Security policy and user awareness

Check Point unearths critical SigRed bug in Windows DNS

SigRed vulnerability is highly dangerous, but is being fixed as part of the July 2020 Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

CISOs undervalued, overworked, burning out, warns CIISec

The vast majority of security professionals say they are under immense pressure, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: AI in cyber needs complex cost/benefit analysis

AI and machine learning techniques are said to hold great promise in security, enabling organisations to operate a IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation being gravely overestimated? Continue Reading

By

• Anne Bailey

‘Name-and-shame’ ransomware attacks increasing in prevalence

Since emerging at the tail-end of 2019, double extortion, or exfiltration and encryption, ransomware attacks have become highly popular, and now account for a significant number of incidents, according to Emsisoft research Continue Reading

By

• Alex Scroxton, Security Editor

Australian enterprises facing more cyber attacks

The volume of cyber attacks in Australia jumped from 90% in October 2019 and 81% in February 2019, underscoring the worsening threat landscape in the country Continue Reading

By

• Aaron Tan, TechTarget

NCSC launches pen testing service for remote workers

An expansion to the successful Exercise in a Box toolkit will enable SMEs to probe the cyber security defences of remote workers Continue Reading

By

• Alex Scroxton, Security Editor

Zoom zero-day a reminder to stop using Windows 7

Researchers have disclosed a newly discovered zero-day vulnerability to videoconferencing service Zoom, which only affects users of Windows 7 systems Continue Reading

By

• Alex Scroxton, Security Editor

HSBC customers targeted in new smishing scam

SMS phishing scam is targeting HSBC customers in the UK to trick them into handing over their bank account details Continue Reading

By

• Alex Scroxton, Security Editor

Majority of security pros fed up with alert fatigue

A vast majority of security professionals say they experience alert fatigue, and 88% are facing challenges with their current SIEM setup, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Clearview AI faces ICO investigation over facial recognition

Controversial company that scraped data from the public internet to build its facial recognition algorithm faces a joint UK-Australian investigation into its practices Continue Reading

By

• Alex Scroxton, Security Editor

Most finance firms are multicloud, but many are unprepared for public cloud cyber attacks

Financial services firms are moving to the cloud at pace, but many are uncertain whether they could cope with an attack on an application based in the public cloud Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Pubs and restaurants failing on cyber fraud protection

Virtually all of the UK’s most popular restaurant and pub brands are failing to proactively block fraudulent emails from reaching their targets Continue Reading

By

• Alex Scroxton, Security Editor

Political awareness needed to ethically handle migration data, panel claims

Understanding the political, social and economic relationships between different groups in society is needed to ensure location data is not used in ways that further endanger already vulnerable people on the move Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Use of spyware apps linked to domestic abuse soars in lockdown

The rise in domestic violence during the pandemic has been linked to increase use of stalkerware apps by abusers Continue Reading

By

• Alex Scroxton, Security Editor

Cosmic Lynx cyber crime group takes BEC to new heights

Newly identified Russian threat group targets large organisations with increasingly dangerous business email compromise attacks Continue Reading

By

• Alex Scroxton, Security Editor

Over 15 billion credentials for sale on dark web

Research by Digital Shadows reveals the scale of the security threat facing consumers as it uncovers 15 billion usernames and passwords stolen in more than 100,000 different data breaches Continue Reading

By

• Alex Scroxton, Security Editor

Cyber4Summer scheme to divert young people from cyber crime

Cyber4Summer platform will offer 100 different tracks covering a range of security skills to divert them from falling into a life of cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Balancing human oversight with AI autonomy

Artificial intelligence and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation gravely overestimated? Continue Reading

By

• Richard Absalom, Information Security Forum

CIO interview: David Allison, global head of IT, First Quantum Minerals

For his first global CIO role, the IT chief had to tackle unusual challenges such as reliable networking and IT use in inhospitable mining environments in developing countries Continue Reading

By

• Mark Samuels

Chinese law may require companies to disclose cyber-security preparations outside China

Companies with Chinese operations may have to disclose information about the security of their networks in other countries under China’s draft data security law Continue Reading

