Web application security

Top 10 cyber security stories of 2019

Here are Computer Weekly’s top 10 cyber security stories of 2019 Continue Reading

By

• Alex Scroxton, Security Editor

Finnish government supports local authorities in cyber security initiative

The Finnish government has committed resources to a cyber security project aimed at local authorities Continue Reading

By

• Gerard O'Dwyer

Alarm bells ring, the IoT is listening

With Christmas bearing down on us, a series of vulnerability disclosures has drawn attention to the parlous state of IoT security, and serves as a timely warning to people planning to buy smart devices as gifts Continue Reading

By

• Alex Scroxton, Security Editor

Jailed hacker ordered to pay back £270k

An Essex man jailed in April over malware offences dating back years has been ordered to pay back the profits of his crime spree, and sell valuable assets Continue Reading

By

• Alex Scroxton, Security Editor

Great Cannon DDoS operation fires on Hong Kong protesters

AT&T’s security unit has evidence that China is pressing its Great Cannon DDoS tool into service once again, specifically to target pro-democracy protests in Hong Kong Continue Reading

By

• Alex Scroxton, Security Editor

Two Russians indicted over Dridex and Zeus malware

The US Department of Justice has indicted two Russian citizens over their alleged role in the distribution of the virulent Bugat, or Dridex, and Zeus banking trojans Continue Reading

By

• Alex Scroxton, Security Editor

Black Hat Europe: Mental health websites are leaking user data

At Black Hat Europe in London, researchers reveal the extent to which confidential data is being leaked to third parties by online mental health websites Continue Reading

By

• Alex Scroxton, Security Editor

Aviatrix VPN vulnerability left user endpoints wide open

Immersive Labs has disclosed a serious vulnerability in VPN supplier Aviatrix’s enterprise client that could have granted hackers elevated user privileges across enterprise targets Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: In-depth protection is a matter of basic hygiene

The belief that effective perimeter security is the best way to protect data is a fallacy that is being repeatedly exposed. We must recognise the need for a data-centric security model to protect data from both internal and external threats, but what does this mean for security professionals? Continue Reading

By

• Petra Wenham

Top Android apps at risk from StrandHogg vulnerability

Researchers at Promon say all of the 500 most-downloaded Android apps are at risk from a newly discovered vulnerability Continue Reading

By

• Alex Scroxton, Security Editor

Hack Friday: This Christmas, fight back against cyber criminals

It’s nearly Christmas, and cyber attacks and fraud attempts in the retail sector are ramping up. Is it time to panic? And is there anything we can do beyond hammering home the message around basic cyber security hygiene? Continue Reading

By

• Alex Scroxton, Security Editor

Uber app exploit posed safety risk to passengers

A flaw in Uber’s system meant thousands of trips in London were taken with unauthorised drivers at the wheel Continue Reading

By

• Alex Scroxton, Security Editor

Tim Berners-Lee launches nine principles for the web

Inventor of the worldwide web sets out Contract for the Web to protect its freedom, data privacy and access for all Continue Reading

By

• Cliff Saran, Managing Editor

Macy’s Magecart breach presages Christmas fraud spike

US retailer Macy’s admits some customer data was accessed by unknown actors during a week-long Magecart attack Continue Reading

By

• Alex Scroxton, Security Editor

Notorious hackers claim responsibility for Labour DDoS

Hackers claiming to represent Lizard Squad say they were behind a distributed denial of service attack on the UK’s Labour Party Continue Reading

By

• Alex Scroxton, Security Editor

Home Office Brexit app contains multiple security flaws

The Home Office’s Brexit app may be putting EU citizens’ personal data at risk Continue Reading

By

• Alex Scroxton, Security Editor

Cyber criminals tool up for Christmas fraud season

Organised criminals are trying to cash in on the festive retail boom with both brand new and tried-and-tested techniques Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC: Expert advice on container security

For all the promises of containers, changes in architecture and practices associated with the technology bring new challenges and opportunities. In this handbook, Computer Weekly looks at the security challenges associated with container technology. Continue Reading

Attack on Labour shows need for DDoS defence but should alarm few

After being hit by two DDoS attacks in the space of 24 hours, many commentators are convinced the UK’s Labour Party is the victim of foreign interference in the General Election campaign. It probably isn’t Continue Reading

By

• Alex Scroxton, Security Editor

Nordic SMEs lack the money needed for cyber security

Businesses and governments in Denmark and Norway are working together to address a cyber security shortfall for SMEs in each country Continue Reading

