Web application security

Low-complexity CVEs a growing concern

Analysis of thousands of CVEs logged with NIST in 2020 reveals some unwelcome developments Continue Reading

By

• Alex Scroxton, Security Editor

Dating app users warned to watch out for scammers

A vast amount of money was lost to romance scammers last year, and with millions of people isolated in lockdown the problem is getting worse, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Windows 10, Server 2019 users must patch serious zero-day

Another dangerous zero-day exploit is among 56 vulnerabilities patched by Microsoft in February’s Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Data breaches are a ticking timebomb for consumers

Damage from data breaches goes far beyond the impact to the target organisation – an obvious fact that is too often overlooked, says F-Secure Continue Reading

By

• Alex Scroxton, Security Editor

NHS reports fewer phishing emails in 2020

The NHSmail email service saw a steady decline in suspected phishing emails during the course of 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Google Chrome update to patch serious zero-day

A serious heap buffer overflow vulnerability means Google Chrome users should patch their browsers as soon as possible Continue Reading

By

• Alex Scroxton, Security Editor

SolarWinds chases multiple leads in breach investigation

Investigators at SolarWinds are exploring multiple theories as to how the company’s systems were compromised Continue Reading

By

• Alex Scroxton, Security Editor

SolarWinds patches two critical CVEs in Orion platform

New vulnerabilities disclosed as SolarWinds reels from December 2020 Solorigate/Sunburst attack – but do not appear to have been exploited yet Continue Reading

By

• Alex Scroxton, Security Editor

Grindr complaint results in €9.6m GDPR fine

Norway’s data protection authority plans to apply a fine totalling 10% of LGBTQ+ dating app Grindr’s revenues over its data sharing practices Continue Reading

By

• Alex Scroxton, Security Editor

Emergency Apple updates patch exploited zero-days

Three vulnerabilities could give attackers full control of their target Apple devices, and must be patched immediately Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Time to rethink stopgap solutions

After a year of unprecedented disruption thanks to Covid-19, it looks like remote working is set to remain with us for now, which means security strategies will change in 2021. What will this change look like, and what tools and services will be selling like hot cakes? Continue Reading

By

• Paul Holland, Information Security Forum

How can healthcare organisations fight increased cyber crime in 2021?

As the Covid-19 pandemic enters what may be its most dangerous phase, we explore how healthcare organisations can ward off cyber threats while preserving their ability to deliver critical care Continue Reading

By

• Nicholas Fearn

Incompetent cyber criminals leak data in opsec failure

Even cyber criminals need to pay attention to their information security posture, as this cautionary tale uncovered by Check Point reveals Continue Reading

By

• Alex Scroxton, Security Editor

Malwarebytes also hit by SolarWinds attackers

The nation state group that attacked SolarWinds in December got inside Malwarebytes by exploiting privileged access to its Microsoft Office 365 tenant, the firm reveals Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: It’s time to secure the collaboration revolution

After a year of unprecedented disruption thanks to Covid-19, it looks like remote working is set to remain with us for now, which means security strategies will change in 2021. What will this change look like, and what tools and services will be selling like hotcakes? Continue Reading

By

• Paddy Francis

Click fraud levels reach new heights in pandemic

Small companies risk losing £10,000 a year, and enterprises as much as £520,000, to cyber criminals as click fraud volumes spike Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Plan for hybrid working to become normal

After a year of unprecedented disruption thanks to Covid-19, it looks like remote working is set to remain with us for now, which means security strategies will change in 2021. What will this change look like, and what tools and services will be selling like hot cakes? Continue Reading

By

• Martin Kuppinger, KuppingerCole

Critical zero-day features in first Patch Tuesday of 2021

Microsoft releases fixes for 84 bugs on the first Patch Tuesday of 2021, including a critical zero-day vulnerability in Microsoft Defender Continue Reading

By

• Alex Scroxton, Security Editor

Palo Alto Networks opens Australia cloud location

The cyber security company’s Australia cloud location will address data localisation requirements amid growing adoption of cloud-based security services Continue Reading

By

• Aaron Tan, TechTarget

Mimecast latest security firm to be compromised

Users of a specific Mimecast certificate used to authenticate services to Microsoft Office 365 may be at risk of compromise in an attack that may relate to the ongoing SolarWinds incident Continue Reading

