Web application security

Harman seeks to bring private member’s bill over contact tracing

Chair of Human Rights Committee aims to put the proposed Contact Tracing (Data Protection) Bill 2020 before parliament as a private member’s bill if necessary Continue Reading

By

• Alex Scroxton, Security Editor

Venafi buys cloud protection service Jetstack

Jetstack specialises in open source machine identity protection software for Kubernetes and cloud native ecosystems Continue Reading

By

• Alex Scroxton, Security Editor

UK’s contact-tracing app targeted by scammers

Even though it is only operational on the Isle of Wight as a beta test, the UK government’s coronavirus contact-tracing app has already attracted the attention of cyber criminals Continue Reading

By

• Alex Scroxton, Security Editor

Report reveals inadequate cyber security at Schiphol Airport

A report has revealed problems with critical security systems in Amsterdam’s Schiphol Airport Continue Reading

By

• Kim Loohuis

Microsoft fixes 16 critical vulnerabilities on Patch Tuesday

The trend towards mammoth Patch Tuesdays continues as Microsoft fixes 111 vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Draft Covid-19 contact tracing legislation proposes formal oversight

Human Rights Committee chair Harriet Harman has outlined a proposed bill to guarantee the security and privacy of data generated by the UK’s Covid-19 contact tracing app Continue Reading

By

• Alex Scroxton, Security Editor

What are the security priorities for the post-coronavirus world?

The Covid-19 pandemic is forcing massive change across the business world and things may never go back to normal. What does security look like in this new world, and what will buyers be prioritising? Continue Reading

By

• Alex Scroxton, Security Editor

Zoom buys secure messaging service Keybase

Unified comms platform Zoom says the acquisition of Keybase will finally let it bring end-to-end encryption to the table Continue Reading

By

• Alex Scroxton, Security Editor

Contact-tracing app fails to protect privacy and human rights

Reassurances over the security and human rights implications of NHSX’s approach to developing its Covid-19 contact-tracing app are insufficient, says the cross-bench Human Rights Committee Continue Reading

By

• Alex Scroxton, Security Editor

Next round of Zoom updates targets consumer security

Casual consumer users of Zoom will get additional protections in an update to be released over the long weekend Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Security teams are key workers and need support

Cyber criminals are enjoying a boom during the Covid-19 pandemic, and security teams are working overtime as a result. How can security pros manage their increased workload, safeguard their mental wellbeing, and avoid burnout? Continue Reading

By

• Petra Wenham

Contact tracing: The privacy vs protection debate

The Covid-19 pandemic has necessitated extreme measures not seen in peacetime for over 100 years. Contact-tracing apps are being developed as a tool for managing the pandemic, but are they a step too far? Continue Reading

By

• Peter Ray Allison

Homeworking - the new norm - is there any other option...

In the last blog, I touched on the lasting effects of the COVID-19 pandemic; the obvious fallout here is the massive increase in home/remote working, something I’ve been practicing since 1989 – ... Continue Reading

By

• Steve Broadhead, Broadband Testing

SD-WAN; One Way To Partly Consolidate The Complex Puzzle That Is Contemporary IT

I was recently sent an article by my PR mate Hannah from one of their clients, Versa – a company I’ve met up with and they talk a lot of common sense, far more than their er, so-called president… ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Xen Orchestra latest victim of Salt cryptojackers

More victims of cyber criminals exploiting two critical Salt vulnerabilities are coming forward Continue Reading

By

• Alex Scroxton, Security Editor

Blogging platform Ghost hacked through Salt vulnerability

Publishing service’s network was taken over by illicit cryptominers after failing to patch a critical vulnerability Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2020: Compliance and risk are top security concerns

When it comes to security, buyers are prioritising solutions and services that address compliance issues, risk management and data protection, according to the Computer Weekly/TechTarget IT Priorities 2020 study Continue Reading

By

• Alex Scroxton, Security Editor

Why you should think before you Zoom

Feel free to use Zoom during the coronavirus lockdown, but think before you discuss anything confidential Continue Reading

By

• Dai Davis, Percy Crow Davis & Co

Critical SaltStack vulnerability affects thousands of datacentres

Critical vulnerabilities in the Salt remote task and configuration framework enable hackers to take control of cloud servers and must be patched right away Continue Reading