By

• Gerard O'Dwyer

‘Robust’ security foils cyber attack on Labour Party

Labour claims to have been the victim of a cyber attack, but says it is confident no data leaked Continue Reading

By

• Alex Scroxton, Security Editor

Shared responsibility model key to solving 5G security problem

Both buyers and sellers need to cooperate to solve the thorny issues around 5G security Continue Reading

By

• Alex Scroxton, Security Editor

Saudis recruited Twitter employees to spy on critics

Court documents reveal how the Saudi Arabian government targeted Twitter employees as part of a coordinated effort to gather information on known dissidents Continue Reading

By

• Alex Scroxton, Security Editor

Global security workforce must more than double to meet demand

There are about 2.8 million cyber security professionals working today, and the world needs four million more Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware authors seeking new ways to avoid being spotted

Sector analysis from Sophos has revealed some insight into how malware authors are adapting to thwart cyber security controls Continue Reading

By

• Alex Scroxton, Security Editor

EU patches 20-year-old open source vulnerability

Ethical hackers taking part in a bug bounty programme on behalf of the European Union have uncovered a 20-year-old vulnerability Continue Reading

By

• Alex Scroxton, Security Editor

Banks let customers down with mixed approaches to security

Treasury Committee report recommends new measures to tackle financial fraud Continue Reading

By

• Alex Scroxton, Security Editor

Take responsibility for cyber security basics, urges NCSC CEO

At the launch of its third annual review, NCSC head Ciaran Martin appealed for individuals and businesses to address the fundamentals of cyber security hygiene to help lighten the load Continue Reading

By

• Alex Scroxton, Security Editor

NordVPN blames datacentre provider for server breach

VPN provider insists no user data was compromised in a March 2018 server breach, and says its datacentre provider failed to inform it of the issue Continue Reading

By

• Alex Scroxton, Security Editor

Attacker hit VPN firm Avast through its VPN

Avast has published details of how attackers attempted to gain access to its network over a five month period Continue Reading

By

• Alex Scroxton, Security Editor

Over-30s tend to do better at cyber security than younger colleagues

Attitudes to workplace cyber security differ by age group, but not in the way one might imagine, according to a new study by NTT Security Continue Reading

By

• Alex Scroxton, Security Editor

Sodinokibi emerging as a diverse, multi-vector threat to businesses

McAfee shares insight into the Sodinokibi ransomware campaign gleaned from its network of honeypots Continue Reading

By

• Alex Scroxton, Security Editor

IBM, McAfee among founders of open source security alliance

A group of cyber security suppliers have come together to form the Open Cybersecurity Alliance Continue Reading

By

• Alex Scroxton, Security Editor

UK and US call on Facebook to walk back encryption plans

The US, Australian and UK governments have asked Facebook to ditch plans to deploy end-to-end encryption across Facebook Messenger, Instagram and WhatsApp Continue Reading

By

• Alex Scroxton, Security Editor

LogRhythm touts unlimited data plan for SIEM systems

SIEM supplier introduces three-year, term-based pricing plan that lets enterprises ingest as much data as they want without breaking the bank Continue Reading

By

• Aaron Tan, TechTarget

Attackers breached supplier systems to steal Airbus secrets

Airbus has been the subject of at least four major cyber attacks in the past 12 months, with contractors and suppliers targeted through their VPNs Continue Reading

By

• Alex Scroxton, Security Editor

Overinvestment breeds overconfidence among security pros

CISOs have made an abundance of security investments in multiple suppliers, but this might not be the right approach Continue Reading

By

• Alex Scroxton, Security Editor

Google pushes back on scale of YouTube phishing threat

Millions of YouTubers may be at risk after some high-profile influencers reported their accounts were compromised in an apparent phishing attack, but the platform’s owner, Google, is not so sure Continue Reading

By

• Alex Scroxton, Security Editor

UN agency Unicef praised for response to accidental data leak

The UN’s children’s agency has disclosed an inadvertent leak of personal data belonging to users of its online learning platform Agora Continue Reading

By

• Alex Scroxton, Security Editor

Singapore’s SecureAge eyes US market

The Singapore-based supplier of encryption and anti-malware tools has set up a new office in Greater Washington, DC as the next logical step in its global expansion plan Continue Reading

By

• Aaron Tan, TechTarget

How to mitigate IoT security risks to tap business benefits

Security concerns are preventing many businesses from adopting IoT-based technologies, but with a bit of planning, the business benefits can be realised by mitigating the risk Continue Reading