By

• Bill Goodwin, Computer Weekly

Security Think Tank: Artificial intelligence will be no silver bullet for security

AI and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation gravely overestimated? Continue Reading

By

• Ivana Bartoletti

Locked-down teens flock to NCSC CyberFirst training scheme

A record number of 14 to 17-year-olds have signed up to the National Cyber Security Centre’s CyberFirst summer school Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: AI cyber attacks will be a step-change for criminals

AI and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation gravely overestimated? Continue Reading

By

• Lee Howells and Yannis Kalfoglou

UK’s unsung cyber security heroes sought

Nominations have opened for the fifth annual Security Serious Unsung Heroes Awards Continue Reading

By

• Alex Scroxton, Security Editor

Zoom making progress on cyber security and privacy, says CEO

Three months after being hit by a spate of security incidents, Zoom’s CEO, Eric Yuan, has been discussing progress towards a more secure product Continue Reading

By

• Alex Scroxton, Security Editor

Remote workers more aware of security, but still flout the rules

Almost three-quarters of remote workers reckon they have gained in cyber security awareness during lockdown, but don’t seem to be especially bothered about keeping themselves safe Continue Reading

By

• Alex Scroxton, Security Editor

Mysterious EvilQuest macOS ransomware spreads through torrents

A new strain of ransomware, dubbed EvilQuest, is threatening Apple Mac environments, and seems to behave quite oddly Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Get your house in order before deploying AI

AI and machine learning techniques are said to hold great promise in security, enabling organisations to operate a IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation being gravely overestimated? Continue Reading

By

• Mike Gillespie

Time to rethink business continuity and cyber security

Business continuity and cyber security remain largely in separate silos, but changes in the IT and cyber threat landscapes mean there is an urgent need for organisations to alter their approach Continue Reading

By

• Warwick Ashford, Senior analyst

FakeSpy Android malware targets Royal Mail app users

The FakeSpy malware was first identified in October 2017 but is now significantly more powerful and dangerous Continue Reading

By

• Alex Scroxton, Security Editor

Australia to invest a record A$1.35bn in cyber security

The Australian government is making its largest ever investment in cyber security over the next decade to identify cyber threats, disrupt foreign cyber criminals and build new capabilities Continue Reading

By

• Aaron Tan, TechTarget

ReversingLabs makes over 100 Yara rules publicly available

Threat intelligence specialist is making its IP available on GitHub to support malware hunters in their work Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: ‘Shift left’ to secure containers

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Paul Holland, Information Security Forum

The Security Interviews: What CISOs can learn from Covid-19

Mike Lloyd, CTO at Redseal, holds 21 cyber security patents and a PhD in stochastic epidemic modelling from Heriot-Watt University in Edinburgh, so is probably the man to talk to when it comes to cyber security in the world of Covid-19 Continue Reading

By

• Alex Scroxton, Security Editor

Complex security estates hinder incident response

The more disparate security tools in use in an organisation, the harder it becomes to mount an effective incident response Continue Reading

By

• Alex Scroxton, Security Editor

Phishing back in vogue as ransomware vector

Researchers have observed an increase in phishing as a means to deliver ransomware payloads – and organisations don’t appear to be prepared Continue Reading

By

• Alex Scroxton, Security Editor

Evil Corp’s latest ransomware project spreading fast

A new ransomware strain dubbed WastedLocker is spreading rapidly and targeting major corporations Continue Reading

By

• Alex Scroxton, Security Editor

Out of date security laws leave UK plc at risk during pandemic

The CyberUp coalition has written to Boris Johnson to urge him to reform the UK’s 30 year-old cyber crime laws Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Cyber crime landscape evolving as lockdown eases

As some countries begin to gradually ease Covid-19 lockdown measures, cyber criminals’ tactics are changing, but the pandemic remains a tempting lure Continue Reading

By

• Alex Scroxton, Security Editor

Australian government has failed on cyber security

The federal government’s current approach of allowing each agency to make its own cyber decisions is not working and more needs to be done to hunt down adversaries Continue Reading

By

• Carlo Minassian

Pub ‘check-in’ apps provoke fresh privacy concerns

With pubs and restaurants required to collect customer data for contact tracing when they reopen, data privacy risks will be heightened Continue Reading