By

• Alex Scroxton, Security Editor

Mobile banking customers at risk from new EventBot trojan

Customers of Barclays, HSBC, Santander and many other banks should be alert to a dangerous new trojan Continue Reading

By

• Alex Scroxton, Security Editor

Under the spotlight, video apps rush to strengthen security

Most popular videoconferencing applications now meet Mozilla’s minimum security standards, with fierce competition and public pressure driving rapid improvement Continue Reading

By

• Alex Scroxton, Security Editor

Almost half of security pros being redeployed during pandemic

Close to half of cyber security professionals say they have been taken off some or all of their security duties to focus attention elsewhere during the Covid-19 coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Black Rose Lucy ransomware now posing as FBI porn warning

A new strain of Russian-developed ransomware impersonates US federal law enforcement to force payment, says Check Point Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches .gif file vulnerability in Teams

Vulnerability could have enabled cyber criminals to use a malicious .gif file to scrape user data and take over Teams accounts Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Can AV go from dodgy scareware to cyber hero?

Alun Baker, CEO of Clario, is on a mission to rehabilitate the image of consumer security products and take the fear out of selling antivirus. We find out how things are changing Continue Reading

By

• Alex Scroxton, Security Editor

iOS zero-day leaves iPhone users dangerously exposed

Researchers identify dangerous vulnerabilities in Apple’s iOS operating system that allow remote code execution on target devices Continue Reading

By

• Alex Scroxton, Security Editor

Zoom to roll out fresh cyber security updates

New features include support for advanced AES 256-bit encryption Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Cyber criminals may be changing tactics

Cyber criminals “may soon shift to heavier exploitation of footholds established through phishing and other scams”, warns Cyber Threat Coalition Continue Reading

By

• Alex Scroxton, Security Editor

NCSC launches coronavirus cyber security campaign

The National Cyber Security Centre has launched a reporting service for scam emails as part of a campaign to help people protect themselves from cyber criminals exploiting the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Zoom and WebEx users targeted by credential stealing attempts

Videoconferencing apps such as Zoom and Cisco’s WebEx are being targeted by cyber criminals trying to steal users’ personal data Continue Reading

By

• Alex Scroxton, Security Editor

Dutch organisations address business email compromise fraud

Public-private partnership in the Netherlands works to break the chains used by fraudsters to carry out BEC attacks Continue Reading

By

• Kim Loohuis

EU warns no compromise on privacy as NHS clashes with tech firms on contact tracing

EU and UK regulators express data privacy concerns days after Silicon Valley giants announce collaboration on contact-tracing apps to prevent the spread of the Covid-19 coronavirus Continue Reading

By

• Joe O’Halloran, Computer Weekly

Coronavirus: Standard Chartered bans employees from Zoom

Standard Chartered is the first bank to have instructed its staff to refrain from using Zoom Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Researcher finds security vulnerability in Slack

Some common assumptions about the security of cloud-based messaging platform Slack may not be entirely accurate, says an Alien Labs researcher Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches 19 critical bugs in another heavy Patch Tuesday

The volume of vulnerabilities being uncovered by Microsoft remains high, with more than 100 fixes pushed out in April’s Patch Tuesday Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Zoom user credentials for sale on dark web

IntSight researchers say they have found a database containing thousands of Zoom usernames and passwords being sold on the dark web Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Warning over surge in Zoom security incidents

Check Point researchers have observed a surge in suspicious Zoom domains as cyber criminals target popular remote working and collaboration tools Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Zoom restricted or banned at multiple organisations

Use of videoconferencing tool has been banned at Google and in parts of the German and US governments Continue Reading

By

• Alex Scroxton, Security Editor

Despite coronavirus, overall cyber crime volumes hold steady

The UK’s NCSC and the US’s CISA see little change in overall volumes of cyber crime in spite of the coronavirus crisis – for the time being Continue Reading

By

• Alex Scroxton, Security Editor

Happy developers write secure code, report claims

DevOps specialist Sonatype claims to have found a direct correlation between satisfied developers and application security hygiene Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Criminals using Zoom installer to spread cryptominer

