Security policy and user awareness

Overcome the security talent shortage by addressing your tech stack

This is a guest post by Graham Pearson, vice-president and general manager for ANZ at Lacework Australians will spend approximately $5.6bn on cyber security alone this year, according to AustCyber, ... Continue Reading

By

• Aaron Tan, TechTarget

Security Think Tank: Think people, processes and systems

Security learning is a career-long process, so as 2021 draws to a close, participants in the Computer Weekly Security Think Tank sum up the most important cyber lessons they’ve taken away from the past 12 months Continue Reading

By

• Cate Pye, PA Consulting

Kaspersky introduces cyber policy for bionic devices

Cyber firm Kaspersky has become one of the first organisations in the world to develop and implement a security policy covering the use of bionic devices and other forms of human augmentation Continue Reading

By

• Alex Scroxton, Security Editor

A ‘whole of society’ approach to cyber may be on the horizon

Nominet Cyber managing director David Carroll reflects on the NCSC’s latest annual review amid 2021’s fast-evolving threat landscape Continue Reading

By

• David Carroll, Nominet Cyber

Compliance, device management a challenge for NHS cyber teams

Information gleaned by asset visibility specialist Armis reveals that despite improvements, some daunting security challenges still dog the NHS Continue Reading

By

• Alex Scroxton, Security Editor

MI6 will ‘open up’ to tech firms to innovate faster than adversaries, says chief Richard Moore

MI6 will use investment fund to back tech companies to develop long-term technologies that will help it to keep pace with China and Russia Continue Reading

By

• Bill Goodwin, Computer Weekly

HP patches bugs in over 150 printer models

More than 150 HP multifunction printers are at risk of compromise through a series of newly disclosed vulnerabilities, one of them wormable Continue Reading

By

• Alex Scroxton, Security Editor

Recovering from ransomware: One organisation’s inside story

In February 2021, French office equipment supplier Manutan fell victim to a DoppelPaymer ransomware hit. IT ops director Jérôme Marchandiau tells the inside story of the incident Continue Reading

By

• Yann Serra, LeMagIT

Why does ransomware still work?

As someone who first encountered ransomware during the last millennium – thankfully at second-hand – and has been writing about it for almost as long, I sometimes find myself amazed by the high ... Continue Reading

By

• Bryan Betts, Freeform Dynamics

British Army picks Immersive Labs for cyber training

The British Army will make Immersive Labs’ security training platform available to all serving personnel Continue Reading

By

• Alex Scroxton, Security Editor

Three latest trends and developments around the Mitre ATT&CK framework

Framework is set to receive important updates to help organisations and businesses evolve their cyber security. Learn more about what it offers Continue Reading

By

• Shannon Flynn, ReHack Magazine

Security Think Tank: Dissecting the true value of SASE is a challenge

As a relatively nascent technology that is getting a lot of publicity, dissecting the true value of SASE is still a difficult proposition, for now Continue Reading

By

• Maximilian Brook

UK’s surveillance culture may be normalising use of tech for abuse

Intense surveillance of public spaces by UK authorities may be playing a part in the normalisation of cyber stalking in intimate relationships Continue Reading

By

• Alex Scroxton, Security Editor

UK consumers warned of increase in credit card application fraud

There has been a sharp rise in fraudsters using stolen personal details to open credit card accounts Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

NCSC commits to new diversity measures

The National Cyber Security Centre’s second annual report on diversity in cyber security finds room for improvement Continue Reading

By

• Alex Scroxton, Security Editor

Upcoming holidays prompt ransomware warning from authorities

Ransomware gangs know how calendars work, and may target their attacks around major holidays to take advantage of more people being off work, according to a new alert Continue Reading

By

• Alex Scroxton, Security Editor

Black Friday cyber warning for 4,000 card-skimming victims

NCSC warns thousands of small retailers that their websites are being exploited to steal customer data Continue Reading

By

• Alex Scroxton, Security Editor

Why is Emotet back, and should we be worried about it?

