Security policy and user awareness

UK plc going backwards on cyber maturity, Cisco report claims

Fewer UK organisations believe their cyber security postures have reached a mature level than did so 12 months ago, as they struggle to keep up with new challenges and a fast-evolving threat landscape Continue Reading

By

• Alex Scroxton, Security Editor

Counter-eavesdropping agency unlawfully used surveillance powers to identify journalist’s source

More than 750 journalists had their communications data accessed by law enforcement and government agencies between 2018 and 2022 Continue Reading

By

• Bill Goodwin, Computer Weekly

NCSC reaffirms guidance for those at risk of Chinese state hacking

As the UK and US governments announce sanctions and indictments of a Chinese state threat actor, the NCSC has reiterated its security advice for individuals at risk of being targeted for espionage purposes Continue Reading

By

• Alex Scroxton, Security Editor

US authorities charge seven over Chinese hacking

The US Department of Justice has charged seven Chinese nationals linked to the APT31 threat actor that targeted politicians in the UK and US Continue Reading

By

• Alex Scroxton, Security Editor

Which? calls for government action on fake banking sites

Amid high volumes of spoofed, fraudulent banking websites, Which? is calling for the government to implement new legal obligations for domain registrars Continue Reading

By

• Alex Scroxton, Security Editor

NCSC guidance to help CEOs work through cyber incidents

The NCSC has published in-depth guidance on how business leaders should respond to a cyber attack or data breach. Learn about some of the key steps you will need to follow Continue Reading

By

• Alex Scroxton, Security Editor

UK’s cyber resilience stagnates as more fall victim to attacks

The government is calling on businesses to ramp up their cyber protections as study shows improvements to resilience are stagnating amid an ever-growing volume of attacks Continue Reading

By

• Alex Scroxton, Security Editor

Board-level buy-in: preparing cyber defences the right way

The cyber security function isn’t a back office team that is never seen and never heard. To truly protect the company, cyber security touches every corner of the business, and it starts from the top Continue Reading

By

• Bruno Soares

Australia’s cyber security spending to grow 11.5% this year

Highly publicised cyber attacks and growing regulatory obligations are keeping security and risk top of mind for Australian organisations this year, says Gartner Continue Reading

By

• Aaron Tan, TechTarget

The Security Interviews: Alex Yampolskiy, SecurityScorecard

Alex Yampolskiy conceived the idea for risk management specialist SecurityScorecard after getting stung by a SaaS supplier that was being cavalier with its customer data. He tells his story to Computer Weekly Continue Reading

By

• Alex Scroxton, Security Editor

UK’s AI ambitions pointless while cyber security is still neglected

The UK’s AI ambitions may be at considerable risk without stronger cyber defences across the private and public sectors Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft AI-powered cyber service to go live in April

After a year being previewed by beta customers, Microsoft’s much vaunted Copilot for Security service is about to go on general release, promising time savings and improved accuracy for hard-pressed security pros Continue Reading

By

• Alex Scroxton, Security Editor

British Library opens up over ransomware attack to help others

The British Library has opted for full transparency after experiencing a devastating ransomware attack, publishing details of the intrusion, its response and the lessons it has learned Continue Reading

By

• Alex Scroxton, Security Editor

March Patch Tuesday throws up two critical Hyper-V flaws

Two critical vulnerabilities in Windows Hyper-V stand out on an otherwise unremarkable Patch Tuesday Continue Reading

By

• Alex Scroxton, Security Editor

Dutch organisations vulnerable to deepfake fraud

With the information many employees share on social media, Dutch companies are especially vulnerable to a new form of fraud Continue Reading

By

• Kim Loohuis

OSS leaders detail commitments to bolster software security

CISA has announced a number of actions to help secure the global open source ecosystem, as leading package repositories including the Python and Rust foundations advance their own initiatives Continue Reading

By

• Alex Scroxton, Security Editor

Rapid7 hits out over botched vulnerability disclosure

Software development firm JetBrains and security specialist Rapid7 fall out over the handling of a critical vulnerability disclosure, while customers are left rushing to patch Continue Reading

