News

IT governance

• May 18, 2021 18 May'21

  Irish High Court dismisses legal bid by Facebook over EU-US data transfers

  Latest twist in long-running legal battle sees Facebook lose legal bid to prevent the Irish Data Protection Commissioner suspending its transfer of data about European citizens to the US

• May 17, 2021 17 May'21

  Conti ransomware syndicate behind attack on Irish health service

  More details continue to emerge of the significant ransomware attack on Ireland’s HSE

• May 17, 2021 17 May'21

  Government seeks input on supply chain security

  Amid concerns that too few companies are addressing vulnerabilities in their supply chain, DCMS is opening a consultation on new measures to enhance security

• May 14, 2021 14 May'21

  Colonial Pipeline paid $5m ransom, reports say

  Colonial Pipeline may have paid a significant ransom within hours of being attacked, it has emerged, but it’s unlikely the story ends here

• May 13, 2021 13 May'21

  Publishing exploit code does more harm than good, says report

  Disclosing exploit code before patches are available gives malicious actors a ‘massive’ head-start, says Kenna Security

• May 13, 2021 13 May'21

  Biden beefs up public-private security cooperation

  Joe Biden has signed a new Executive Order to harden US cyber security and government networks, with an emphasis on information sharing

• May 13, 2021 13 May'21

  CISOs weathered the pandemic well, but at personal cost

  Over 80% of CISOs think their existing security capabilities stayed strong during the worst of the Covid-19 pandemic, but now face stress and burnout on an unheard-of scale

• May 13, 2021 13 May'21

  Verizon DBIR underscores year of unprecedented cyber challenge

  Verizon 2021 Data Breach Investigations Report draws predictable conclusions as the impact of the Covid-19 pandemic continues to be felt

• May 12, 2021 12 May'21

  UK government publishes Online Safety Bill draft

  Bill builds on previous commitments by the government, which has added new measures to uphold democracy and freedom of speech while making tech giants more accountable

• May 12, 2021 12 May'21

  CyberUK 2021: NCSC encourages startups to invest in cyber

  National Cyber Security Centre is launching bespoke cyber security guidance aimed at the UK’s valuable startup community

• May 12, 2021 12 May'21

  UK to fund national cyber teams in Global South

  Government will commit millions of pounds to supporting vulnerable countries in establishing cyber capacity

• May 12, 2021 12 May'21

  Microsoft fixes four critical bugs on lighter Patch Tuesday

  Four critical RCE vulnerabilities put users of various Microsoft products at risk, and should be patched right away

• May 12, 2021 12 May'21

  The Security Interviews: Why helpful bots could hurt vaccine roll-outs

  Earlier this year, spikes in traffic to websites containing information about Covid-19 vaccines were attributed by Imperva to automated bots scraping data. Why is that a problem?

• May 11, 2021 11 May'21

  UK Plc invited to sign up for Early Warning of cyber incidents

  The launch of the Early Warning incident notification service is among the enhancements being made by the NCSC to its service packages

• May 11, 2021 11 May'21

  Collaboration key to success of UK’s Cyber Security Council

  The founders of the UK’s Cyber Security Council have been setting out their plans to professionalise the cyber sector at the NCSC’s CyberUK 2021 event

• May 11, 2021 11 May'21

  NCSC cyber guidance targets cloud and home working

  The NCSC’s refreshed cyber security guidance for larger organisations places particular emphasis on cloud, home working and ransomware

• May 11, 2021 11 May'21

  Government to reform Computer Misuse Act

  Home secretary Priti Patel will explore reforming the Computer Misuse Act as calls mount for the 31-year-old law to be updated to reflect the changed online world

• May 11, 2021 11 May'21

  SolarWinds CEO calls for collective action against state attacks

  SolarWinds CEO tells NCSC’s CyberUK conference he is exploring the possibility of collaborating with other companies on collective cyber action against attacks backed by nation states

• May 11, 2021 11 May'21

  Colonial Pipeline ransomware attack has grave consequences

  The ramifications of a major ransomware attack against a US fuel pipeline operator could spread far and wide

• May 10, 2021 10 May'21

  NCSC Active Cyber Defence blocks surge of pandemic scams

  The NCSC responded to a surge in online scams last year as it moved to protect both the general public and critical national services during the pandemic

• May 07, 2021 07 May'21

  NCSC, CISA publish new information on Russia’s Cozy Bear

  New intelligence from UK and US cyber agencies suggests that APT29, or Cozy Bear, has been switching up its tactics

• May 07, 2021 07 May'21

  NCSC publishes smart city security guidelines

  Guidance for local authorities, IT and cyber professionals aims to ensure the security of connected, smart city projects