Videoconferencing application targeted to deliver cryptomining malware to unsuspecting victims Continue Reading

By

• Alex Scroxton, Security Editor

Google data shows high interest in security and remote working

An analysis of the most Googled technology terms during the Covid-19 coronavirus pandemic has highlighted the scale of the cyber security challenge presented by the crisis Continue Reading

By

• Alex Scroxton, Security Editor

JavaScript skimmers: An evolving and dangerous threat

Cyber attacks exploiting Magecart JavaScript skimmers are spiking during the coronavirus pandemic, and like biological viruses, they just keep evolving Continue Reading

By

• Fabian Libeau

Coronavirus: Magecart attacks on online retailers jump 20%

RiskIQ researchers have observed a sharp uptick in Magecart credit card attacks, driven by increased traffic to online retailers during the coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Is Zoom safe and should security teams ban it?

Zoom’s rapid rise to prominence has highlighted a score of security problems with the service. Should CISOs try to steer their organisations away from it, or ban it outright? Continue Reading

By

• Alex Scroxton, Security Editor

Too late to protect online privacy, say Brits

Most UK consumers are concerned about data privacy, but think it’s too late to do much about it, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Houseparty denies hack as credential stuffing attacks spread

Social media service denies its service has been hacked, and is offering a million-dollar bounty to anybody who can prove otherwise Continue Reading

By

• Alex Scroxton, Security Editor

Lorca calls on security scaleups to tackle coronavirus challenge

Lorca innovation programme has launched an open call for its next cohort of cyber security scaleups, with a timely focus on coronavirus challenges Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: What are the latest free cyber security offers?

We round up the latest free offers on cyber security products and services being made available during the Covid-19 coronavirus crisis Continue Reading

By

• Alex Scroxton, Security Editor

Tupperware fixes hacked site, but questions remain over response

Kitchenware brand removes active digital credit card skimmer from its website and insists it takes security seriously despite ignoring repeated attempts to contact it Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Be alert to rogue mobile apps exploiting outbreak

Well-meaning developers are beginning to offer medical apps to monitor coronavirus symptoms and provide information on the pandemic. Opportunists and cyber criminals are not far behind them Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus and privacy – finding the middle ground

Data collection has a role to play in fighting the deadly Covid-19 coronavirus outbreak, but governments need to be accountable for how it is used Continue Reading

By

• Eduardo Ustaran

Tekya auto-clicker malware exploits kids’ Android apps

Google has removed multiple apps for children that were found to contain Tekya auto-clicker malware Continue Reading

By

• Alex Scroxton, Security Editor

The AWS bucket list: Keep your cloud secure

Misconfigured cloud installations risk billions of records being exposed, damaging organisations’ finances and reputations. Paying attention to securing AWS storage buckets is a simple matter Continue Reading

By

• Peter Ray Allison

Coronavirus: Kaspersky, Bitdefender make products free to NHS

Kaspersky and Bitdefender have both made various products and services available free to healthcare customers as the Covid-19 coronavirus pandemic intensifies Continue Reading

By

• Alex Scroxton, Security Editor

Thousands of Netflix, Disney+ streaming accounts being stolen

Proofpoint has urged users of streaming services to be alert to cyber criminals hijacking their accounts Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Sans Institute issues cyber security advice for parents

With schools now shut across the UK, parents will bear more responsibility for keeping children safe online and educating them about online harms Continue Reading

By

• Alex Scroxton, Security Editor

Volume of computer misuse incidents falling, says ONS

Downward trend comes despite an overall increase in fraud, according to new statistics Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: How to implement safe and secure remote working

Find out what CIOs and CISOs need to know to enable their end-users to work remotely and stay secure during the Covid-19 coronavirus crisis, and learn how users can help themselves Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Amid panic, how to find a sound level of security

In our globalised world, high-profile events such as Covid-19 have huge business impacts, some of which may be felt by CISOs. What responsibilities do security professionals have in such circumstances? Continue Reading

By

• Sabba Mirza and James Walsh

Covid-19: NCSC issues secure remote working guidance

With hundreds of thousands likely to be working remotely for some time, the UK’s NCSC has issued best practice guidance to enable security teams to support them Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus-linked hacks likely as Czech hospital comes under attack