By

• Warwick Ashford, Senior analyst

VMware’s latest acquisitions point to emerging platform war

VMware’s buyout of Carbon Black and Pivotal is a sign of an emerging platform war following the IBM-Red Hat deal Continue Reading

By

• Aaron Tan, TechTarget

Kaspersky eyes enterprise business, opens APAC transparency hub

The security firm wants to engage with enterprises and use its newly launched Malaysian Transparency Centre to burnish its credentials Continue Reading

By

• Edwin Yapp

Top four considerations when securing the multi-cloud environment

This is a guest post by Stephen Dane, managing director for cyber security at Cisco Asia-Pacific, Japan and Greater China We live in a multi-cloud world. A world where a multitude of offerings from ... Continue Reading

By

• Aaron Tan, TechTarget

Silence APT group eyes APAC banks

Russian-speaking advanced persistent threat group has set its sights on banks in the region, customising its arsenal for targeted attacks Continue Reading

By

• Aaron Tan, TechTarget

Even fintech startups battling to meet cyber security challenges

A study shows that most fintech startups, like most banks, are failing to address vulnerabilities in the web and mobile applications, underlining the scale of the challenge Continue Reading

By

• Warwick Ashford, Senior analyst

How EDR is moving beyond the endpoint

An emerging breed of detection and response offerings is going beyond endpoints to collect and decipher telemetry data from across the enterprise Continue Reading

By

• Aaron Tan, TechTarget

Formjacking dominates web-related data breaches

Formjacking has become one of the most popular data stealing methods, say researchers, who urge commercial websites to review all third-party coding practices without delay Continue Reading

By

• Warwick Ashford, Senior analyst

DCMS funding aims to increase diversity in cyber sector

A funding round has been announced as part of the Cyber Skills Immediate Impact Fund (CSIIF) with aims of encouraging more diverse talent into the UK’s cyber security sector Continue Reading

By

• Clare McDonald, Business Editor

Digital domain identified as major security threat by Norway’s intelligence service

Norway's intelligence services has revealed the extent of the threat posed to the country by cyber attacks Continue Reading

By

• Gerard O'Dwyer

British Airways e-ticketing system could expose passenger details

British Airways has not addressed a potential leak of passenger details despite warnings from security researchers, but says it is aware of the issue and is taking action Continue Reading

By

• Warwick Ashford, Senior analyst

BACnet IoT building automation devices vulnerable to attack

A security researcher has revealed that internet-connected building automating devices using the BACnet communication protocol are vulnerable to cyber attack Continue Reading

By

• Warwick Ashford, Senior analyst

F-Secure warns of F5 Big IP-related security issue

F-Secure has discovered security issues relating to an F5 device that it says could potentially turn hundreds of thousands of load balancers into beachheads for cyber attacks Continue Reading

By

• Warwick Ashford, Senior analyst

NCC Group warns of security risks of leading printers

Researchers uncover more than 35 vulnerabilities in six leading enterprise printers, many of which could allow access to corporate networks, underlining the need to counter security risks of embedded systems Continue Reading

By

• Warwick Ashford, Senior analyst

Financial services top cyber attack target

Financial services are among the most attractive targets for cyber attackers, security researchers reveal, with phishing and credential stuffing among the top threats Continue Reading

By

• Warwick Ashford, Senior analyst

Global malware down but ransomware up, with UK hard hit

Despite a global decrease in the volume of malware in the past year, ransomware is surging once again, and the UK is one of the worst-hit countries, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

CW ASEAN: Trend Watch – Security

Artificial intelligence tools are becoming a vital part of the security arsenal for organizations and cyber criminals alike. In this handbook, Computer Weekly looks at how ASEAN firms are using AI to combat cyber threats and experts discuss the latest smart cyber security tools. Continue Reading

CW ANZ: Trend Watch – Security

With regulations pushing data protection up the business agenda, we look at how Australia’s Notifiable Data Breaches scheme has been received and consider why a survey that found Australian firms are experiencing fewer cyber breach incidents appears to conflict with anecdotal evidence that suggests the opposite. Continue Reading

Securing your mobile estate – best practice for CIOs

The prevalence of mobile devices in every part of daily life is shaping how enterprises make choices about software and network infrastructure, but how do businesses go about securing these vast new endpoint estates? Continue Reading

By

• Christian Annesley

Podcast: The Computer Weekly Downtime Upload – Episode 22

In this week’s episode of the Computer Weekly Downtime Upload podcast, Brian McKenna, Caroline Donnelly and Clare McDonald talk about digital transformation in the NHS, Sky’s efforts to get more women working in tech and how big businesses could be risking extinction by ignoring IT Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