• May 07, 2021 07 May'21

  Cyber accreditation to improve legal standing of security pros

  Institute of Cyber Digital Investigations Professionals will help incident responders and cyber investigators get the professional recognition they deserve

• May 07, 2021 07 May'21

  Reddit enlists HackerOne to run public bug bounty programme

  Online community platform is opening up its HackerOne bug bounty programme to any ethical hacker who cares to have a look under the bonnet

• May 06, 2021 06 May'21

  Government urged to add scam protections to Online Safety Bill

  Group of organisations calls for the government to use the Online Safety Bill to protect people from cyber scams

• May 06, 2021 06 May'21

  Scammers accidentally reveal fake Amazon review data

  More than 13 million records relating to an organised fake review scam have been found on an unsecured ElasticSearch database, implicating hundreds of thousands of people in unethical behaviour

• May 06, 2021 06 May'21

  Google to introduce mandatory MFA for users

  In future, holders of Google accounts will have no option but to use multifactor authentication if they want to use the firm’s services

• May 05, 2021 05 May'21

  Dysfunctional cyber, network teams disrupt digital transformation

  Despite shared goals, combative and dysfunctional relationships within specialist tech teams are putting digital transformation projects at risk, according to a report

• May 05, 2021 05 May'21

  Sophos: How timely intervention stopped a ProxyLogon attack

  A recent incident at an undisclosed customer sheds new light on how malicious actors exploit unpatched Microsoft Exchange servers

• May 04, 2021 04 May'21

  Half of organisations breached via a third party in 12 months

  New report highlights the risks of outsourcing key business processes without paying due care and attention to your service provider’s security

• April 30, 2021 30 Apr'21

  MPs accuse government of unduly interfering in information commissioner appointment

  Cross-party group of MPs says government is influencing the appointment of a new information commissioner by explicitly seeking a candidate who will support its policy agenda, rather than regulate independently

• April 29, 2021 29 Apr'21

  G7 countries to cooperate on digital regulation

  Digital and technology ministers outline their agenda for how technology can be used to facilitate the post-Covid recovery, signalling closer collaboration in key areas of the digital economy

• April 28, 2021 28 Apr'21

  Covid-19 security challenges leave bank customers at risk

  Challenges arising from the pandemic have left gaping holes in banking security, putting consumers at risk of fraud

• April 28, 2021 28 Apr'21

  Office 365 compromise likely led to Merseyrail ransomware attack

  Compromise of Merseyrail employee data seems to have begun after a key email account was hacked

• April 28, 2021 28 Apr'21

  NHS App to serve as vaccine passport for foreign holidays

  Existing NHS App will have vaccine passport functionality added to it, transport secretary confirms

• April 28, 2021 28 Apr'21

  Government extends Gov.uk Verify for a further two years

  The government’s Gov.uk Verify identity platform will continue to run until April 2023 while a new identity service is developed

• April 27, 2021 27 Apr'21

  UK supermarkets to trial age estimation tech for alcohol purchases

  Biometric age estimation technology developed by Yoti to be tested in UK supermarkets for alcohol purchases as part of government-led digital identities initiative

• April 27, 2021 27 Apr'21

  Total cost of ransomware attack heading towards $2m

  Sophos’ latest study finds that ransomware attacks are proving increasingly disruptive to their victims’ finances

• April 27, 2021 27 Apr'21

  Leaky Azure storage account puts software developer IP at risk

  Source code for multiple products was left exposed in an unsecured Microsoft Azure cloud storage account, say researchers, but attributing responsibility for the error has proved difficult

• April 27, 2021 27 Apr'21

  Apple OS updates patch multiple security holes

  The much-heralded release of the privacy-centric iOS 14.5 also brings patches for multiple CVEs, and users of Apple smartphones, tablets and notebooks are best advised to update as soon as possible

• April 27, 2021 27 Apr'21

  The Security Interviews: Making sense of outbound email security

  Screening inbound emails is an accepted part of an organisation’s security posture, but the topic of securing outbound traffic is less often discussed. Zivver’s Rick Goud is on a mission to change this

• April 22, 2021 22 Apr'21

  GCHQ: Cyber investment a guarantor of UK’s global status

  GCHQ director Jeremy Fleming sets out a vision for the UK’s cyber security future

• April 22, 2021 22 Apr'21

  Researchers shed more light on APT29 activity during SolarWinds attack

  RiskIQ’s Atlas threat intel team uncovers new patterns and threat infrastructure used in the SolarWind’s attacks

• April 22, 2021 22 Apr'21

  ToxicEye malware exploits Telegram messaging service

  The Telegram instant messaging service is being used by malicious actors to manage a remote access trojan called ToxicEye