By

• Alex Scroxton, Security Editor

Banning ransomware payments back on the agenda

The idea of banning ransomware payments to cyber criminals is back on the agenda, with former NCSC chief Ciaran Martin arguing that tougher measures need to be taken Continue Reading

By

• Alex Scroxton, Security Editor

Authorised access only – biometrics in the workplace

In this week’s Computer Weekly, we examine how biometrics technologies are transforming identity and access management. We analyse research that shows a mismatch between managerial expectations of generative AI and worker experience. And we look at how to assess the best hybrid cloud management tools. Read the issue now. Continue Reading

Ivanti vulnerabilities explained: Everything you need to know

A series of vulnerabilities in Ivanti products have caused concern worldwide. Delve into some of the key issues arising from the Ivanti disclosures, looking at the vulnerabilities and their impact, what affected users should do, and learn about new developments Continue Reading

By

• Alex Scroxton, Security Editor

Okta doubles down on cyber in wake of high-profile breaches

Okta launches Secure Identity Commitment to shore up its technology in the wake of a damaging breach and elevate best practice around identity Continue Reading

By

• Alex Scroxton, Security Editor

75% of third-party breaches target software, IT supply chains

Data drawn from SecurityScorecard’s telemetry reveals how supply chain breaches are becoming a weapon of choice for threat actors Continue Reading

By

• Alex Scroxton, Security Editor

Users love their cyber teams, but find them frustrating

Despite strong support for security teams, a good number of ordinary workers see them as obstructive to business goals, and would like to see them operate more transparently Continue Reading

By

• Alex Scroxton, Security Editor

Black Basta and Bl00dy ransomware gangs exploiting ConnectWise vulns

More ransomware gangs have been observed exploiting two dangerous vulnerabilities in ConnectWise ScreenConnect software, prompting new warnings for users to get patching Continue Reading

By

• Alex Scroxton, Security Editor

Majority of UK employees ‘willingly gamble’ with security

Human-centric threats originating from employees continue to damage organisations both financially and reputationally, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

ConnectWise users see cyber attacks surge, including ransomware

ConnectWise ScreenConnect users who have yet to patch against a critical vulnerability are now being targeted by a barrage of cyber attacks, including ransomware Continue Reading

By

• Alex Scroxton, Security Editor

How can we adapt work practices to protect CISO mental health?

Cyber leaders are finding it harder to keep up with security requirements than just two years ago, risking a domino effect of dissatisfaction, burnout and eventually, resignation Continue Reading

By

• Mick Baccio

LockBit locked out: Cyber community reacts

Reaction to the takedown of the LockBit ransomware gang is enthusiastic, but tempered with the knowledge that cyber criminals are often remarkably resilient Continue Reading

By

• Alex Scroxton, Security Editor

LockBit gang members arrested in Poland and Ukraine

The UK’s National Crime Agency and its global partners have shared more details on their audacious takedown of the LockBit ransomware operation, including news of two arrests Continue Reading

By

• Alex Scroxton, Security Editor

Cops take down LockBit ransomware gang

The notorious LockBit ransomware crew has been disrupted in an international law enforcement sting led by the UK's National Crime Agency Continue Reading

By

• Alex Scroxton, Security Editor

Bouncing back from a cyber attack

Organisations need to move away from victim blaming when cyber attacks on OT systems occur and focus on fostering collaboration between teams to minimise downtime, among other efforts to bounce back and return to business Continue Reading

By

• Marty Rickard

Security-by-design push prompts new ISC2 accreditations

Security-by-design has become a hot-button regulatory issue. ISC2 has decided now is the time to upskill cyber pros around these vital software and hardware development principles Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft: Nation-state hackers are exploiting ChatGPT

Threat actors from China, Iran, North Korea and Russia have all been probing use cases for generative AI service ChatGPT, but have yet to use such tools in a full-blown cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches two zero-days for Valentine’s Day

Two security feature bypasses impacting Microsoft SmartScreen are on the February Patch Tuesday docket, among more than 70 issues Continue Reading