The world of cyber security is on high alert to heightened vulnerabilities as the spread of the Covid-19 coronavirus changes daily life across Europe Continue Reading

By

• Alex Scroxton, Security Editor

Cookie-stealing trojans found lurking on Android phones

Kaspersky discovers two new Android malware modifications that could give hackers control of their victims’ social media accounts Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft locks down new vulnerability with EternalBlue echoes

Microsoft has moved to get ahead of a serious remote code execution vulnerability in Microsoft Server Message Block 3.1.1, which was accidentally disclosed then missed in its March Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft fixes 26 critical vulnerabilities in another heavy Patch Tuesday

March’s Patch Tuesday is another big one for Microsoft, addressing 115 vulnerabilities, 26 of them critical Continue Reading

By

• Alex Scroxton, Security Editor

Schoolgirl security experts prepare to do battle

The finals of the CyberFirst Girls contest will take place on 16 March as the culmination of the NCSC’s annual competition to unearth future security talent Continue Reading

By

• Alex Scroxton, Security Editor

VAT software supplier exposed data of millions

Eight million sales records belonging to UK and EU consumers left exposed due to misconfigured server Continue Reading

By

• Alex Scroxton, Security Editor

Singapore among world’s top sources of online threats

Singapore remained a hotspot for originating cyber attacks in 2019, with 11 million attacks launched from servers in the city-state Continue Reading

By

• Aaron Tan, TechTarget

The Security Interviews: Inside the world of bug bounties

You may not make a million as a bug bounty hunter, but you might help remove some of the stigma that persists around cyber security, says HackerOne’s Shlomie Liberow Continue Reading

By

• Alex Scroxton, Security Editor

Fake CDNs obscuring credit card fraudsters

Fake content delivery networks and ngrok servers are being pressed into service to obscure credit card skimming activities Continue Reading

By

• Alex Scroxton, Security Editor

Cloud Snooper firewall bypass may be work of nation state

Cloud Snooper deploys a combination of specialised techniques to sneak past enterprise firewalls, warns Sophos Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Gil Shwed’s 10-year vision for security

Check Point founder Gil Shwed discusses his new Infinity Next concept and how he plans to remodel the world of cyber security in the next 10 years Continue Reading

McAfee buys Light Point to enhance web browser protection

Acquisition of Light Point Security will extend the capabilities of multiple McAfee products Continue Reading

By

• Alex Scroxton, Security Editor

Open security group unveils common OpenDXL language

Open Cybersecurity Alliance announces the availability of OpenDXL Ontology, the first open source language for connecting disparate security tools through a common messaging framework Continue Reading

By

• Alex Scroxton, Security Editor

Labour condemns Google data plans

Shadow digital minister Chi Onwurah challenges the government to stop Google’s plans to move UK user data out of the EU Continue Reading

By

• Alex Scroxton, Security Editor

Malicious apps still getting past Google controls

Check Point researchers have found multiple malware-infected apps in the Google Play store, including a clicker called Haken, which has been downloaded more than 50,000 times Continue Reading

By

• Alex Scroxton, Security Editor

F-Secure’s AI reads mean tweets to fight abuse and trolls

Researchers working on F-Secure’s Project Blackfin have developed a model for clustering tweets to help pinpoint abuse and harassment Continue Reading

By

• Alex Scroxton, Security Editor

Addressing the IoT security challenge

We consider how best to address some of the critical security challenges around the internet of things Continue Reading

By

• Charaka Goonatilake, Panaseer

Cost of cloud misconfigurations set at $5tn

Cloud security outfit DivvyCloud says more than 33 billion records have been exposed in cloud misconfiguration incidents in the past 24 months Continue Reading

By

• Alex Scroxton, Security Editor

Girlguiding hosts interactive cyber security workshop

100 Guides from South West England took part in an NCSC event to learn more about security fundamentals Continue Reading

By

• Alex Scroxton, Security Editor

Ex-soldiers to become ethical hackers

A new programme will give armed forces veterans in Scotland a grounding in cyber security skills, including penetration testing and ethical hacking Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Practical steps to achieve zero trust