By

• Alex Scroxton, Security Editor

Early stage UK security startups face funding crisis

Overall cyber security funding since the advent of the pandemic is well up, but investment is dominated by safe, later-stage firms while those raising capital for the first time fall away Continue Reading

By

• Alex Scroxton, Security Editor

New SolarWinds CEO sets out rescue plan

Customers can expect to see more regular and thorough checks on SolarWinds products, alongside greater engagement with the security community Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Cyber effectiveness, efficiency key in 2021

After a year of unprecedented disruption thanks to Covid-19, it looks like remote working is set to remain with us for now, which means security strategies will change in 2021. What will this change look like, and what tools and services will be selling like hot cakes? Continue Reading

By

• Simon Persin, Turnkey Consulting

Security Long Reads: Cyber insiders reveal what’s to come in 2021

In this long read, we gather together the thoughts of cyber security insiders from across the industry to get their take on what will happen in 2021 Continue Reading

By

• Alex Scroxton, Security Editor

Top 10 cyber crime stories of 2020

Here are Computer Weekly’s top 10 cyber crime stories of 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Top 10 cyber security stories of 2020

Here are Computer Weekly’s 10 top cyber security stories of 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Patching: Balancing technical requirements with business considerations

With an increasing reliance on subscription models alongside the regular patching of software, updates have become an essential part of modern business practices. However, care needs to be taken to ensure the optimum patching process is implemented Continue Reading

By

• Peter Ray Allison

My Question Answered: Neteventing (not not eventing) In Cyberspace...

My fine friends at Netevents have continued to battle the global lockdown elements (and we now know in England that the words "lockdown" and "tier" mean the same thing - who would have guessed?) ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Why Security As A Service Makes Common Sense...

Let us go back in time to 2019 – a time when we could actually attend IT events in a physical way. There I am, on the top level of a stand, having a coffee and scanning the hall, seeing “me too” ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Dodgy browser extensions put social media users at risk

More than three million users of third-party browser extensions for Instagram, Facebook, Vimeo and others have been infected with malware, according to Avast Continue Reading

By

• Alex Scroxton, Security Editor

FireEye and partners release SolarWinds kill-switch

A so-called kill-switch for the dangerous SolarWinds Sunburst attack should allay some user fears, but is not a full fix for the issue Continue Reading

By

• Alex Scroxton, Security Editor

How security will be different after Covid-19

In this week’s Computer Weekly, the world of cyber security will probably never return to its pre-pandemic state – we look ahead. The combination of remote working and streaming video is putting extra strain on networks. And we look at how digital transformation is changing the way contact centres are run. Read the issue now. Continue Reading

French regulators fine Google and Amazon over cookie policies

Google and Amazon rapped over their use of advertising cookies by the French data protection authorities Continue Reading

By

• Alex Scroxton, Security Editor

Amnesia:33 IoT flaws dangerous and patches unlikely, say experts

The disclosure of multiple flaws by Forescout has raised big questions for the developers of connected products, and for their users Continue Reading

By

• Alex Scroxton, Security Editor

Patch Tuesday: Microsoft presents just 58 CVEs for Christmas

The final Patch Tuesday of 2020 contains 58 fixes, a minnow compared to some recent drops, but many are still of high importance Continue Reading

By

• Alex Scroxton, Security Editor

Russian state actors exploiting VMware bug to hijack data, users warned

Russian APT groups are actively exploiting a vulnerability in VMware products to access protected data, according to latest warnings Continue Reading

By

• Alex Scroxton, Security Editor

Grindr and others patch critical Android bug

Fixes for CVE-2020-8913 deployed as app developers shore up their defences against a disclosed Google Play vulnerability Continue Reading

By

• Alex Scroxton, Security Editor

Avast and Borsetta to support Intel’s AI security project

Security firm Avast and AI security specialist Borsetta have signed up to support an Intel-led artificial intelligence security research project Continue Reading

By

• Alex Scroxton, Security Editor

Cyber Aware campaign to help safeguard Christmas shoppers

New government campaign sets out to raise awareness of online shopping fraud in the run-up to Christmas Continue Reading

By

• Alex Scroxton, Security Editor

Lax Android app developers putting millions of users at risk

Eight months after Google patched a critical vulnerability, developers have failed to update their apps, putting millions of users of apps such as dating services Bumble and Grindr at risk Continue Reading

