Security policy and user awareness

Ukraine joins Nato cyber knowledge hub

Ukraine is to become a contributing participant in Nato’s Cooperative Cyber Defence Centre of Excellence Continue Reading

By

• Alex Scroxton, Security Editor

Scrapping NHS Digital a backward step for patient data rights

Former NHS Digital chair Kingsley Manning has spoken out over proposals to fold NHS Digital into NHS England, saying that more oversight is needed to safeguard patient data in light of recent events Continue Reading

By

• Alex Scroxton, Security Editor

Assessing the aims of the Government Cyber Security Strategy

The clear aims of the Government Cyber Security Strategy are welcome, but are they realistic or achievable? Continue Reading

By

• Laura Marsden and Chris Goslin

Universities need better protection from email-based cyber attacks

The need to educate university staff and students on avoiding email-based cyber attacks is more acute than ever, says Proofpoint’s Adenike Cosgrove Continue Reading

By

• Adenike Cosgrove

Boardroom does not see ransomware as a priority

Less than a quarter of company directors think ransomware is a top priority for their security teams, according to Egress Continue Reading

By

• Alex Scroxton, Security Editor

Direct action is a risky business for Ukraine's volunteer hackers

Hackers have been responding to Ukraine’s call to create an IT army, but there are many reasons why taking direct action in a kinetic conflict is a bad idea Continue Reading

By

• Alex Scroxton, Security Editor

Eight schools recognised for quality security education

Eight new schools and colleges around the UK have been recognised by the NCSC’s CyberFirst Schools initiative Continue Reading

By

• Alex Scroxton, Security Editor

BBC blasted with millions of malicious emails

Responding to an FoI request, the BBC has revealed it receives more than 300,000 malicious email attacks every day Continue Reading

By

• Alex Scroxton, Security Editor

Ukraine cyber attacks seen spiking, but no destructive cyber war yet

While cyber attacks linked to Russia’s war on Ukraine are taking place, they are having little impact beyond the region Continue Reading

By

• Alex Scroxton, Security Editor

Time to act on "Authorised Payment" Fraud

In 2014 a working group hosted by the DPA (Digital Policy Alliance) working with faster payment data from six banks established that 75% of fraudulent payments could have been stopped in real time ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Mass phishing attacks against Ukrainian citizens reported

The Ukrainian cyber authorities are alerting people located in the country to be alert to phishing attacks Continue Reading

By

• Alex Scroxton, Security Editor

The UK’s cyber security sector is thriving, but our work has only just begun

The government’s Annual Cyber Sector Report painted a positive picture of the UK security industry. CIISec’s Amanda Finch thinks we can go further in developing cyber talent and opening up the sector Continue Reading

By

• Amanda Finch, Institute of Information Security Professionals

KnowBe4 cyber drama tackles Colonial Pipeline in fourth season

KnowBe4’s ongoing cyber security training drama, The Inside Man, reaches its fourth season with a plot drawing inspiration from one of the most impactful cyber attacks of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

New wave of cyber attacks on Ukraine preceded Russian invasion

A wave of DDoS attacks, and a second data wiper attack, were seen hitting Ukraine in the hours leading up to the Russian invasion Continue Reading

By

• Alex Scroxton, Security Editor

Security organisations form Nonprofit Cyber coalition

Founding members of the Nonprofit Cyber coalition pledge to enhance joint action on cyber security around the world Continue Reading

By

• Alex Scroxton, Security Editor

New cyber guidelines to safeguard construction sector

NCSC launches sector-specific security guidance for organisations in the construction industry, with input from the Chartered Institute of Building Continue Reading

By

• Alex Scroxton, Security Editor

Russia behind dangerous Cyclops Blink malware

Joint NCSC CISA advisory attributes a dangerous malware, dubbed Cyclops Blink, to Russia’s Sandworm APT, likely a GRU unit, with WatchGuard users at particular risk Continue Reading

By

• Alex Scroxton, Security Editor

No imminent cyber threat to UK from Russia

Intelligence officials say they have no evidence or indication that Russian cyber attackers are preparing offensive assaults on infrastructure or organisations in Britain Continue Reading

By

• Alex Scroxton, Security Editor

Attempted burglary exposes risk of NatWest customer data in former worker’s home

Former Royal Bank of Scotland employee offers bank a compromise in her dispute over the return of confidential customer information Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