The sudden reappearance of Emotet this week has security teams on high alert, but do we need to be worried about its return, and what should we be doing about it? Continue Reading

By

• Alex Scroxton, Security Editor

GCHQ, NSA chiefs recommit to counter cyber threats

UK and US intelligence services reaffirm a joint commitment to disrupt and deter new and emerging cyber threats Continue Reading

By

• Alex Scroxton, Security Editor

Forced on-line by the NHS: to be confused, exploited, ignored, mistreated and/or patronised

All this informed my MSc IT Security final dissertation entitled ‘Inclusion, Confusion and Exclusion – is technology making the Vulnerable more Vulnerable?’ I looked at Social, Financial and ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Government to legislate to make APP fraud reimbursement mandatory

UK payments regulator wants to reduce the huge sums of money lost to authorised push payment fraud and is calling on the banking and tech industries to play their part Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security startups line up on Cyber Runway

Some 108 cyber security startups representing the UK’s most cutting-edge innovators are to join Plexal’s Cyber Runway accelerator Continue Reading

By

• Alex Scroxton, Security Editor

Zero-days: The next element of the service-based cyber economy?

Digital Shadows researchers have reported on the emergence of zero-days as a service, which could be the next big thing in the cyber criminal underworld Continue Reading

By

• Alex Scroxton, Security Editor

Out of the shadows: The rise of ethical hackers in 2021

Ethical hackers working on the Bugcrowd platform have saved organisations almost $30bn in risk during the Covid-19 pandemic, as the community sheds old stereotypes Continue Reading

By

• Alex Scroxton, Security Editor

One-fifth of NCSC-supported cyber incidents linked to Covid-19

National Cyber Security Centre has helped to thwart multiple cyber incidents that could have seriously disrupted the UK’s response to the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

UK government proposes new rules for digital supply chain security

Proposals could see IT service providers legally required to adhere to the NCSC’s Cyber Assessment Framework, among other things Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: What to find out before investing in SASE

Petra Wenham of the BCS shares her thoughts on what organisations need to consider as they investigate whether or not to invest in secure access service edge technology Continue Reading

By

• Petra Wenham

HPE’s Aruba networking unit hit by cyber attack

Undisclosed threat actor compromised data buckets used to run the Aruba Central cloud environment using a stolen access key Continue Reading

By

• Alex Scroxton, Security Editor

Scale of crime-as-a-service economy a growing concern, say researchers

The cyber criminal underground continues its evolution towards a service-based economy Continue Reading

By

• Alex Scroxton, Security Editor

The ICO is right to push back against government meddling

Some criticisms of the ICO are justified, but the answer to that is not to give Whitehall more oversight over the data protection regulator, argues legal expert Edward Machin Continue Reading

By

• Edward Machin

Bank of England loses 161 computing devices in three years

Bank cannot account for phones, laptops and tablets that have gone missing over the past three years Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Zero trust: Now is the time

The cyber security industry has been talking about a zero-trust approach to security for just over a decade, but now it’s time to move towards full implementation because it is more appropriate than ever, and it is rapidly gaining support from suppliers Continue Reading

By

• Warwick Ashford, Senior analyst

November Patch Tuesday drop fixes bugs in Excel, Exchange Server

Another relatively light Patch Tuesday drop from Microsoft addresses 55 vulnerabilities, two of them already being exploited Continue Reading

By

• Alex Scroxton, Security Editor

Digital surveillance of remote workers may increase enterprise risk

From productivity tools to security threats, we explore how digital surveillance is forcing remote workers towards shadow IT Continue Reading

By

• Matthew Staff

How to manage endpoint security in a hybrid work environment

The future of the workplace is clearly hybrid, but this has untold implications around endpoint security. How can businesses overcome these? Continue Reading

By

• Nicholas Fearn

The Secret IR Insider’s Diary – this is not a fashion show

In the latest pages taken from their diary, the Secret IR Insider reveals why organisations should be worried about every threat, not just the latest and greatest Continue Reading

By

• The Secret IR Insider, Check Point

US seeks to extradite REvil affiliate who attacked Kaseya

US Department of Justice unseals charges against a Ukrainian national accused of being behind the summer 2021 REvil ransomware attack on Kaseya Continue Reading

By

• Alex Scroxton, Security Editor

Shock horror... Humans used for security validation instead of AI/M-L!

As a judge on the Tech Trailblazers awards, I can assure you of two security-related actuality wotsits: The onslaught of security start-ups is anything but slowing down; this year has seen a record ... Continue Reading

By

• Steve Broadhead, Broadband Testing

The Netherlands works on resilience with large-scale national cyber exercise

For the Netherlands, the biggest challenge in a large-scale cyber crisis is to maintain speed while exercising due care Continue Reading

By

• Kim Loohuis

Spyware firm NSO and others added to US banned Entity List

US government bans target Israeli spyware makers and cyber firms in Russia and Singapore Continue Reading

By

• Alex Scroxton, Security Editor

UK’s Labour Party hit by third-party data breach

Data on Labour Party members was recently compromised in an apparent cyber attack on a third-party data processor Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: SASE – marketing buzz or the future of security?