By

• Alex Scroxton, Security Editor

New variants of Qakbot malware under development

Despite its infrastructure having been taken down by the FBI last year, someone appears to be actively working on a new and improved version of the infamous Qakbot malware Continue Reading

By

• Alex Scroxton, Security Editor

Hunter-killer malware volumes seen surging

Latest Picus Security report on malware tactics, techniques and procedures reveals an increasing focus on disabling security defences Continue Reading

By

• Alex Scroxton, Security Editor

Executives must face down state-sponsored hacking groups targeting firmware

State-backed groups have ratcheted up the pressure for cyber security professionals and executives. But that’s not an excuse to cede them the territory. Continue Reading

By

• Michael Marcotte

MoD ethical hacking programme expands after initial success

The Ministry of Defence has expanded the scope of its defensive security partnership with HackerOne Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: The phishing forecast for 2024

Egress' Jack Chapman and James Dyer explore how phishing attacks are set to grow in their scope and sophistication this year, with generative AI playing a big role Continue Reading

By

• Jack Chapman and James Dyer

UK’s McPartland Cyber Review to probe trust in technology

The UK government has launched a cyber security review that will investigate how best to give businesses the confidence they need to use new technologies Continue Reading

By

• Alex Scroxton, Security Editor

UK and France push for international agreement on spyware

The UK and France are hosting diplomats, big tech companies and civil society groups, in a two-day conference in London targeting the proliferation of spyware tools and ‘hackers for hire’ Continue Reading

By

• Bill Goodwin, Computer Weekly

Three predictions for responding to the cyber threat landscape in 2024

Nominet's Kim Wiles looks to the coming months and calls for cooperation and collaboration on tackling cyber security threats Continue Reading

By

• Kim Wiles

Generative AI – an early adopter’s experience

In this week’s Computer Weekly, as IT leaders start to implement GenAI in their organisations, we look at the experiences of one early adopter. Our latest buyer’s guide examines the key security trends for 2024. And Microsoft’s head of identity talks about a future without passwords. Read the issue now. Continue Reading

US sanctions Iranians behind CNI cyber attacks

US government issues new sanctions against six Iranians suspected of being behind a series of cyber attacks targeting critical national infrastructure, notably water supply systems Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Expect more from GenAI in 2024

But 2024 also feels slightly different; the past 12 months have seen generative AI burst on to the scene, and this year its impact will continue to be felt, says Turnkey Consulting's Harshini Carey. Continue Reading

By

• Harshini Carey, Turnkey Consulting

Quantum, AI and geopolitical conflict: '24 will be a big year for cyber

With big trends like quantum, generative AI and geopolitical conflict, 2024 looks set to be a big year in security, but defenders have an unparalleled opportunity to harness these trends for good, says Quorum's Federico Charosky Continue Reading

By

• Federico Charosky

Security Think Tank: What to expect in cyber this year

Risk arising from insecure generative AI, an explosion in mainstream acceptance of zero-trust, and increasingly tight cyber insurance policies will all be high on the agenda in 2024, writes Forrester senior analyst Alla Valente Continue Reading

By

• Alla Valente

Bulk sender authentication: More vital than ever

With new guidelines from Google and Yahoo governing bulk emails coming into force in February 2024, here's what you need to know to keep your sales and marketing lists compliant Continue Reading

By

• Gerasim Hovhannisyan

Bugcrowd sees surge in vulnerability submissions, led by public sector

Crowdsourced vulnerability disclosure and bug bounty platform Bugcrowd says it saw a 151% uptick in submissions related to government and public sector organisations in 2023 Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: 2024 is the year we bridge the cyber divide

ISACA's Steven Sim Kok Leong shares his thoughts on the coming year in cyber security, considering the impact of regulatory change, the evolving role of the CISO, and advances in innovative cyber tech Continue Reading

By

• Steven Sim Kok Leong

Inside Cisco’s security platform strategy

Raj Chopra, senior vice-president of Cisco’s security business, outlines the company’s security platform strategy and how it brought different products together into a single platform Continue Reading

By

• Aaron Tan, TechTarget

Critical vulnerability exposes Fortra GoAnywhere users

Fortra GoAnywhere MFT users must take steps to address a newly disclosed zero-day vulnerability without delay Continue Reading