By

• Alex Scroxton, Security Editor

DHL, Amazon and FedEx are most phished delivery services

DHL has emerged as the most imitated delivery brand in Europe, accounting for 77% of the total volume of phishing emails received in November 2020 Continue Reading

By

• Alex Scroxton, Security Editor

This Christmas, Covid-19 heightens retail security risks for everyone

Do you think it’s only retailers and consumers who need to consider cyber security when shopping online during the holidays? You’re dead wrong. This year, the Covid-19 pandemic and the shift to remote working has thrown a spanner in the works Continue Reading

By

• Alex Scroxton, Security Editor

Nominet introduces new resources for cyber scam victims

Domain name registrar is working with law enforcement to provide new information, guidance and resources for potential victims of online scams Continue Reading

By

• Alex Scroxton, Security Editor

NCSC issues retail security alert ahead of Black Friday sales

National Cyber Security Centre issues refreshed guidance as cyber criminals turn their eyes to the holiday shopping season Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC: Expert advice on zero-trust security

Zero trust is a security model that eliminates the traditional perimeter and assumes that no user or device can be trusted until proven otherwise. In this handbook, Computer Weekly looks at how enterprises can take a zero-trust approach to securing their network, devices and workforce. Continue Reading

Human error blamed in Welsh Covid-19 patient data leak

Public Health Wales accepts recommendations of independent probe into data breach that saw PII on 18,105 coronavirus patients leaked Continue Reading

By

• Alex Scroxton, Security Editor

DDoS mitigation strategies needed to maintain availability during pandemic

The growing prevalence of DDoS attacks combined with the increased reliance on internet connectivity during the pandemic means enterprises can no longer afford to ignore the threat of DDoS attacks. Computer Weekly explores organisations’ perceptions of the risks and best practice for mitigation Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Microsoft drops fix for serious zero-day among 112 Patch Tuesday updates

November’s Patch Tuesday contains fixes for 112 bugs, including a potentially serious zero-day exploit that malicious actors are already taking advantage of Continue Reading

By

• Alex Scroxton, Security Editor

Zoom rapped over historic security practices

The US Federal Trade Commission rules that Zoom’s practices undermined the security of its users Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2020: After Covid-19, security goes back to basics

This year’s transition to remote working highlighted big gaps in the fundamentals of security, as updated TechTarget/Computer Weekly data reveals Continue Reading

By

• Alex Scroxton, Security Editor

EU moves closer to encryption ban after Austria, France attacks

Draft resolution document setting up an EU-wide ban on end-to-end encryption is set to be waved through this week Continue Reading

By

• Alex Scroxton, Security Editor

ICO sued over ‘failure’ to address ad industry practices

Privacy campaigner the Open Rights Group claims the advertising technology industry is systematically breaching the GDPR, and the ICO is doing nothing about it Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft to support next generation of security startups

Tech giant lends its support to the NCSC Cyber Accelerator scheme, which is seeking its seventh cohort of startups Continue Reading

By

• Alex Scroxton, Security Editor

Trump supporters targeted by cryptocurrency scammers

The successful breach of Donald Trump’s official website shows up lax security on his campaign team and is yet another timely warning that nobody is immune to cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Barracuda eyes Indochina markets

Barracuda is looking to expand its local presence and headcount in fast-growing emerging markets of Vietnam, Cambodia and Laos Continue Reading

By

• Aaron Tan, TechTarget

Protecting remote workers an opportunity to do security better

Securing the fully remote workforce has been a challenge for IT teams, but it presents an opportunity to commit to a higher standard of cyber security, according to a Cisco report Continue Reading

By

• Alex Scroxton, Security Editor

NSA’s top CVE list a timely reminder to patch

Many of the CVEs detailed on the NSA’s top 25 chart are golden oldies Continue Reading

By

• Alex Scroxton, Security Editor

Trump and Biden campaign apps easy targets for cyber criminals

You don’t need a stellar IQ to exploit the dangerous StrandHogg Android vulnerability, and users of both Donald Trump’s and Joe Biden’s mobile apps are at risk of falling victim to it Continue Reading

By

• Alex Scroxton, Security Editor

Customer loyalty accounts in danger from cyber criminals

Billions of credential stuffing attacks are harvesting valuable customer data for the dark web economy Continue Reading

By

• Alex Scroxton, Security Editor

Police given access to self-isolation data

NHS Test and Trace self-isolation data will be made available to police after new guidance changes data-sharing rules Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Microsoft fixes 87 bugs in October 2020 Patch Tuesday