SASE architectures promise to prevent multiple types of cyber attacks, but deciding whether SASE is right for your organisation will require understanding whether SASE is a fit for your use cases in IT Continue Reading

By

• Martin Kuppinger, KuppingerCole

BlackMatter ransomware crew shuts down, leaves victims in a bind

The BlackMatter ransomware gang appears to be winding down its activities, possibly due to pressure from law enforcement Continue Reading

By

• Alex Scroxton, Security Editor

Businesses and governments urged to take action over Trojan Source supply chain attacks

Businesses and governments have been put on alert to guard against Trojan Source hacking attacks Continue Reading

By

• Bill Goodwin, Computer Weekly

Online Safety Bill puts user protection onus on platform providers

The Online Safety Bill will place new duties and responsibilities on online platforms accessible from the UK, but as it currently stands, it contains several grey areas Continue Reading

By

• Peter Ray Allison

Facebook rebrands to Meta amid continuing controversies

Facebook has changed its corporate name to Meta to support its work on the next generation of “social technologies”, but concerns around trust and privacy persist Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How ransomware crews pile on the pressure to get victims to pay

Sophos researchers share some of the more common tactics ransomware gangs use to pressurise their victims into paying up Continue Reading

By

• Alex Scroxton, Security Editor

Government commits millions to security investment

Spending Review adds more than £750m of funding to improve cyber security resilience across government Continue Reading

By

• Alex Scroxton, Security Editor

Cyber sector growth exacerbating skills shortage

Data from security association (ISC)² shows demand for cyber pros is still outpacing supply as the sector continues an upward growth trajectory Continue Reading

By

• Alex Scroxton, Security Editor

Cyber experts on how to nobble a Nobelium attack

A recent spate of attempted Nobelium cyber attacks were mostly unsuccessful, but serve as a reminder to pay attention to some more fundamental aspects of security Continue Reading

By

• Alex Scroxton, Security Editor

Managing cyber risk by integrating supply chains

In this week’s Computer Weekly, our latest Buyer’s Guide examines the security and IT integration challenges of modern supply chains, especially post-pandemic – while we also talk to the CEO of software provider SolarWinds about how the company overcame its huge supply chain attack. And we look at how a small town in Lancashire was chosen as the HQ for the UK’s new National Cyber Force. Read the issue now. Continue Reading

Airport operator MAG boosts threat visibility with hybrid SOC

With budget concerns weighing heavy during the pandemic, Manchester Airports Group ditched an impending capex-heavy cyber investment in favour of a hybrid managed/in-house approach. Learn more about its experience Continue Reading

By

• Alex Scroxton, Security Editor

LightBasin hackers breach 13 telcos in two years

Hackers have obtained an undisclosed volume of subscriber information and call metadata in a sustained campaign against telecommunications firms Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Back on the office network: What are the risks for mobile users?

Many people are returning to offices and bringing their mobile devices with them. What are the cyber security implications of this? Continue Reading

By

• Nicholas Fearn

No easy fix for vulnerability exploitation, so be prepared

Vulnerability management and disclosure is a tricky business with ethical and business ramifications for software vendors, CISOs and ethical hackers alike – and CISOs sit right in the middle of this Continue Reading

By

• Andrew Morris, Turnkey Consulting

Doing the right thing: How CISOs should approach responsible disclosure

Owen Wright, responsible for penetration testing and adversary simulation at Context, part of Accenture Security, advises how CISOs should approach responsible disclosure Continue Reading

By

• Owen Wright, Accenture Security

NHS Digital enhances in-house cyber awareness drive

Keep IT Confidential campaign aims to help NHS staff understand more about security threats and learn how to reduce risk Continue Reading

By

• Alex Scroxton, Security Editor

Encryption protects the marginalised – and it’s under threat

Encryption keeps marginalised groups connected and safe, but new regulatory attempts to break it put them at risk Continue Reading