IBM opens cyber security hub in India

Big Blue’s new cyber security hub, comprising a cyber range, software development facilities and a security operations centre, will serve enterprises across the Asia-Pacific region Continue Reading

By

• Aaron Tan, TechTarget

UK organisations swift to chide phishing victims

While UK organisations are doing better at security training, many are quick to punish employees who fall victim to phishing attacks, whether real or simulated Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Good training is all about context

In-house or outsourced? What makes a good security training programme, and what questions should buyers ask when procuring training as a service? Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

Think nation-state cyber attacks won’t hit you? Think again…

In this week’s Computer Weekly, with Russian state cyber attacks in the news, we find out why security professionals in every organisation need to remain alert. Our buyer’s guide looks at the tools and programmes helping improve IT training. And we look at how the traditional sport of golf is undergoing a digital transformation. Read the issue now. Continue Reading

UK organisations untroubled by Trickbot surge

A surge in Trickbot infections is targeting some of the world’s most prominent brands, but UK organisations seem thankfully unaffected Continue Reading

By

• Alex Scroxton, Security Editor

It takes a village: Protecting kids online is everyone’s responsibility

The rapid uptake of smartphones among children has contributed to the increasing number of cases of cyber bullying and online grooming. Is this an educational issue or a cultural problem, and can modern enterprise help? Continue Reading

By

• Peter Ray Allison

2021 another record year for UK cyber investment

Total revenue generated by the UK’s cyber sector was up 14% last year, and UK-registered security firms raised over £1bn in investment Continue Reading

By

• Alex Scroxton, Security Editor

Parasol data breach: Frustrated IT contractors dig into the dark web in search of their data

The emergence on the dark web of passports, payslips and other personal documents belonging to contractors affected by the cyber attack and subsequent data breach at Parasol is prompting group actions and forcing some IT contractors to find out for themselves if their data has been compromised Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

TA2451 targets aviation and transport sector with tailored lures

Newly designated cyber criminal group favours highly specific lures and a tried-and-tested modus operandi to compromise targets in the aviation, aerospace and transport sectors Continue Reading

By

• Alex Scroxton, Security Editor

China emerges as leader in vulnerability exploitation

Threat actors linked to China are emerging as a significant force in the weaponisation of newly discovered CVEs Continue Reading

By

• Alex Scroxton, Security Editor

CMA secures final Privacy Sandbox guarantees from Google

The CMA has secured a final set of Privacy Sandbox commitments from Google relating to the proposed removal of third-party cookies from its Chrome browser Continue Reading

By

• Alex Scroxton, Security Editor

Lack of knowledge disastrous for effective security strategy within Dutch companies

Most Dutch companies still haven’t realised that security is an integral part of their IT and company strategy Continue Reading

By

• Kim Loohuis

Why security professionals should pay attention to what Russia is doing

Even though the average organisation is an unlikely target for a Russian state cyber attack, here's why security teams still need to watch what Russian threat groups are up to Continue Reading

By

• Alex Scroxton, Security Editor

Phishing tests are a useful exercise, but don’t overdo it

The vast majority of cyber attacks start with a phish, so it’s not surprising that phishing tests form part of cyber training plans. But sometimes these tests go too far. Cyberis’ Gemma Moore looks at how to avoid the pitfalls Continue Reading

By

• Gemma Moore

Ransomware ever more sophisticated and impactful, warns NCSC

UK’s National Cyber Security Centre teams up with US and Australian partners in a joint advisory warning organisations of the increasing sophistication exhibited by criminal ransomware gangs Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft stomps on 48 bugs in February Patch Tuesday update

It’s a light Patch Tuesday for February 2022, as Microsoft issues fixes for just 48 CVEs, including a solitary zero-day Continue Reading

By

• Alex Scroxton, Security Editor

How Dutch hackers are working to make the internet safe

We hear how the personal mission of a Dutch hacker grew into a serious organisation with international ambitions Continue Reading

By

• Kim Loohuis

Log4Shell, Ukraine and umbrella firm cyber attacks – Computer Weekly Downtime Upload podcast

Alex Scroxton joins the team to discuss the Log4j vulnerability and Russian pressure on Ukraine. Also discussed are cyber attacks on umbrella companies, neuro-diversity and junk in space Continue Reading