• April 21, 2021 21 Apr'21

  NCSC offers teachers free cyber security training

  The NCSC’s latest security training offer builds on a package of measures designed to protect schools from cyber attack

• April 21, 2021 21 Apr'21

  EU lays out plans to regulate AI development

  Proposal aims to encourage the development of ethical artificial intelligence systems that do not infringe the human rights of EU citizens

• April 21, 2021 21 Apr'21

  SonicWall Email Security zero-days need urgent patch

  Users of SonicWall Email Security are advised to patch immediately, but the supplier is being criticised for the pace of its response

• April 20, 2021 20 Apr'21

  Health app myGP adds Covid-19 vaccine passport function

  The new feature is described as the UK’s first NHS-assured Covid-19 certification feature

• April 20, 2021 20 Apr'21

  Chinese APT exploits critical CVE in Pulse Secure VPN

  A newly disclosed vulnerability in Pulse Secure’s VPN is being exploited by a Chinese advanced persistent threat group – assume compromise and mitigate today

• April 20, 2021 20 Apr'21

  Codecov supply chain attack has echoes of SolarWinds

  Supply chain attack on code auditing service may have compromised the likes of HPE and IBM

• April 19, 2021 19 Apr'21

  Digital secretary steps in on Nvidia/Arm deal

  The first stage of a formal investigation by the CMA is now underway, to look at whether the sale of Arm to Nvidia will damage the chip industry

• April 19, 2021 19 Apr'21

  YouGov incentivises sharing of personally identifiable information

  YouGov Safe is a new service to help organisations target consumers more precisely, where people can select how much personal data they wish to share

• April 15, 2021 15 Apr'21

  Uber ordered to reinstate six drivers fired by automated process

  A default judgment handed down by Dutch court has ordered Uber to reinstate six drivers with compensation following unevidenced accusations of fraud and automated firing via algorithm

• April 15, 2021 15 Apr'21

  Biden sanctions Russia over SolarWinds cyber attacks

  US president imposes new sanctions on Russia following malicious cyber attacks against the US and allies

• April 15, 2021 15 Apr'21

  University of Hertfordshire is latest academic cyber attack victim

  Multiple systems are offline at the University of Hertfordshire following a cyber attack

• April 15, 2021 15 Apr'21

  Ireland’s DPC launches probe into Facebook leak

  The Irish Data Protection Commission has launched an ‘own volition’ inquiry into the leak of data from 500 million Facebook profiles

• April 14, 2021 14 Apr'21

  FBI accesses ProxyLogon target servers to disrupt cyber criminals

  US Justice Department reveals successful court-authorised effort to clamp down on ProxyLogon exploitation

• April 14, 2021 14 Apr'21

  EU set to tilt AI balance in favour of citizen rights

  New draft EU regulations aim to protect people from biased decision-making

• April 14, 2021 14 Apr'21

  NSA unearths more MS Exchange vulnerabilities

  Microsoft patches more critical vulnerabilities in Exchange Server a month after the ProxyLogon incident, after being warned by the US National Security Agency

• April 13, 2021 13 Apr'21

  MP told to ditch official email over hacking fears

  MP Tom Tugendhat claims the intelligence services advised him to switch to the Gmail service due to concerns his parliamentary email could be hacked

• April 13, 2021 13 Apr'21

  Millions of devices at risk from NAME:WRECK DNS bugs

  Newly disclosed set of nine DNS vulnerabilities puts over 100 million consumer, enterprise and industrial IoT devices at risk

• April 09, 2021 09 Apr'21

  Cring ransomware hits ICS through two-year-old bug

  A long-disclosed vulnerability in Fortinet’s Fortigate VPN servers is being exploited to distribute Cring ransomware

• April 08, 2021 08 Apr'21

  Nation-state cyber attacks double in three years

  Cyber attacks backed by nation states are becoming more frequent and varied, moving the world closer to a point of ‘advanced cyber-conflict’, according to a University of Surrey research project

• April 07, 2021 07 Apr'21

  Facebook ducks calls to apologise over huge data leak

  Facebook gives its side of the story as data on millions of its users leaks, but is yet to apologise for security lapses that put half a billion people at risk of compromise

• April 07, 2021 07 Apr'21

  Digital Markets Unit starts work on codes of conduct for tech giants

  Digital markets regulator officially launched to ensure tech giants such as Facebook and Google cannot exploit their market dominance to crowd out competition and stifle innovation online

• April 06, 2021 06 Apr'21

  Facebook data leak could be outside scope of GDPR

  Regulators may be unable to do much about leaked data on 533 million Facebook users, as it seems to have been stolen before GDPR came into force

• March 31, 2021 31 Mar'21

  NHS is apparently closing security skills gap

  By the end of 2020, there were more than twice as many in-house security professionals at NHS trusts as there were two years before