By

• Callum Voge

FCA warns over future hybrid working security risks

Earlier this week, the Financial Conduct Authority issued fresh guidance to regulated organisations on keeping hybrid workers safe and secure Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft warns of MysterySnail on October Patch Tuesday

Microsoft has fixed a zero-day that is being actively exploited to deliver a new remote access trojan dubbed MysterySnail to targets Continue Reading

By

• Alex Scroxton, Security Editor

Former signals intel leader named godfather of UK security

Sixth annual Security Serious Unsung Heroes Awards honours former Royal Corps of Signals colonel and infosec pioneer John Doody Continue Reading

By

• Alex Scroxton, Security Editor

Australia unveils ransomware action plan

The Australian government has established a task force to address the ransomware menace and is proposing legislation to mandate reporting of ransomware incidents by businesses Continue Reading

By

• Stephen Withers

BCS calls on government to retain protections against AI

BCS, the Chartered Institute for IT, wants the government to retain protections that allow people to have decisions about them made by an AI reviewed by humans if needed Continue Reading

By

• Alex Scroxton, Security Editor

Covid-19 will loom over cyber strategy for years to come

In remarks delivered to a Chatham House conference, NCSC head Lindy Cameron reflects on the security challenges facing the UK, and sets out some plans for the future Continue Reading

By

• Alex Scroxton, Security Editor

Sensitive documents to stay with whistleblower after deadline for agreement for their return passes

A deadllne to agree the safe return of the sensitive banking details of former and current NatWest Group customers has passed without agreement Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Singapore refreshes cyber security strategy

The city-state updates its national cyber security strategy to shore up the security of critical infrastructure and enterprises while growing its cyber security industry, among other goals Continue Reading

By

• Aaron Tan, TechTarget

Craft beer specialist Brewdog fixes serious app vulnerability

Vulnerability in brewer’s mobile app could have resulted in serious consequences for its shareholders and customers Continue Reading

By

• Alex Scroxton, Security Editor

Fast-moving Ryuk campaign targets healthcare organisations

Newly designated FIN12 gang leverages the work of the cyber criminal ecosystem to conduct lightning-fast ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Addressing the backup dilemma to ransomware recovery

Everyone knows good backups are essential if one is to recover from a ransomware attack, but using them effectively poses challenges that IT teams need to know about Continue Reading

By

• W Curtis Preston

ICO expresses concerns over its future independence

In its response to the government’s data protection consultation, the Information Commissioner’s Office has raised worries over its future ability to function independently of government interference Continue Reading

By

• Alex Scroxton, Security Editor

Twitch data breach investigations continue

Investigations are ongoing into a 125GB data breach that hit livestreaming platform Twitch, apparently the work of hacktivists Continue Reading

By

• Alex Scroxton, Security Editor

US lawmakers propose ransomware reporting rules

Former presidential candidate Elizabeth Warren lends her support to a bill that would require corporate ransomware victims to disclose more information about their attacks to the authorities Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Responsible vulnerability disclosure is a joint effort

By working hand-in-hand, developers and security researchers can both play a vital role in ensuring newly-discovered vulnerabilities are addressed appropriately, writes Paddy Francis of Airbus CyberSecurity Continue Reading

By

• Paddy Francis

Gaming service Twitch hacked, data leaked

Users of livestreaming platform Twitch may be at risk after a 125GB torrent of data was leaked Continue Reading

By

• Alex Scroxton, Security Editor

Apache web server users urged to patch immediately

New zero-day in Apache HTTP Server is already being actively exploited and must be addressed immediately Continue Reading

By

• Alex Scroxton, Security Editor

Auto-enrolment begins for Google multi-factor authentication

Google has started to turn on multi-factor authentication on consumer accounts by default, and aims to auto-enrol 150 million users by the end of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

New strategies needed to close the cyber security skills gap

Teaching cyber security in schools is a long-term solution to a present-day problem Continue Reading

By

• Martin Smith, SASIG

New Python-based ransomware attacks unfold in record time

Sophos researchers detail a new variety of Python-based ransomware attack targeting VMware ESXi-hosted VMs Continue Reading

By

• Alex Scroxton, Security Editor

Invest in cyber security with confidence using a structured approach

Cyber security has never been more challenging or important in rapidly changing business, regulatory, IT and threat environments. There is a need for a more structured approach to investment Continue Reading

By

• Warwick Ashford, Senior analyst

Two arrests made in European ransomware investigation

Unnamed ransomware operation was disrupted last week in Kiev, Ukraine, following a coordinated investigation Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Embracing vulnerability management for the greater good