By

• Alex Scroxton, Security Editor
• Caroline Donnelly, Senior Editor, UK
• Clare McDonald, Business Editor

DPD delivers swift fix for serious API flaw

API vulnerability potentially left PII on DPD Group’s customers dangerously exposed, but was rapidly fixed on disclosure Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft to start blocking macros to thwart malware

Microsoft is making changes to web macro permissions across multiple Office apps to help improve user security Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Building the UK’s future cyber ecosystem

As the government lays out the next iteration of its Cyber Security Strategy, we speak to Plexal and Lorca’s Saj Huq about his work building a cyber ecosystem to support the UK’s future ambitions Continue Reading

By

• Alex Scroxton, Security Editor

Right to disconnect and less monitoring key to better remote work

The World Health Organisation and International Labour Organisation warn against invasive workplace surveillance and promote right to disconnect in joint briefing on how to promote healthy and safe remote working Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Check Point looks to plug ASEAN’s cyber security gap

Check Point is shoring up its sales force and partner ecosystem to address the cyber security needs of small and mid-sized businesses in a region that is highly targeted by threat actors Continue Reading

By

• Aaron Tan, TechTarget

data recovery agent (DRA)

A data recovery agent (DRA) is a Microsoft Windows user account with the ability to decrypt data that was encrypted by other users. Continue Reading

By

• Gavin Wright

Security Think Tank: How to build a human firewall

In-house or outsourced? What makes a good security training programme, and what questions should buyers ask when procuring training as a service? Continue Reading

By

• Merry Song, Turnkey Consulting

Mechanism underlying cookie popups found in breach of GDPR

A fundamental element of the mechanism by which the advertising industry requests tracking consent from web users has been found in breach of the General Data Protection Regulation Continue Reading

By

• Alex Scroxton, Security Editor

Reforms needed to tackle economic crime, says Treasury Committee

The Treasury Committee is disappointed at progress towards tackling economic crime and fraud in both the online and offline worlds, and is calling for more action Continue Reading

By

• Alex Scroxton, Security Editor

British Council data exposed by third-party cyber failure

The British Council entrusted confidential data on its students to a third-party and was let down Continue Reading

By

• Alex Scroxton, Security Editor

What neurodivergent people really think of working in cyber security

Many firms are filling cyber security skills gaps by hiring neurodivergent talent – but more support is needed for neurodivergent cyber security professionals, writes autistic tech journalist Nicholas Fearn Continue Reading

By

• Nicholas Fearn

Data on children of armed forces personnel exposed in breach

Data on 4,142 children of serving armed forces personnel was exposed in a data breach at the Ministry of Defence Continue Reading

By

• Alex Scroxton, Security Editor

Understand your cyber training ‘need’ before committing to a programme

In-house or outsourced? What makes a good security training programme, and what questions should buyers ask when procuring training-as-a-service? Continue Reading

By

• Paddy Francis

Cyber skills gap affecting data privacy practice, finds ISACA

Organisations are struggling to fill both legal and technical privacy roles, with potentially damaging consequences, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

CISOs must get out in front of Ukraine cyber crisis, says NCSC

The National Cyber Security Centre is urging UK organisations to take steps to bolster their cyber security resilience in response to the ongoing Ukraine crisis Continue Reading

By

• Alex Scroxton, Security Editor

Novel phishing campaign highlights need for MFA, says Microsoft

Microsoft details a new multi-stage phishing campaign that only affects victims without multifactor authentication in place Continue Reading

By

• Alex Scroxton, Security Editor

Nightmare Log4Shell scenario averted by prompt, professional action

Prompt and professional community response to the Log4Shell disclosure means the dangerous and widespread vulnerability has not been exploited to the extent many had feared Continue Reading

By

• Alex Scroxton, Security Editor

Navigating PIPL: European businesses plot their next steps into China

How does China’s strict new Personal Information Protection Law impact European businesses? Continue Reading

By

• Matthew Staff

Security Think Tank: Focus on ‘nudging’ to build effective cyber training

In-house or outsourced? What makes a good security training programme, and what questions should buyers ask when procuring training-as-a-service? Continue Reading

By

• Tom Everard

More intel emerges on WhisperGate malware that hit Ukraine

Security experts have been poring over the WhisperGate malware with which alleged Russia-backed entities targeted Ukrainian government websites Continue Reading

