News

IT governance

• August 16, 2023 16 Aug'23

  NCSC expands Cyber Incident Response service more widely

  The NCSC has added a level to its CIR programme to enable more cyber attack victims to take advantage of the service, which offers access to assured incident response specialists

• August 16, 2023 16 Aug'23

  ITAM influence on cyber risk becoming a factor in credit ratings

  Credit agency S&P Global Ratings warns that organisations that pay inadequate attention to IT asset management as a factor in their cyber risk management processes may find their creditworthiness takes a dive

• August 15, 2023 15 Aug'23

  Biometrics and surveillance camera commissioner resigns

  Dual biometrics and surveillance camera watchdog will step down at the end of October 2023, noting that while he agreed to stay on until the Data Protection and Digital Information Bill received royal assent, continuing delays to its passage means ...

• August 15, 2023 15 Aug'23

  Norfolk and Suffolk police hit by FoI-linked data breach

  Latest UK police data breach relates to crime suspects, victims and witnesses across East Anglia, and comes just days after a similar incident at the Northern Irish service

• August 14, 2023 14 Aug'23

  US Cyber Board to probe cloud security after latest Exchange hack

  CSRB review of cloud security comes in the wake of a major Chinese cyber attack on US government bodies orchestrated through Microsoft’s cloud services

• August 11, 2023 11 Aug'23

  Google Help workers claim layoffs are retaliation for unionising

  More than 100 Google Help workers claim that Google and Accenture’s decision to layoff two-thirds of the team was done in retaliation for their attempts to form a union, while companies claim decision was made well in advance of unionisation attempt

• August 11, 2023 11 Aug'23

  Biden administration bans investment in Chinese high tech

  Executive Order prohibits investment firms from supporting Chinese firms specialising in AI, quantum and advanced semiconductors

• August 10, 2023 10 Aug'23

  Google speeds up security update frequency for Chrome

  Changes to Google’s security update policy are supposed to help close the gap in which cyber criminals can exploit n-day vulnerabilities

• August 10, 2023 10 Aug'23

  PSNI investigating second breach after laptop stolen

  Just hours after accidentally disclosing the personal details of 10,000 personnel, the Police Service of Northern Ireland has notified a second data breach after a police issue laptop and documents were stolen from a parked car

• August 09, 2023 09 Aug'23

  AI interview: Krystal Kauffman, lead organiser, Turkopticon

  Remote Mechanical Turk workers are responsible for training artificial intelligence algorithms and completing other data-related business processes - we hear about the workplace issues they face

• August 09, 2023 09 Aug'23

  Microsoft addresses Office vulnerability attacked by Russian spooks in latest update

  Microsoft has issued fixes for over 70 vulnerabilities in its August Patch Tuesday drop, including remedies for CVE-2023-36884, which was disclosed without a fix in July and has been the subject of Kremlin-backed cyber attacks

• August 09, 2023 09 Aug'23

  Northern Irish police expose staff data in botched FoI response

  Human error is being blamed for the leak of personally identifiable information on all serving officers and civilian staff at the Police Service of Northern Ireland

• August 08, 2023 08 Aug'23

  UK voter data hacked in cyber attack on election watchdog

  An unknown threat actor who attacked the UK’s Electoral Commission had access to data on millions of UK voters for over a year, the watchdog has revealed

• August 08, 2023 08 Aug'23

  Workplace monitoring needs worker consent, says select committee

  Employers looking to monitor their employees through connected devices should only to so with the consent of those affected due to negative impacts such surveillance can have on work intensification and mental health

• August 08, 2023 08 Aug'23

  Many UK organisations considering ChatGPT bans on employee devices

  More than 60% of organisations in the UK have either banned, or are considering banning, the use of generative AI tools on employee- or business-owned devices

• August 07, 2023 07 Aug'23

  NHS trust suspends two governors as whistleblower email dispute continues

  Governors at an NHS trust have been suspended after asking questions about emails used to bring a General Medical Council investigation against a whistleblower

• August 07, 2023 07 Aug'23

  Microsoft fixes Azure flaw that was subject of researcher criticism

  Microsoft has confirmed a potentially-dangerous flaw in the Azure platform has now been fully fixed, and moved to reassure customers that despite criticism it is committed to responsible disclosure and timely fixes