In theory, the elimination of trust on the network simplifies IT security, but zero trust also brings new complications and new challenges. How should CISOs go about moving their organisations from traditional network security to a zero-trust architecture? Continue Reading

By

• Petra Wenham

Internet Explorer zero day among 99 Patch Tuesday problems

After an eventful January Patch Tuesday that marked the end of support for Windows 7, the February 2020 update is another whopper, fixing close to 100 vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Mac-based security threats outpacing Windows

Security threats targeting Apple endpoints are growing more quickly than those targeting Windows machines, according to Malwarebytes Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Zero trust is complex, but has rich rewards

In theory, the elimination of trust on the network simplifies IT security, but zero trust also brings new complications and new challenges. How should CISOs go about moving their organisations from traditional network security to a zero-trust architecture? Continue Reading

By

• Bhanu Jagasia

Joaquin Phoenix’s Joker is ‘most dangerous’ movie

Ahead of the 2020 Oscars, Kaspersky researchers say they found more than 300 files masquerading as the Joker movie Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: No trust in zero trust need not be a problem

In theory, the elimination of trust on the network simplifies IT security, but zero trust also brings new complications and new challenges. How should CISOs go about moving their organisations from traditional network security to a zero-trust architecture? Continue Reading

By

• Silvano Sogus

Darktrace signs to McLaren for 2020 F1 season

McLaren Racing has enlisted Darktrace to become its official artificial intelligence cyber security partner Continue Reading

By

• Alex Scroxton, Security Editor

Scammers using fake PayPal emails stole over £1m in the UK in last quarter

Fraudsters tricked Brits into sending over £1m worth of goods to them that they hadn't paid for Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Web app ubiquity gives cyber criminals new opportunities

The popularity and ubiquity of web-based apps such as Office 365 and Salesforce is a temptation too good to miss for cyber criminals Continue Reading

By

• Alex Scroxton, Security Editor

Check Point pledges end to security updates

Check Point’s Gil Shwed expands on a vision for the next 10 years of cyber security, which he calls Infinity Next Continue Reading

By

• Alex Scroxton, Security Editor

Davos: The clock is ticking on climate change but cyber crime and emerging technologies add to risks

Climate change, natural disasters, extreme weather and loss of biodiversity are the greatest risks we face. With cyber conflicts, state-sponsored hacking and internet fragmentation, doing nothing is not an option, says the World Economic Forum Continue Reading

By

• Bill Goodwin, Computer Weekly

NCSC launches study on cyber security diversity

The UK’s National Cyber Security Centre wants to improve the diversity of the cyber security sector Continue Reading

By

• Alex Scroxton, Security Editor

UK cyber security sector worth more than £8bn

The UK’s cyber security industry employs 43,000 full-time workers, and contributed nearly £4bn to the UK economy in 2019, according to DCMS Continue Reading

By

• Alex Scroxton, Security Editor

SANS Institute calls on Manchester security pros

Manchester will play host to a week-long cyber security training event during February Continue Reading

By

• Alex Scroxton, Security Editor

Milan hosts Cisco’s first European security innovation unit

Cisco has cut the ribbon on its first Cyber Security Co-Innovation Centre in Europe, at Milan’s Leonardo da Vinci Science and Technology Museum Continue Reading

By

• Alex Scroxton, Security Editor

Citrix releases IoC scanner for ADC and Gateway vulnerabilities

As patches for its compromised NetScaler ADC and Gateway products begin to roll out, Citrix enlists FireEye Mandiant to develop an indicator of compromise scanner for end-users Continue Reading

By

• Alex Scroxton, Security Editor

Internal error left Microsoft customer service data exposed

Customer service and support records of nearly 250 million Microsoft customers left exposed after database misconfiguration Continue Reading

By

• Alex Scroxton, Security Editor

ICO code sets out digital privacy standards for children

The Information Commissioner’s Office has published its Age Appropriate Design Code, a set of 15 standards that online platforms must meet to protect the privacy of younger users Continue Reading

By

• Alex Scroxton, Security Editor

5G builders test vulnerabilities in Finnish hackathon

University hackathon puts 5G security to the test as new wireless technology’s roll-out nears Continue Reading

By

• Gerard O'Dwyer