APT attack on telcos highlights need for comprehensive defence

A global cyber attack against multiple telecommunications firms underlines need for comprehensive approach to cyber defence, say researchers and industry commentators Continue Reading

By

• Warwick Ashford, Senior analyst

DevSecOps is key to uniting opposing forces

Unifying DevOps and security teams with the aid of automation will bring harmony and added business benefits, says systems engineer Continue Reading

By

• Warwick Ashford, Senior analyst

Inside F5’s cyber security playbook

F5 Networks' CISO talks up measures that the application delivery and security specialist is employing to fend off cyber attackers that come knocking on its doors Continue Reading

By

• Aaron Tan, TechTarget

CW Europe: Why are Dutch companies slow to take advantage of the IoT?

Many organisations in the Netherlands are missing out on the benefits of the internet of things because they lack awareness of its potential. Also read why construction of Apple's first non-US datacentre has halted in Denmark, and why some scientists have raised questions about the effects of 5G mobile phone radiation on public health. Continue Reading

Beware of security blind spots in encrypted traffic

The growth of encrypted traffic has put the spotlight on intrusion prevention systems that help to surface cyber attacks conducted under the cloak of network encryption Continue Reading

By

• Aaron Tan, TechTarget

Lapse in LinkedIn security certificate update

A lapse in the update of LinkedIn’s security certificate has once again underlined the importance of keeping track to avoid disruptions and phishing attacks, and how even big players are failing to get it right Continue Reading

By

• Warwick Ashford, Senior analyst

Black Hat Asia 2019: Get ready for the cyber arms race

The arms race is now squarely in the cyber realm as defence teams and threat actors arm themselves with AI tools Continue Reading

By

• Ai Lei Tao

Magento e-commerce sites urged to apply security update

Security experts are urging companies using the Magento e-commerce site to apply security updates without delay to avoid a disastrous hacking campaign Continue Reading

By

• Warwick Ashford, Senior analyst

Firms urged to gear up for new malware and tactics as threats proliferate

The volume of malware attacks reached a record level in 2018, with UK and India bucking global trend of increased ransomware attacks, a study shows Continue Reading

By

• Warwick Ashford, Senior analyst

Remainers accidentally DDoS the British government

With eight days until the UK's scheduled exit from the European Union, a prime minister who has lost control, a paralysed political system, and Britain reduced to a laughing stock on the world ... Continue Reading

By

• Alex Scroxton, Security Editor

CyLon announces latest cyber security accelerator cohort

Swiss and Israeli cyber security startups join teams from the UK for CyLon’s ninth London accelerator cohort Continue Reading

By

• Warwick Ashford, Senior analyst

Facebook facing 10 GDPR investigations in Ireland

Ireland’s Data Protection Commission has revealed it has 10 active probes into Facebook, Instagram and WhatsApp, as well as Apple, LinkedIn and Twitter, on its books Continue Reading

By

• Alex Scroxton, Security Editor

What are the CDN options for enterprises?

We look at how content delivery networks can give your organisation’s web presence a literal edge Continue Reading

By

• Rene Millman

Facebook planned to spy on Android phone users, internal emails reveal

Facebook planned to use its Android app to track the location of its customers and to allow advertisers to send political advertising and invites to dating sites to ‘single’ people, confidential documents show Continue Reading

By

• Bill Goodwin, Computer Weekly

Scoop! Symantec Acquisition Makes Sense Of Software Defined Perimeter Security...

OK - so that's probably not the perfect headline to be announced by anyone who whistles through their teeth... Been having some interesting conversations recently around the idea of zero trust ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Telegram bot gets users hooked

Popular social media service provides a rich set of features for cyber criminals, RSA warns Continue Reading

By

• Cliff Saran, Managing Editor

Lauri Love takes legal action against NCA for return of seized computers

Lauri Love, a former engineering student who won a battle with the US Department of Justice against extradition to the US to face hacking charges, is suing the UK's intelligence agency, the NCA, for the return of his seized computers Continue Reading

By

• Bill Goodwin, Computer Weekly

A guide to choosing cloud-based security services

Cloud-based security services can help organisations with a growing cloud footprint to reduce cost and address the manpower crunch in cyber security Continue Reading

By

• Aaron Tan, TechTarget

How traffic scrubbing can guard against DDoS attacks

Although most scrubbing services can help fend off distributed denial of service attacks, a more comprehensive mitigation strategy is required to remain unscathed Continue Reading

By

• Ai Lei Tao

The rise of DevSecOps

The increasing complexity of security threats facing enterprises is leading to DevSecOps approaches, which combine operations and development with security, so that all business units are involved in security operations Continue Reading

By

• Finbarr Toesland

UK firms say £6.6bn annual security testing cost too high

Avord launches platform to reduce the multibillion-pound annual cyber security testing cost that most UK firms say is too high Continue Reading

By

• Warwick Ashford, Senior analyst

Can we live without passwords?