• August 07, 2023 07 Aug'23

  Rise in fraudsters spoofing the websites of leading UK banks

  Despite safeguards to protect customers from scams, UK retail banks are still seeing high volumes of fake phishing websites exploiting their brands, and the problem seems to be increasing in scope and scale

• August 04, 2023 04 Aug'23

  Log4Shell, ProxyShell still among most widely exploited flaws

  Statistics released by the collective Five Eyes cyber agencies reveals insight into the most exploited vulnerabilities of 2022, and unsurprisingly there are some old ‘friends’ on the list

• August 04, 2023 04 Aug'23

  Biden’s SBOM mandate a ‘shot heard around the world’, report says

  Two years and three months after Joe Biden mandated new standards in supply chain security, over 40% of UK respondents to a survey say they have implemented new SBOM policies in direct response

• August 03, 2023 03 Aug'23

  Scottish NHS trust ducks fine after staff shared patient data via WhatsApp

  NHS Lanarkshire has been issued a formal reprimand by the ICO after staff members used WhatsApp to share patients’ personal data with one another

• August 03, 2023 03 Aug'23

  Microsoft attacked over ‘grossly irresponsible’ security practice

  The CEO of Tenable has launched a scathing attack on Microsoft, asserting that the organisation is deliberately keeping its Azure cloud customers in the dark about dangerous vulnerabilities and accusing it of a culture of ‘toxic obfuscation’

• August 02, 2023 02 Aug'23

  Ivanti MDM users told to patch against two dangerous flaws

  Users of Ivanti’s mobile device management platform have been warned to act now to patch two vulnerabilities that were chained by a threat actor in a series of cyber attacks on the Norwegian government

• August 02, 2023 02 Aug'23

  Improved rural connectivity could add £65bn to UK economy

  Study from leading operator and economic consultancy points to potential massive economic boost to UK rural communities through increased digital connectivity and if long-standing obstacles are removed

• July 28, 2023 28 Jul'23

  Risks of opening up AI

  Meta has annouced that its Llama 2 large language model will be freely available under a community licence with certain restrictions

• July 28, 2023 28 Jul'23

  Scottish university hit by Rhysida ransomware gang

  Data allegedly stolen from the University of Western Scotland has been put up for sale on the dark web by a ransomware gang going by the name Rhysida

• July 27, 2023 27 Jul'23

  European Commission starts investigation into Microsoft Teams bundling

  The commission will investigate if the bundling of Microsoft’s collaboration software with its office productivity suite breaks competition rules

• July 27, 2023 27 Jul'23

  Cyber criminals pivot away from ransomware encryption

  Cyber breaches that saw data theft and extortion without an encryption or ransomware component account for more and more incidents, in a possible indication that ransomware gangs are changing up their business models

• July 27, 2023 27 Jul'23

  US cyber breach reporting rules to have global impact

  Organisations that operate as Foreign Private Issuers in the US will have to get to grips with strict new cyber breach reporting regulations handed down by the SEC in Washington

• July 27, 2023 27 Jul'23

  Meta results show impact of data fines and datacentre upgrade strategy

  The owner of Facebook is battling with regulators over transferring EU data to the US. It is also seeing less improvements on CPUs

• July 25, 2023 25 Jul'23

  Cisco, BT and others launch network security coalition

  Network Resilience Coalition focuses on bringing together global expertise to improve data and network security

• July 25, 2023 25 Jul'23

  Tetra radio users’ comms may have been exposed for years

  A number of flaws in the encryption algorithms used in the secure Tetra radio communications standard have potentially left users exposed to snooping

• July 24, 2023 24 Jul'23

  Citrix NetScaler users told to patch new zero-day urgently

  A vulnerability disclosed and patched last week by Citrix appears to be being exploited by China-backed threat actors as a zero-day, prompting warnings from government cyber bodies

• July 24, 2023 24 Jul'23

  Tribunal investigates complaint that journalists’ phones were unlawfully monitored

  The Investigatory Powers Tribunal has agreed to investigate complaints by Northern Ireland investigative journalists Trevor Birney and Barry McCaffrey that they were unlawfully placed under surveillance