By

• Alex Scroxton, Security Editor

NCSC catches a million phishes in its nets

The NCSC has racked up a million suspicious email reports from the public just two months after launching a reporting service, but the lucky sender won’t be receiving a grand prize Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Securing containers needn’t be taxing

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Andrew Morris, Turnkey Consulting

EU judges GDPR an overall success, but changes still needed

Two years after its implementation, an EU report says that the GDPR is achieving what it set out to do, with a few reservations Continue Reading

By

• Alex Scroxton, Security Editor

Brits will sell their personal data for pennies

Surprising findings from an Okta report on digital identity suggest Brits would be willing to part with valuable personal data for a surprisingly low amount Continue Reading

By

• Alex Scroxton, Security Editor

APT groups’ mobile momentum finally faces resistance

State-backed APT groups are increasingly targeting mobile devices as Covid-19 puts the spotlight on remote working infrastructure security. We explore how the industry is fighting back Continue Reading

By

• Matthew Staff

How to apply zero-trust models to container security

Containers have become a common fixture in software development, but they have resulted in new concerns for security teams. Is zero-trust the answer to tackling them? Continue Reading

By

• Nicholas Fearn

Neurodiversity on the rise among career hackers

More diverse hackers enhance the ability of both traditional and cutting-edge cyber security solutions to find and fix vulnerabilities, according to a new report from Bugcrowd Continue Reading

By

• Alex Scroxton, Security Editor

Flash-based MacOS malware hides in plain sight

By masquerading as a legitimate Adobe web application, the new malware strains can trick Mac users into bypassing their on-board defences Continue Reading

By

• Alex Scroxton, Security Editor

Concern over digital risk falls dramatically during pandemic

Brits are understandably more worried about the NHS than personal cyber security Continue Reading

By

• Alex Scroxton, Security Editor

APAC still hotbed for cyber attacks

Individuals and organisations in APAC are encountering malware more frequently than the rest of the world, study finds Continue Reading

By

• Aaron Tan, TechTarget

CW APAC: Trend Watch – data protection

Asia-Pacific organisations see the importance of having good data protection practices, even as they are still grappling with organisational and operational challenges. In this handbook, Computer Weekly looks at the different levels of preparedness across the region and what firms can do to plug any gaps. Continue Reading

Cisco patches dangerous Webex vulnerability

CVE-2020-3347 bug enables cyber criminals to steal meeting records from within Cisco’s Webex service Continue Reading

By

• Alex Scroxton, Security Editor

Check Point uncovers targeted Microsoft Office 365 phishing campaign

Organised criminal campaign exploited Adobe, Oxford University and Samsung web domains to trick users into giving up their passwords Continue Reading

By

• Alex Scroxton, Security Editor

Zoom U-turns on end-to-end encryption

Embattled video-conferencing provider Zoom backtracks on previous refusals to provide end-to-end encryption to free users Continue Reading

By

• Alex Scroxton, Security Editor

Help secure the top UK entry point for cyberfraud

“NHS” is the UK’s most trusted brand. Until recently it was one of the least protected/secure. There have been significant improvements but, as a result of Covid, impersonating the NHS now comes ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Coronavirus: 50% of security pros had no pandemic contingency plan

A survey of security professionals conducted on behalf of Bitdefender reveals the lack of forward planning for events such as the Covid-19 coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

UK-US data deal puts Brexit data adequacy pact at risk

European Data Protection Board writes to MEPs saying the UK is at risk of failing to strike a post-Brexit data adequacy accord if its data protection agreements with the US don’t strike the right note Continue Reading

By

• Alex Scroxton, Security Editor

Activists call on Zoom to implement encryption for all

A coalition of tech organisations and nonprofits have urged Zoom CEO Eric Yuan to make end-to-end encryption available to all users Continue Reading

By

• Alex Scroxton, Security Editor

Banking trojans roar back to prominence in May

Check Point sees an upswing in malicious activity around a number of classic banking trojan malware variants Continue Reading

