy Infrastructure (WAPI) is a wireless local area network security standard officially supported by the Chinese government. Continue Reading

By

• Rahul Awati

Lack of expertise hurting UK government’s cyber preparedness

UK government bodies and critical infrastructure owners cite a lack of staff resources, and internal and external expertise, as hampering factors when it comes to cyber readiness, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Universal IAM policy failings put cloud environments at risk

Almost all organisations lack appropriate IAM policy controls to effectively secure their data in the cloud, according to a damning study Continue Reading

By

• Alex Scroxton, Security Editor

AI researcher says police tech suppliers are hostile to transparency

Expert witness in Lords police tech inquiry welcomes committee’s findings but questions whether its recommendations on how to end the ‘Wild West’ of police artificial intelligence and algorithmic technologies in the UK would be implemented Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Open source CMS platform Directus patches XSS bug

A stored cross-site scripting vulnerability in the Directus platform could have enabled malicious actors to gain access to valuable data Continue Reading

By

• Alex Scroxton, Security Editor

Raspberry Pi Foundation ditches default username policy

Raspberry Pi owners will no longer be able to use the default ‘pi’ username, as the Raspberry Pi Foundation clamps down on insecure practices Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill: Collaborating to make the internet safer for all

The UK government's plan to regulate the internet and social media includes some positive and progressive measures – but by working with industry, a lot more could be achieved Continue Reading

By

• Martin Wilson

Two teenagers charged with Lapsus$ cyber attacks

City of London Police have charged two teenagers in connection with the Lapsus$ cyber crime spree Continue Reading

By

• Alex Scroxton, Security Editor

Four moves to ‘checkmate’ critical assets thanks to lax cloud security

Malicious actors can compromise 94% of critical assets within four steps of the initial breach point, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Bank fraud prevention scheme blocked £60m in fraud last year

Scheme to catch fraudsters, including online scammers, before they commit their crimes has reported a significant increase in crimes prevented Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Lapsus$ cyber crime spree continues despite arrests

The arrests of seven people in connection with the Lapsus$ cyber crime group has not dented the gang’s enthusiasm for causing chaos Continue Reading

By

• Alex Scroxton, Security Editor

Recruitment risks: Avoiding the dangers of fraudulent candidates

Tech companies are seeing an increase in fraudulent job applications, with associated impacts on risk and cyber security. So how can organisations protect themselves from fraudulent applicants while ensuring they recruit the best talent? Continue Reading

By

• Peter Ray Allison

Overhaul of UK police tech needed to prevent abuse

Lords inquiry finds UK police are deploying artificial intelligence and algorithmic technologies without a thorough examination of their efficacy or outcomes, and are essentially ‘making it up as they go along’ Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

European Commission proposes new cyber security regulations

New cyber and information security regulations have been proposed by the European Commission to create a minimum set of standards in both areas Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

London police arrest seven in connection to Lapsus$

Seven people arrested by London police over cyber attacks carried out by Lapsus$ group, which is responsible for a number of recent, high profile attacks Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How Lapsus$ exploited the failings of multifactor authentication

Attacks on Nvidia and Okta highlight weak MFA and the risk of employees being bribed or falling victim to social engineering Continue Reading

By

• Cliff Saran, Managing Editor

Private equity house spins SSE company out of McAfee Enterprise

The launch of Skyhigh Security completes division of McAfee Enterprise into separate businesses by Symphony Technology Group, which acquired the long-standing cyber security firm for $4bn in March 2021 Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

NHS urgent care provider uses ID and access management to reduce complexity for clinicians

Provider of care through NHS 111 is using a cloud-based identity and access management system to remove the need for clinicians to remember multiple passwords Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Details of Conti ransomware affiliate released

Information about a new Conti affiliate has been released by eSentire and BreakPoint Lab after a joint investigation into the group’s indicators of compromise Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

mutual authentication

Mutual authentication, also called two-way authentication, is a process or technology in which both entities in a communications link authenticate each other. Continue Reading

By

• Paul Kirvan

The state of digital identity in the UK - such a great idea, you'll need a whole bunch of them

The promise of digital identity is a simple one: Prove once that you are who you say you are, and then forever more you have a single method to log in to any online service you choose. No more ... Continue Reading

By

• Bryan Glick, Editor in chief

Ukrainian cyber defences prove resilient

Thanks to a combination of prior experience and global support, Ukraine’s defences against cyber incidents are holding strong in the face of Russian attacks Continue Reading

By

• Alex Scroxton, Security Editor

NCSC catches 10 million phishes

Nation Cyber Security Centre’s scam email reporting service enjoys great success as government embarks on new cyber awareness campaign Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill introduced in Parliament

The government has introduced its long-awaited Online Safety Bill in Parliament, alongside new criminal offences and sanctions for tech company execs Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Value of contactless transactions doubles in two years

Almost £166bn was spent in the UK last year using contactless technology, compared with £80.5bn in 2019 Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

SentinelOne adds Attivo Networks to identity portfolio

SentinelOne adds identity threat detection and response technology to its cyber portfolio, saying it will benefit zero-trust adoption among its customers Continue Reading

By

• Alex Scroxton, Security Editor

Paid-for advertising measures included in Online Safety Bill

New measures to deal with fraudulent paid-for advertising have been included in the government’s draft Online Safety Bill, marking the fourth extension in two months Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How APAC organisations can mitigate edge security threats

The move to the edge expands an organisation’s attack surface. Here are some measures that organisations can take to minimise their edge security risks Continue Reading

By

• Aaron Tan, TechTarget

Online Safety Bill updated to deal with anonymous abuse

Social media companies will be forced to deal with anonymous abuse online by the introduction of new measures in the Online Safety Bill Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Shared Key Authentication (SKA)

Shared Key Authentication (SKA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. Continue Reading

By

• Andrew Zola