• July 24, 2023 24 Jul'23

  Bank of England’s project to replace ‘beating heart’ is foundation for continuous development

  The Bank of England has reached a major milestone in its core system replacement programme, with next landmark in sight

• July 24, 2023 24 Jul'23

  Security AI and automation may reduce cost of data breaches

  Organisations that go all in on security AI and automation tend to incur lower financial costs when they experience a data breach incident, according to an IBM report

• July 20, 2023 20 Jul'23

  Online Safety Bill screening measures amount to ‘prior restraint’

  The Open Rights Group is calling on Parliament to reform the Online Safety Bill, on the basis that its content-screening measures would amount to “prior restraint” on freedom of expression

• July 20, 2023 20 Jul'23

  How the DSMA balances security and privacy with press freedom

  In a world of information sharing and 24-hour news cycles, the Defence and Security Media Advisory committee have to balance national security and data privacy with freedom of the press

• July 19, 2023 19 Jul'23

  BlackCat and Clop gangs both claim cyber attack on Estée Lauder

  Cosmetics conglomerate Estée Lauder is experiencing operational disruption in the wake of a cyber attack that seems to involve two different cyber crime gangs

• July 19, 2023 19 Jul'23

  ‘Significant gaps’ in UK AI regulation, says Ada Lovelace Institute

  UK government’s plans to diffuse regulatory responsibility for AI among existing regulators will mean the tech is “only partially regulated”, while its data reforms will undercut already-limited existing protections, says Ada Lovelace Institute

• July 19, 2023 19 Jul'23

  Cyber criminal AI tool WormGPT produces ‘unsettling’ results

  A newly discovered generative AI tool dubbed WormGPT is being sold to the cyber criminal underground via the dark web, and poses a significant danger, researchers warn

• July 17, 2023 17 Jul'23

  Police Scotland use cloud for biometric data despite clear risks

  Police Scotland confirms it has stored significant volumes of biometric data on a cloud-based digital evidence sharing system despite major ongoing data protection concerns, bringing into question the effectiveness of the current regulatory approach...

• July 17, 2023 17 Jul'23

  Shift towards ‘smarter’ digital life as broadband security, sustainability become key needs

  Cisco survey finds consumer expectations will reshape the needs and economics of the internet

• July 13, 2023 13 Jul'23

  Civil society groups call on EU to put human rights at centre of AI Act

  Dozens of civil society groups are calling on EU institutions to prioritise people and human rights in AI legislation as secretive negotiations begin

• July 13, 2023 13 Jul'23

  Microsoft issues new warning over Chinese cyber espionage

  A newly uncovered Chinese espionage campaign exploited forged authentication tokens to access its victims’ email accounts, says Microsoft

• July 13, 2023 13 Jul'23

  One month after MOVEit: New vulnerabilities found as more victims are named

  Five weeks after the mass MOVEit breach, new vulnerabilities in the file transfer tool are coming to light as the Clop cyber crime group continues to terrorise victims. But has the gang bitten off more than it can chew?

• July 12, 2023 12 Jul'23

  Digital public services ‘riddled’ with problems, says TUC

  The UK’s increasingly digitised public services are plagued by design, governance and workplace issues that are undermining the government’s stated goal of improving efficiency, but can be alleviated by giving public sector workers a greater say in ...

• July 12, 2023 12 Jul'23

  Ofcom’s online safety preparedness efforts hobbled by government

  Despite Ofcom’s progress so far, UK government changes to the scope and timetable of the Online Safety Bill are hobbling the ability of the regulator to successfully prepare for the new regime

• July 12, 2023 12 Jul'23

  Microsoft users on high alert over dangerous RCE zero-day

  A serious RCE vulnerability in Microsoft Office and Windows is among several zero-days disclosed in Redmond’s July Patch Tuesday update, but this one does not have a patch yet

• July 11, 2023 11 Jul'23

  EU formally grants data adequacy to US

  The European Commission has formally granted the US data adequacy, allowing companies and organisations to freely transfer personal data across the Atlantic via the EU-US Data Privacy Framework. But privacy activist Max Schrems has already committed...