Smaller October Patch Tuesday update includes fixes for critical bugs in Windows 10 and Windows Server 2019 Continue Reading

By

• Alex Scroxton, Security Editor

Suppliers neglecting virtual appliance security, putting users at risk

Software suppliers are often distributing their products on virtual appliances that contain known vulnerabilities or are running outdated or unsupported operating systems, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Five Eyes spy group again demands access to private messages

Spooks are once again calling for the tech industry to break end-to-end encryption in messaging platforms Continue Reading

By

• Alex Scroxton, Security Editor

Cyber security skills ad branded ‘crass’ by minister

Security skills campaign advert depicting a ballet dancer comes in for criticism as the arts sector struggles in the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Magecart strikes website of school payments service Wisepay

Magecart credit card skimmer harvested financial data of users of Wisepay’s platform over a two-day period Continue Reading

By

• Alex Scroxton, Security Editor

NCSC relaunches SME security guide with home working focus

The NCSC is issuing an updated version of its guide to security for SMEs, reflecting the long-lasting changes to the world of work seen in 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Fake news tops list of online concerns worldwide

Receiving false information is a greater worry than other online risks such as cyber bullying and fraud, says the Lloyd’s Register Foundation Continue Reading

By

• Alex Scroxton, Security Editor

Picking Your Way Through The SASE Minefield

After the best part of two decades of gradual change in the world of the networking infrastructure, WiFi and mobile notwithstanding, the past few years have seen more upheaval than at any time ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Find and fix your Adobe Flash dependencies, says NCSC

As Adobe’s Flash Player approaches end-of-life, the National Cyber Security Centre is urging organisations to fix their Flash dependencies Continue Reading

By

• Alex Scroxton, Security Editor

GitHub makes code vulnerability scanning feature public

Code-scanning service is now out of beta and generally available, helping teams to bake security into their code at the development stage Continue Reading

By

• Alex Scroxton, Security Editor

NCSC expands schools programme to north-east England and Northern Ireland

Following an initial roll-out in Gloucestershire and Wales, the NCSC’s CyberFirst Schools programme is being extended to north-east England and Northern Ireland Continue Reading

By

• Alex Scroxton, Security Editor

NatWest offers online banking customers free security services

Bank responds to a surge in cyber crime targeting users of online banking services Continue Reading

By

• Alex Scroxton, Security Editor

Remote working world reveals cloud/SaaS security concerns

Research reveals pivotal moment when the cloud is playing a more important role than ever to support mass remote working, with CISO concerns over cloud security remaining stubbornly high Continue Reading

By

• Joe O’Halloran, Computer Weekly

TikTok ban stayed after last-minute court case

TikTok’s lawyers have staved off an imminent ban for the time being, after successfully arguing that it infringed rights guaranteed under the Constitution of the United States Continue Reading

By

• Alex Scroxton, Security Editor

Security now main driving force behind digital transformation

Organisations are urgently remodelling their core technology stack in the light of the Covid-19 pandemic, and this is pushing security to the top of the agenda Continue Reading

By

• Alex Scroxton, Security Editor

Covid-19 has changed how we think about cyber security forever

Six months into the global pandemic, the true impact on the future of cyber security is beginning to look clearer, says Microsoft’s Ann Johnson Continue Reading

By

• Ann Johnson, Microsoft

Third-party code bug left Instagram users at risk of account takeover

A critical vulnerability in Instagram’s image processing could have allowed attackers to take over not just their victim’s account, but their entire device Continue Reading

By

• Alex Scroxton, Security Editor

Government blasted over ‘reckless’ contact-tracing security

The Open Rights Group and Big Brother Watch accuse the government of endangering public health with a reckless attitude to contact-tracing data security Continue Reading

By

• Alex Scroxton, Security Editor

Race to patch as Microsoft confirms Zerologon attacks in the wild

Don’t be the organisation that made the headlines because it failed to patch. Microsoft says it is seeing cyber attacks ramping up around the Zerologon CVE-2020-1472 bug Continue Reading

By

• Alex Scroxton, Security Editor

Video gamers barraged with cyber attacks

From credential stuffing to SQL injection and DDoS, video game producers and players are seeing massive volumes of cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Scam mobile apps spreading via rogue TikTok accounts