By

• Alex Scroxton, Security Editor

AI will heighten global ransomware threat, says NCSC

The benefits of artificial intelligence to cyber criminals being well-known, the NCSC now assesses it’s likely AI will soon be widely used to enhance ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Salesforce’s bug bounty programme paid out $3m in 2023

Ethical hackers disclosed more than 4,000 vulnerabilities to Salesforce last year through its bug bounty programme, and received over $3m in rewards Continue Reading

By

• Alex Scroxton, Security Editor

Treat cyber risk like financial or legal issue, says UK government

UK government and NCSC launch proposed code of practice on cyber security governance to help directors and business leaders toughen their defences Continue Reading

By

• Alex Scroxton, Security Editor

Leak of 26 billion records may prove to be ‘mother of all breaches’

The discovery of a dataset comprising 26 billion stolen records may prove to be record-breaking in both its size and the danger it poses to ordinary people Continue Reading

By

• Alex Scroxton, Security Editor

Chat control: Tech companies warn ministers over EU encryption plans

Tech companies have written to EU ministers to urge them to back the European Parliament, rather than the European Commission, over proposed regulations to police child abuse Continue Reading

By

• Bill Goodwin, Computer Weekly

Neighbouring Kent councils hit by simultaneous cyber attacks

Canterbury, Dover and Thanet Councils in Kent have all been struck by simultaneous cyber attacks knocking systems offline, with indications of a link between all three Continue Reading

By

• Alex Scroxton, Security Editor

Powering up cyber security defences with AI

AI holds great promise when it comes to securing valuable, and vulnerable, data, but security teams face some challenges if they are to get the best out of it, writes IBM’s Christopher Meenan Continue Reading

By

• Christopher Meenan

Cyber non-profit enlists ex-NCSC head as technical chair

Founding NCSC chief exec Ciaran Martin is to join the newly launched Cyber Monitoring Centre non-profit as chair of its technical committee Continue Reading

By

• Alex Scroxton, Security Editor

NCSC invites security pros to join the big leagues

The NCSC is inviting security pros from across the UK to sign up to work with its experts on an intelligence-sharing initiative Continue Reading

By

• Alex Scroxton, Security Editor

Biometric revolution in IAM: The future of authentication

The IAM landscape is experiencing profound change thanks to the advent of biometrics. Learn about the latest advantages and key benefits of biometrics in identity Continue Reading

By

• Isla Sibanda

The Security Interviews: Rebecca Taylor, SecureWorks Counter Threat Unit

In October 2023, Rebecca Taylor of the SecureWorks Counter Threat Unit was recognised at the annual Security Serious Unsung Heroes Awards for her work. Computer Weekly caught up with her to talk mentoring, cyber career development and diversity Continue Reading

By

• Alex Scroxton, Security Editor

Victims of 2023 Capita data breaches head to High Court

More than 5,000 people impacted by data breaches arising from two cyber incidents affecting outsourcer Capita have joined a group action lawsuit Continue Reading

By

• Alex Scroxton, Security Editor

Singapore proposes governance framework for generative AI

AI Verify Foundation and Infocomm Media Development Authority have proposed a governance framework for generative AI to address the risks and concerns about the emerging technology Continue Reading

By

• Aaron Tan, TechTarget

Kaspersky shares Pegasus spyware-hunting tool

Kaspersky has developed a way of easily exposing the presence of Pegasus spyware on iOS devices and believes its methodology may also help users identify other such surveillance malware Continue Reading

By

• Alex Scroxton, Security Editor

The human toll of ransomware: how IT pros suffer during incidents

Any ransomware attack causes significant challenges for a business or organisation going through such incident. But ransomware attacks also have tremendous impact on the staff – especially IT teams – working on mitigating the attack’s effect Continue Reading

By

• Pia Hüsch, Jamie MacColl and Gareth Mott

British Library cyber attack explained: What you need to know

In this essential guide, Computer Weekly investigates the cyber attack on the British Library that has rendered IT systems inoperable and caused service disruption to thousands of users Continue Reading