By

• Alex Scroxton, Security Editor

MPs to debate landmark IoT security law

Proposed bill mandates tighter protections for connected products, and adds new rules for broadband roll-out into the bargain Continue Reading

By

• Alex Scroxton, Security Editor

Prepare, but don’t panic, over supposed Russian cyber threat

A fresh alert from the US Department of Homeland Security may have IT security teams jumpy over the possibility that their organisations could be targeted by Russian state actors Continue Reading

By

• Alex Scroxton, Security Editor

Cyber Essentials programme gets biggest update since launch

NCSC implements a thorough revision of its Cyber Essentials scheme to reflect the changing security landscape Continue Reading

By

• Alex Scroxton, Security Editor

UK government launches internal cyber strategy

Multi-pronged government security strategy is designed to protect both core systems and public services Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware attacks dropped 37% in December, claims NCC

Latest monthly data reveals a significant decline in ransomware attacks at the end of 2021, but a new, emergent gang is making waves Continue Reading

By

• Alex Scroxton, Security Editor

Updated cyber security regulations proposed for managed services sector

The Network and Information Systems regulations are to be updated to include MSPs and outsourcers, following a spate of supply chain attacks Continue Reading

By

• Alex Scroxton, Security Editor

MoonBounce firmware bootkit shows advances in malicious implants

MoonBounce firmware bootkit shows evident technical improvements over others, making it a more dangerous threat to organisations. It is being used by Chinese state-backed actors Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Cyber training is useless without staff empowerment

In-house or outsourced? What makes a good security training programme, and what questions should buyers ask when procuring training as a service? Continue Reading

By

• Tim Holman, 2-sec

Singapore to tighten digital banking security

Banks in Singapore will have to put in place more stringent measures to combat the rise in online phishing scams targeted at bank customers in the city-state Continue Reading

By

• Aaron Tan, TechTarget

Police take down VPN linked to multiple ransomware hits

German police led a multinational effort to seize and take down the LabVPN service, which was allegedly used by cyber criminals to facilitate ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Cobalt Strike still C2 infrastructure of choice

Its utility and ease of use, coupled with explosive growth in ransomware actions, makes Cobalt Strike Team Servers the C2 infrastructure of choice for malicious actors Continue Reading

By

• Alex Scroxton, Security Editor

‘Russian-backed’ hackers defaced Ukrainian websites as cover for dangerous malware attack

Kiev claims that a hacking group in Belarus – a close ally of Russia – was responsible for hacking Ukrainian government websites amid threats of military action Continue Reading

By

• Bill Goodwin, Computer Weekly

Nordic companies targeted in wave of cyber attacks

After a slew of cyber attacks hit major companies in the Nordics at the end of last year, we look at how they were affected and how they have recovered Continue Reading

By

• Gerard O'Dwyer

NCSC sounds alarm over Russia-backed hacks

The UK’s National Cyber Security Centre joins US calls to be wary of Russian state interference in critical national infrastructure IT systems Continue Reading

MEPs demand EU probe into Pegasus spyware abuse

A group of European Parliament Members has called for an EU-wide investigation into NSO Group’s Pegasus spyware after it emerged EU member states may have used it Continue Reading

By

• Alex Scroxton, Security Editor

UK government bodies challenged on secure identity

Public sector bodies in the UK recognise secure identity and access management as critical to the roll-out of digital services, but face challenges in addressing this Continue Reading

By

• Alex Scroxton, Security Editor

Dutch cyber volunteers receive major funding boost

The Dutch Institute for Vulnerability Disclosure has received a $100,000 donation to expand the scope of its work Continue Reading

By

• Alex Scroxton, Security Editor

Banks accused of neglecting customer security measures

Which? singles out Metro Bank, Virgin Money and TSB over insecure online banking processes Continue Reading

By

• Alex Scroxton, Security Editor

France fines Facebook and Google over alleged cookie malpractice

French data protection authorities clamp down on tech platforms for purposely making it more burdensome for users to decline tracking cookies Continue Reading

By

• Alex Scroxton, Security Editor

How APAC firms can stay ahead of cyber threats

Organisations will need to develop behavioural detection, machine learning and threat hunting capabilities to keep pace with the onslaught of cyber attacks Continue Reading