By

• Alex Scroxton, Security Editor

Accessories store Claire’s hit by Magecart credit card fraudsters

Attackers gained access to retailer’s website as long ago as March Continue Reading

By

• Alex Scroxton, Security Editor

NHS email service users ensnared in phishing attack

More than 100 accounts on the NHSmail service were affected by attack, but health service says no patient data was accessed Continue Reading

By

• Alex Scroxton, Security Editor

Fake contact-tracing apps delivering banking trojans

Spoof government coronavirus apps are popping up all over the world, says the Anomali Threat Research team Continue Reading

By

• Alex Scroxton, Security Editor

100,000 cheap wireless cameras vulnerable to hacking

Active devices built by Chinese firm HiChip have been sold in the UK as webcams and connected baby monitors Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Bungled British response leads to rise in security risks

Covid-19 cyber security threats are evolving over the course of the pandemic, becoming more targeted to virus hotspots such as the UK Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Container security starts with good DevOps practice

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Paddy Francis

Decade-old vulnerability among 129 Patch Tuesday fixes

A 10 year-old bug in Windows Group Policies could easily enable attackers to gain highly privileged user status on target systems, opening the doors to a wave of cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Container security is evolving, so must CISOs

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Petra Wenham

Coronavirus: How to go back to the office safely and securely

Security teams should be used to supporting remote workers effectively by now, but what’s going to happen when people start returning to their offices? We look at the risks and how to address them. Continue Reading

By

• Alex Scroxton, Security Editor

Nasty surprises lurking in furloughed employees’ inboxes

Research conducted by KnowBe4 points to a looming email security problem as furloughed employees head back to work Continue Reading

By

• Alex Scroxton, Security Editor

CaixaBank introduces facial recognition ATMs

Spanish bank broadens its use of facial recognition technology on cash machines Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

How Australian firms can defend against supply chain attacks

Supply chain security risks can wreak havoc if measures are not taken to deter cyber attackers from exploiting a supplier’s security gaps to target another firm Continue Reading

By

• Stephen Withers

Cyber security needs more women role models, says report

A report compiled by security assurance organisation Crest highlights the progress made on gender diversity in cyber security, and offers pointers for next steps Continue Reading

By

• Alex Scroxton, Security Editor

Poorly-secured AWS buckets used to launch Magecart attacks

Cyber criminals are exploiting misconfigured AWS S3 buckets to run credit card fraud and malvertising campaigns, according to new data Continue Reading

By

• Alex Scroxton, Security Editor

How retailers are staying connected during their coronavirus shutdown

In this week’s Computer Weekly, we look at how the hard-hit retail sector has turned to technology to stay connected with staff during the coronavirus lockdown. Our latest buyer’s guide examines best practice in data quality and how to avoid “garbage in garbage out” syndrome. And we look at how remote working affects software development teams. Read the issue now. Continue Reading

Tackling the Covid Cyberfraud Pandemic

The Covid-19 lockdown has led to an explosion of fraud and abuse, both on-line and in the "real" world.  Before Test and Trace is fully operational it is already being spoofed .  The problems are ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Police chiefs working with Public Health England on contact-tracing security

Police force representatives are in talks with Public Health England over operational security concerns arising from the NHS Test and Trace coronavirus contact-tracing scheme Continue Reading

By

• Alex Scroxton, Security Editor

Small businesses failing on remote worker protection

Only one-third of people working for small businesses have received any guidance from their employers on how to secure their remote working set-up Continue Reading

By

• Alex Scroxton, Security Editor

Black Lives Matter activists targeted by cyber attacks

Civil liberties organisations are being targeted by far-right trolls as protests over the murder of George Floyd spread worldwide Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Cyber criminals target laid-off workers

Malicious actors are targeting workers laid-off or furloughed during the coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Four steps to container security best practice

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Alan Taberham and Niall Quinn

Why trust is the new currency

Businesses need to engender trust with customers amid the complexity of digital transactions involving multiple third parties, even as consumers are not fully cognizant of the importance of data privacy Continue Reading

By

• Simon Piff

Sodinokibi data auctions highlight changing criminal tactics

The operators of the Sodinokibi ransomware strain are auctioning off swathes of stolen data in an apparent bid to raise cash. What is motivating this new tactic? Continue Reading