By

• Alex Scroxton, Security Editor

Russia hacked ex-MI6 chief’s emails – what they reveal is more Dad’s Army than deep state

A Russian hacking group that published emails of ex-MI6 chief Richard Dearlove claimed to have uncovered a conspiracy, but it was more Dad’s Army than the ‘deep state’, Computer Weekly and Byline Times reveal Continue Reading

By

• Sophie Hill

NCA director sacked after WhatsApp and email security breaches

Nikki Holland, former director of investigations at the NCA, was sacked for “misconduct” after sending sensitive NCA information over personal email and WhatsApp Continue Reading

By

• Bill Goodwin, Computer Weekly

Windows Kerberos, Hyper-V vulns among January Patch Tuesday bugs

Microsoft starts 2024 right with another slimline Patch Tuesday drop, but there are some critical vulns to be alert to, including a number of man-in-the-middle attack vectors Continue Reading

By

• Alex Scroxton, Security Editor

SEC social media hack highlights value of MFA

The US SEC briefly appeared to approve new bitcoin trading rules after a social media account was targeted by troublemakers, proving the value of MFA once again Continue Reading

By

• Alex Scroxton, Security Editor

Study reveals cyber risks to US elections

With the 2024 US presidential election cycle beginning, a study produced by Arctic Wolf has highlighted big gaps in preparedness and resourcing at government bodies across the US Continue Reading

By

• Alex Scroxton, Security Editor

British Library ransomware attack could cost up to £7m

The cost of recovering the British Library’s ransomware-stricken IT systems could be up to £7m, it has emerged Continue Reading

By

• Alex Scroxton, Security Editor

Dutch working to promote cooperation in Europe to keep internet safe

A Dutch cooperative approach offers national and international cooperation opportunities for ISPs to guard against DDoS attacks, lawful interception and detect abuse in networks Continue Reading

By

• Kim Loohuis

China’s UNC4841 pivots to new Barracuda ESG zero-day

The Chinese state threat actor behind a series of cyber attacks on Barracuda Networks customers embarked on a campaign targeting the supplier’s email security products in the run-up to Christmas Continue Reading

By

• Alex Scroxton, Security Editor

2024: Putting Cyber Resilience into Social, Political, Business and Budget context.

On-line Safety, Safeguarding, Security, Counter-fraud and Resilience matter to voters and business. Cyber does not ... until they become victims ... Online crime is, however, now the world’s third ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Decoding zero trust in endpoint security: A practical guide for CISOs

The exponential increase in endpoints has vastly expanded the average organisation’s attack surface – address this by applying zero-trust best practice to endpoints Continue Reading

By

• Isla Sibanda

What is the CIA triad (confidentiality, integrity and availability)?

The CIA triad refers to confidentiality, integrity and availability, describing a model designed to guide policies for information security within an organization. Continue Reading

By

• Cameron Hashemi-Pour, Site Editor
• Wesley Chai

Top 10 cyber crime stories of 2023

Ransomware gangs dominated the cyber criminal underworld in 2023, a year that will prove notable for significant evolutionary trends in their tactics Continue Reading

By

• Alex Scroxton, Security Editor

Beyond the office walls: Safeguarding remote workers from attack

Remote working has enabled people to work from almost anywhere but has piled pressure on cyber pros. Three years after Covid, how are best practices evolving and what can we expect going forward? Continue Reading

By

• Paul Lewis, Nominet

Zero-trust principles: Your gateway to securing remote workers

Remote working has enabled people to work from almost anywhere but has piled pressure on cyber pros. Three years after Covid, how are best practices evolving and what can we expect going forward? Continue Reading

By

• Michael Healey, Turnkey Consulting

What we learned in cyber in 2023, and what to look out for

PA Consulting's Rasika Somasiri looks back at a busy 12 months in the cyber security world, and highlights some key learnings from 2023 Continue Reading

By

• Rasika Somasiri

Evolving best practice: What next for securing remote work?