Malicious TikTok accounts are promoting a number of adware scam mobile apps Continue Reading

By

• Alex Scroxton, Security Editor

Big questions to be answered over TikTok and WeChat reprieve

TikTok and WeChat seem to have received a stay of execution, but big questions and contradictions remain Continue Reading

By

• Alex Scroxton, Security Editor

SASE Is Not Just A Sassy Fashion – It’s Here To Stay So Convert That Attic Now

Earlier in the year, in this space I talked about SASE – Secure Access Service Edge – pronounced “sassy” as being one of the most relevant new Gartner definitions to explore and understand. And I ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Congressman offered Julian Assange a ‘win-win’ deal that would help President Trump

Details have emerged of US congressman Dana Rohrabacher’s offer of a pardon to WikiLeaks founder Julian Assange in a ‘win-win deal that would benefit US President Donald Trump Continue Reading

By

• Bill Goodwin, Computer Weekly

US government deplatforms TikTok and WeChat

The Commerce Department of the US government has banned new downloads of TikTok and WeChat in the US, and announced new prohibitions on doing business with them Continue Reading

By

• Alex Scroxton, Security Editor

Rampant Kitten spent six years hacking Iranian dissidents

Details emerge of an ongoing campaign by Tehran-backed threat actors targeting dissidents and activists Continue Reading

By

• Alex Scroxton, Security Editor

Saudi Arabia sees cyber security boom as coronavirus bites

Saudi Arabian CIOs have been forced to increase their security posture as the Covid-19 pandemic transforms working methods Continue Reading

By

• Alicia Buller

Assange revelations among most important in US history, says Daniel Ellsberg

Daniel Ellsberg, who leaked highly classified documents that changed the course of the Vietnam War in the 1970s, says WikiLeaks exposed a serious pattern of US war crimes Continue Reading

By

• Bill Goodwin, Computer Weekly

Retailers urged to get to grips with Magento as attacks spike

A huge spike in online retailers being hacked with Magecart credit card skimmers is being blamed on unsupported versions of Adobe Magento Continue Reading

By

• Alex Scroxton, Security Editor

Lorca security scaleups to get Splunk data expertise

Lorca inducts Splunk onto its co-marketing programme, giving security scaleups access to new data expertise Continue Reading

By

• Alex Scroxton, Security Editor

Risky development practice leaves company access keys exposed

Database stores, cloud storage and myriad other services are being put at risk by the accidental exposure of company access keys during development Continue Reading

By

• Alex Scroxton, Security Editor

TikTok-Oracle partnership moves forward for consideration

Joint venture proposal could create thousands of jobs and secure TikTok’s future outside China Continue Reading

By

• Alex Scroxton, Security Editor

Data of every Welsh Covid-19 patient leaked online

Data on all 18,105 people in Wales who have received positive tests for the coronavirus was uploaded to a public-facing web server in error Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft drops out of TikTok talks, paves way for Oracle partnership

Microsoft confirms it is dropping out of the running to acquire the US operations of TikTok, leaving the way clear for an imminent partnership deal with Oracle Continue Reading

By

• Alex Scroxton, Security Editor

Travel industry websites are laughably insecure, claims Which?

The travel industry is failing to take the data security of its customers seriously, according to a Which? investigation Continue Reading

By

• Alex Scroxton, Security Editor

Lorca security scaleups hit funding milestone

£153m of investment has been raised by Lorca cohort companies in just two years, almost four times the original target Continue Reading

By

• Alex Scroxton, Security Editor

Government launches £500k healthcare security plan

A £500,000 funding pot from the government aims to help support small and mid-sized healthcare firms during the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Assange prosecution would put journalists around the world at risk

Trevor Timm, co-founder of the Freedom of the Press Foundation, tells a court that if the US prosecutes WikiLeaks founder Julian Assange, every reporter who receives a secret document will be criminalised Continue Reading

By

• Bill Goodwin, Computer Weekly

September’s Patch Tuesday heavy on RCE vulnerabilities

Microsoft’s September update contains patches for 129 common vulnerabilities and exposures, including a high number of remote code execution issues Continue Reading

By

• Alex Scroxton, Security Editor

Why predictive threat intelligence is key

Threat intelligence startup Cyfirma is using virtual agents to gather intelligence on potential cyber attacks that are being coordinated in underground forums before they occur Continue Reading

By

• Aaron Tan, TechTarget