When it comes to vulnerability management, CISOs should define a responsible disclosure policy so that they can receive and manage identified vulnerabilities transparently, practically and collaboratively, says Paul Watts of the ISF Continue Reading

By

• Paul Watts, Information Security Forum

Amnesty International exploited in malware campaign

According to new intelligence from Cisco Talos, Amnesty International’s branding and profile is being used as part of a new malware campaign that exploits people’s fears of the notorious Pegasus spyware app Continue Reading

By

• Alex Scroxton, Security Editor

JVCKenwood hit by Conti ransomware attack

Nearly 2TB of data was stolen from Japanese electronics firm in a Conti ransomware hit Continue Reading

By

• Alex Scroxton, Security Editor

UK consumers would collectively pay over £1bn a year for control of their data

UK consumers are willing to pay a small fee per month to have control of the data they share with Google and Facebook Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

FoggyWeb malware latest tool of dangerous Nobelium APT

Microsoft’s threat intelligence team warns of a new strain of malware being used by the Russia-linked Nobelium APT Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: How SolarWinds came through its darkest hour

In his first major UK press interview, SolarWinds CEO Sudhakar Ramakrishna tells Computer Weekly how a relentless focus on transparency saw the company safely through a nightmare cyber breach scenario Continue Reading

By

• Alex Scroxton, Security Editor

How one red team exercise averted a new SolarWinds-style attack

Palo Alto Networks shares details of how its red teamers found and sealed a customer vulnerability that could have led to another SolarWinds-style supply chain attack Continue Reading

By

• Alex Scroxton, Security Editor

Women and BAME people bear brunt of cyber crime impact

Cyber crime has a disproportionate impact on women and BAME people, according to a new report Continue Reading

By

• Alex Scroxton, Security Editor

What it takes to attract and retain women in cyber security

The narrowing gender gap may be a cause for cheer, but more needs to be done to curb discrimination, and attract and retain women for cyber security roles in Asia-Pacific Continue Reading

By

• Ai Lei Tao

How Australia punches above its weight in cyber security

Australia is playing to its strengths in niche areas such as governance and deep tech to punch above its weight in the cyber security industry Continue Reading

By

• Aaron Tan, TechTarget

Fresh alert over Conti ransomware surge

Conti ransomware crew appears increasingly active, prompting fresh warnings from the US authorities Continue Reading

By

• Alex Scroxton, Security Editor

Threat actors target VMware vCenter Server users

Users of VMware vCenter Server are advised to patch a series of vulnerabilities post haste Continue Reading

By

• Alex Scroxton, Security Editor

Please protect us from our own stupidity

It seems like the simplest thing. Compose an email message and then CC colleagues. But,due to a Ministry of Defence blunder,  this simple action, built into pretty much every piece of email client ... Continue Reading

By

• Cliff Saran, Managing Editor

Managing cyber risk through integrated supply chains

High-profile supply chain cyber attacks have caused huge disruption this year. PA Consulting’s Carl Nightingale considers key questions business leaders should be asking of their organisations Continue Reading

By

• Carl Nightingale

US sanctions Suex crypto exchange over ransomware links

US Treasury cracks down on cryptocurrency exchange that supposedly facilitated proceeds from multiple ransomware gangs Continue Reading

By

• Alex Scroxton, Security Editor

Investigation launched after MoD email blunder

Exposure of PII on Afghan interpreters who worked with the UK may put hundreds at risk of Taliban reprisals Continue Reading

By

• Alex Scroxton, Security Editor

Spanish police bust Mafia-linked phishing gang

A joint operation between European authorities has dismantled a cyber criminal gang with links to the Italian Mafia Continue Reading

By

• Alex Scroxton, Security Editor

security policy

A security policy is a document that states in writing how a company plans to protect its physical and information technology (IT) assets. Continue Reading

By

• Ben Lutkevich, Site Editor

Dutch education administrators underestimate threat of cyber crime

Research shows educational establishments in the Netherlands are becoming favoured targets of cyber criminals and administrators are underestimating the risks Continue Reading

By

• Kim Loohuis

Bitdefender launches free REvil ransomware decryptor

Working alongside law enforcement partners, Bitdefender has developed and released a tool to help REvil victims recover their data for free Continue Reading

By

• Alex Scroxton, Security Editor