Remote working has enabled people to work from almost anywhere but has piled pressure on cyber pros. Three years after Covid, how are best practices evolving and what can we expect going forward? Continue Reading

By

• Scott Burman

Security Think Tank: Testing to improve remote worker security

Remote working has enabled people to work from almost anywhere but has piled pressure on cyber pros. Three years after Covid, how are best practices evolving and what can we expect going forward? Continue Reading

By

• Rowland Johnson

Top 10 cyber security stories of 2023

The past 12 months have seen the security agenda dominated by the usual round of vulnerabilities, concerns over supply chain security and more besides, but it was the chaotic state of global geopolitics that really made an impact Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Anytime, anywhere access is achievable

Remote working has enabled people to work from almost anywhere but has piled pressure on cyber pros. Three years after Covid, how are best practices evolving and what can we expect going forward? Continue Reading

By

• Tim Holman, 2-sec

The Security Interviews: Talking identity with Microsoft’s Joy Chik

Microsoft’s president of identity and network access, Joy Chik, joins Computer Weekly to discuss the evolving threat landscape in identity security, using innovations in artificial intelligence to stay ahead, and advocating for the coming passwordless future Continue Reading

By

• Alex Scroxton, Security Editor

NCSC CEO Lindy Cameron to step down in 2024

NCSC chief exec Lindy Cameron, who helped lead and elevate the national dialogue on cyber security through major events such as Covid-19, SolarWinds Sunburst and Colonial Pipeline, is to step down in the New Year Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft’s Christmas present for cyber teams: no zero-days

Barely 30 vulnerabilities, and no zero-days, have been fixed in the final Patch Tuesday drop of 2023 Continue Reading

By

• Alex Scroxton, Security Editor

Critical UK infrastructure a ‘hostage of fortune’ to ransomware

A lack of ransomware planning and preparedness at the highest levels of government is leaving UK operators or critical national infrastructure dangerously exposed, according to a Joint Committee report Continue Reading

By

• Alex Scroxton, Security Editor

MoD fined after breach of Afghan staffers’ data put lives at risk

The MoD has been fined £350,000 by the ICO after an email blunder exposed data on Afghan nationals who had worked with British forces and were at risk of Taliban reprisals Continue Reading

By

• Alex Scroxton, Security Editor

Outdated data protection practice key factor in PSNI data breach

The August 2023 data breach at the Police Service of Northern Ireland arose chiefly from an outdated approach to data protection and compliance at the force, according to an independent review Continue Reading

By

• Alex Scroxton, Security Editor

Fancy Bear targets Nato entities via critical Outlook flaw

A vulnerability patched in March has likely been exploited by the Russian state actor Fancy Bear, for over two years, according to the latest intelligence Continue Reading

By

• Alex Scroxton, Security Editor

UK names Russian FSB agents behind political hacking campaign

Russian hacking group, Star Blizzard, was part of a Russian intelligence operation aimed at interfering with UK politics and the democratic process, says government. Continue Reading

By

• Bill Goodwin, Computer Weekly

2023 may have seen highest ransomware ‘body count’ yet

Ransomware, or cyber extortion as it is increasingly being termed, remained the most prominent security threat in 2023 – and thanks to large-scale supply chain attacks, the past 12 months may have seen the most victims ever Continue Reading

By

• Alex Scroxton, Security Editor

Considerations for the security of evolving workspaces

Remote working has enabled people to work from almost anywhere but has piled pressure on cyber pros. Three years after Covid, how are best practices evolving and what can we expect going forward? Continue Reading

By

• Simon Backwell

Government launches UK-wide Cyber Explorers Cup

Schoolkids across the UK are being called on to team up and defeat Herbert the Hacker in a new government-backed competition Continue Reading

By

• Alex Scroxton, Security Editor

How to recover systems in the event of a cyber attack

Recovering compromised systems after a cyber attack isn’t easy, but understanding industry best practice offers a template for the key processes to follow Continue Reading

By

• Nicholas Fearn

Operator of Sellafield nuclear facility denies hacking claims

The operator of the Sellafield nuclear site has denied allegations that senior managers covered up a series of cyber security lapses that enabled Chinese and Russian threat actors to compromise its networks Continue Reading

By

• Alex Scroxton, Security Editor