By

• Aaron Tan, TechTarget

Top 10 crime, national security and law stories of 2021

Here are Computer Weekly’s top 10 crime, national security and law stories of 2021 Continue Reading

By

• Bill Goodwin, Computer Weekly

Vulnerabilities to fraud are increasing across the board

As the pandemic continues to affect how we work, socialise, shop and conduct business, so it has increased opportunities for digital fraud and cyber crime. Jason Lane-Sellers explores the latest LexisNexis Risk Solutions ‘Cybercrime report’ Continue Reading

By

• Jason Lane-Sellers, EMEA director of market planning, LexisNexis Risk Solutions

Top 10 cyber security stories of 2021

Cyber security dominated the headlines in 2021, making it hard to gain a clear picture of what to pay attention to. What is an IT buyer to do? Continue Reading

By

• Alex Scroxton, Security Editor

Is the IT sector beset by fear-mongering?

The arms race between hackers and security teams has led to a plethora of new technologies, but it can be hard to differentiate between sensible cyber purchases and those that are promoted by exaggerating risk Continue Reading

By

• Peter Ray Allison

How can you balance security with growth?

As businesses focus on recovery and growth, CISOs must deal with today’s challenges while also planning for tomorrow - how can they achieve both safety and success? Continue Reading

By

• Gavin Cartwright

Security Think Tank: Reframing CISO-boardroom relations

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

Security Think Tank: When will they ever learn?

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Mark Raeburn, Accenture Security

Enabling secure remote working is once again a top priority

The pandemic has bought many new security risks, particularly around remote working. As the UK government once again urges people to work from home under its Plan B restrictions, these risks must be tackled as a priority Continue Reading

By

• Warwick Ashford, Senior analyst

After Log4j, December Patch Tuesday piles on the pressure

December’s Patch Tuesday update from Microsoft contains several critical CVEs, but this month all attention is focused on the fall-out from Log4Shell, and burn-out is becoming a real issue Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Get to know your personal threat landscape

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Andrew Morris, Turnkey Consulting

UK government to take ‘whole-of-society’ approach to cyber

Second iteration of the UK’s National Cyber Strategy broadens its focus to build a ‘whole-of-society’ security posture Continue Reading

By

• Alex Scroxton, Security Editor

Almost half of networks probed for Log4Shell weaknesses

Close to half of corporate networks have already been actively targeted by individuals seeking to exploit the critical Log4Shell Apache bug Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: We are failing to get the cyber message across to users

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Chris Cooper

What is Log4Shell, and why are we panicking about it?

It’s been described as a ‘design failure of catastrophic proportions’ that threatens the very fabric of the digital world. Find out what the Log4j2 Log4Shell panic is all about, and what you should do about it Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: There’s much more to do to secure hybrid workers

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Jack Chapman

C-suite’s biggest ransomware fear: Post-attack regulatory sanctions

Exposure to regulatory sanctions such as fines are the biggest worry for C-suite executives in the wake of a ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

What are the challenges associated with the MITRE ATT&CK framework?

Businesses sometimes struggle to use the MITRE ATT&CK framework effectively. Learn more about some of the challenges, and how to overcome them Continue Reading

By

• Shannon Flynn, ReHack Magazine

UK and US to collaborate on privacy innovation contest

Joint UK-US innovation challenge contest centring on privacy-enhancing technology announced at Summit for Democracy in Washington DC Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Good documentation could save your bacon

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Petra Wenham

2021 another record-breaker for vulnerability disclosure

More than 50 CVEs were logged every day in 2021, more than at any time since records began, while ethical hackers continue to prove their value Continue Reading

By

• Alex Scroxton, Security Editor

Russia may be collaborating with US to bring cyber criminals to heel

Trustwave’s SpiderLabs says its analysis of chatter on underground dark web forums suggests cyber criminals are starting to panic that formerly ‘friendly’ governments are on their case Continue Reading

By

• Alex Scroxton, Security Editor

Number of .uk domain suspensions at record low

Statistics from Nominet show how effective law enforcement action against cyber crime in the UK is paying off Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2022: Pandemic’s long tail for cyber buyers

Pandemic response has been top of mind for cyber leaders these past 18 months, and as Covid-19 turns two, the TechTarget/Computer Weekly IT Priorities 2022 study shows buyers are still focused on how Covid has upended the workplace Continue Reading

By

• Alex Scroxton, Security Editor