Can you imagine a future in which we can be secure online without having to remember an unwieldly list of passwords? Solutions are emerging that could make passwords redundant, but there will be other security problems to resolve Continue Reading

By

• Bruno Halopeau & Adrien Ogee

'Serious' Twitter flaw allows hackers to post on other people's accounts

A vulnerability in Twitter allows hackers to send tweets, private messages, post images or videos, and turn off security features, says British security researcher Continue Reading

By

• Bryan Glick, Editor in chief

APAC cyber security landscape to be more tumultuous in 2019

Amid growing cyber threats, the Asia-Pacific cyber security landscape will not get any rosier in 2019 unless organisations start shoring up their cyber hygiene Continue Reading

By

• Aaron Tan, TechTarget

Shock Headline: IT Saves $$$$ (again)!

Two and a bit years ago – I should remember, it was on my birthday! – I was presenting a panel debate on the latest Cybersecurity deterrents. With four vendors and two consultants on the panel, it ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Mac malware makes debut in top 10 list

Mac malware appears in the WatchGuard top 10 malware list for first time, and 6.8% of major websites still use an insecure SSL protocol, according to the firm’s latest internet security report Continue Reading

By

• Warwick Ashford, Senior analyst

‘Open-minded’ DVSA cuts cost of MOT testing

Government agency harnesses customised open source platform to ensure data security while cutting costs and plans to extend its MOT testing capability to do the same for drivers’ theory tests Continue Reading

By

• Christian Annesley

Marriott data breach highlights basic failings

A breach of a guest reservation database of the Starwood division of the Marriott International hotel group highlights basic personal data protection failures Continue Reading

By

• Warwick Ashford, Senior analyst

Black Friday On My Mind

Ah – tomorrow – the dreaded Black Friday, yet another unwanted import from Trumpland. But, JASK – already previously subjected here to the blogging treatment – has some security advice to offer as ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Why entropy sources should be added to mobile application vetting

NIST's 'Vetting the Security of Mobile Applications' draft discusses four key areas of general requirements. Learn how further improvements to the vetting process could be made. Continue Reading

By

• Judith Myerson

APAC firms warm up to SD-WAN to solve networking woes

A third of enterprises in the APAC region have already deployed SD-WAN at most of their sites, while 55% are in the process of doing so, a study shows Continue Reading

By

• Aaron Tan, TechTarget

How testing perspectives helps find application security flaws

Application security testing requires users to test from all the right perspectives. Discover testing techniques that help find application security flaws with expert Kevin Beaver. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Think Tank: Application layer attack mitigation needs to start with risk analysis

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Maxine Holt, Omdia

Security Think Tank: Focus on security before app deployment

What should organisations be doing to address application layer attacks and reduce the likelihood of a breach through this type of attack? Continue Reading

By

• Richard Absalom, Information Security Forum

Optus to acquire Hivint in cyber security deal

The deal is expected to bolster the telco’s security pedigree in a market that is grappling with more data breaches and cyber incidents Continue Reading

By

• Aaron Tan, TechTarget

How is Android Accessibility Service affected by a banking Trojan?

ThreatFabric researchers uncovered MysteryBot, Android malware that uses overlay attacks to avoid detection. Learn how this malware affects Google's Android Accessibility Service. Continue Reading

By

• Nick Lewis

Everyone, everywhere is responsible for IIoT cyber security

Cyber security in the industrial internet of things is not limited to a single company, industry or region – it is an international threat to public safety, and can only be addressed through collaboration that extends beyond borders and competitive interests Continue Reading

By

• Andrew Kling, The Open Group

Two-thirds of emails not clean, says research

Two-thirds of emails don't make it to the inbox because security systems consider them unsafe, according to research Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

British Airways data breach: Security researchers name suspects and query attack timeline

Security researchers claim to have pinpointed the cause and perpetrators of the British Airways data breach, and also claim the attackers may have had access to its customer data for far longer than previously thought Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Public cloud use surges among DDoS attackers, research shows

According to data accrued by DDoS mitigation firm, Link11, the number of attackers that rely on public cloud services soared during the 12 months to June 2018 Continue Reading

By

• Caroline Donnelly, Senior Editor, UK