By

• Alex Scroxton, Security Editor

Security procurement framework goes live for NHS and public sector

Cyber Security Services Framework, developed by NHS Shared Business Services, has formally launched Continue Reading

By

• Alex Scroxton, Security Editor

Infosec 2020: Covid-19 an opportunity to change security thinking

The annual Infosecurity Europe is being held virtually this year, and speakers at an online panel session have been considering the impact of the pandemic on security awareness Continue Reading

By

• Alex Scroxton, Security Editor

A view from the SOC: Maintaining security capabilities during the pandemic

What are the challenges of maintaining security event and incident detection capabilities in these challenging times? Continue Reading

By

• Tom Hawcutt

VMware vulnerability leaves private clouds open to takeover

Ethical hackers from Citadelo uncovered a vulnerability in VMware Cloud Director that left private cloud owners open to takeover Continue Reading

By

• Alex Scroxton, Security Editor

What will be the IT security priorities of the post-coronavirus world?

In this week’s Computer Weekly, with the working world after the pandemic set to be very different, we assess the IT security priorities for the ‘new normal’. Facial recognition firms are racing to identify people wearing face masks. And how did Europe’s telecoms networks cope with the switch to remote working? Read the issue now. Continue Reading

WikiLeaks founder Julian Assange misses court hearing due to respiratory problems

The WikiLeaks founder is expected to call 21 witnesses during a three-week extradition hearing in September Continue Reading

By

• Bill Goodwin, Computer Weekly

How managed threat hunting helps bust malicious insiders

Managed threat hunting services can help take some of the pressure off security operations centres and help ensure potential breaches don’t escalate into something far worse. We explore one such case with a happy ending Continue Reading

By

• Alex Scroxton, Security Editor

Singapore’s contact-tracing app tops privacy study

Singapore’s TraceTogether is least intrusive in terms of privacy communications compared with similar apps in the region, study finds Continue Reading

By

• Aaron Tan, TechTarget

Security Think Tank: CISO stress – moving from recognition to action

Cyber criminals are enjoying a boom during the Covid-19 pandemic, and security teams are working overtime as a result. How can security professionals manage their increased workload, safeguard their mental well-being and avoid burnout? Continue Reading

By

• Cath Goulding, Nominet

Public Health England to keep contact-tracing data for 20 years

PHE will retain the data it collects via the NHS Test and Trace programme for 20 years Continue Reading

By

• Alex Scroxton, Security Editor

Australia is painting a big red cyber target on its critical infrastructure

Australia’s critical infrastructure is particularly vulnerable to cyber attacks right now because of years of under-investment in cyber security and ageing legacy systems Continue Reading

By

• Carlo Minassian

GDPR at two: How far we’ve come, how far we still have to go

Marking two years of the General Data Protection Regulation, industry voices weigh in on the state of data protection and privacy, consider what has changed, and what still needs to change Continue Reading

By

• Alex Scroxton, Security Editor

Enterprise clouds hammered by cyber attacks during pandemic

Remote workers logging onto enterprise cloud service accounts are an easy access point for attackers, says McAfee Continue Reading

By

• Alex Scroxton, Security Editor

Fears contact-tracing app will open the floodgates for cyber criminals

Study of UK consumers reveals worries over an uptick in cyber crime and a lack of trust in government Continue Reading

By

• Alex Scroxton, Security Editor

StrandHogg mobile vulnerability has evil twin

Variant of the dangerous StrandHogg vulnerability affecting Android phones could allow hackers to access almost all apps on a target device Continue Reading

By

• Alex Scroxton, Security Editor

Android security vulnerabilities differ by country, say researchers

Manufacturers of Android devices including Huawei, Samsung and Xiaomi shipped devices with different levels of security in different regions, leaving their users exposed to attack Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Temper tantrums ahead as GDPR enters its terrible twos?

On the General Data Protection Regulation’s second birthday, Tim Hickman, a data protection lawyer and partner at White & Case LLP, discusses the regulation’s teething troubles and assesses how best to maintain optimum compliance Continue Reading

By

• Alex Scroxton, Security Editor