• March 31, 2021 31 Mar'21

  Cyber Security Council to champion UK security pros

  A new cyber security professional body has launched with the aim of developing and promoting UK cyber security excellence globally and growing the skills base

• March 30, 2021 30 Mar'21

  Ransomware attack on London schools highlights warnings

  Ransomware attack on Harris Federation comes just days after a fresh NCSC alert for the education sector

• March 30, 2021 30 Mar'21

  The Security Interviews: How to secure an F1 team in a pandemic

  A multi-year digital transformation programme paid off for F1 team Williams Racing when the 2020 season was abruptly postponed thanks to Covid-19. Learn how the team’s CIO has been supporting remote working and protecting data

• March 29, 2021 29 Mar'21

  Backup survey: UK councils’ downtimes five times longer than average

  Backup product supplier Veeam’s freedom of information request finds councils’ average downtime is seven hours and that backup and disaster recovery testing is not done frequently

• March 26, 2021 26 Mar'21

  Retailer FatFace pays $2m ransom to Conti cyber criminals

  Retailer FatFace paid out a $2m ransom to restore its data following a January 2021 cyber attack by the Conti ransomware syndicate

• March 26, 2021 26 Mar'21

  Remote working burn-out a factor in security risk

  After a year of working from the kitchen table, stress and burn-out are increasing, giving rise to more security risks – and Millennials seem to be particularly affected

• March 25, 2021 25 Mar'21

  Cyber security complacency puts UK at risk, says NCSC head

  National Cyber Security Centre CEO Lindy Cameron, in her maiden speech in the role, warns of challenges ahead for the UK and sets out the future agenda for cyber

• March 24, 2021 24 Mar'21

  Oil giant Shell hit through Accellion FTA breach

  Energy firm discloses cyber attack through Accellion File Transfer Appliance

• March 24, 2021 24 Mar'21

  Apparent drop in cyber incidents highlights underlying problems

  UK organisations report fewer cyber security incidents, but the headline data masks more serious issues, according to a report

• March 24, 2021 24 Mar'21

  Cyber criminals forging Covid-19 vaccine certificates

  Vaccine passports and certificates are gaining mainstream traction, which means cyber criminals are also on the bandwagon

• March 23, 2021 23 Mar'21

  NCSC beefs up support for education sector after spate of attacks

  Refreshed guidance from the NCSC recommends a defence-in-depth strategy as schools and universities face a renewed wave of cyber attacks

• March 22, 2021 22 Mar'21

  $50m ransomware demand on Acer is highest ever

  Record-breaking double-extortion cyber attack saw REvil gang exfiltrate financial data from Taiwan-based PC manufacturer

• March 22, 2021 22 Mar'21

  Unionised drivers call on Microsoft to suspend Uber’s Face API licences

  Unionised private hire drivers in the UK are calling for Microsoft to suspend Uber’s licences to use its Face API technology after claims the ride-hailing firm’s ID-checking system has led to drivers losing their jobs and having licences revoked

• March 22, 2021 22 Mar'21

  CIO interview: Juliette Atkinson, IT director, Bradford University

  Bradford University’s IT director took a different route than most to get into IT leadership

• March 18, 2021 18 Mar'21

  Vaccine passports cannot put basic rights at risk, warns BCS

  BCS warns of challenges to come as the government presses on with its plans for Covid-19 vaccine passports

• March 17, 2021 17 Mar'21

  Average ransomware cost triples, says report

  The average amount paid out by ransomware victims has grown almost threefold to more than $300,000 per incident, according to a report

• March 17, 2021 17 Mar'21

  Digital Green Certificate proposed for travel in Europe

  Digital Green Certificates will supposedly help re-establish freedom of movement within the European Union

• March 17, 2021 17 Mar'21

  Cyber sector welcomes PM’s defence review

  Security commentators approve of measures to improve the UK’s cyber resilience, strengthen its R&D and skills base, lead on the development of new technology and promote a free, open, peaceful and secure global internet

• March 16, 2021 16 Mar'21

  MoD partners playing fast and loose with confidential data

  Clear spike in data breach incidents at defence partners may reflect better reporting standards, claims MoD

• March 16, 2021 16 Mar'21

  Banks still lack tech skills at the top

  Banks have made progress in adding IT knowledge in their boardrooms, but they need more as digital transformation accelerates

• March 16, 2021 16 Mar'21

  Unusual DearCry ransomware uses ‘rare’ approach to encryption

  Hybrid approach to encryption used by DearCry bears similarities to WannaCry

• March 16, 2021 16 Mar'21

  Microsoft releases one-click ProxyLogon mitigation tool

  Microsoft’s mitigation tool is designed to help customers without dedicated security or IT teams navigate fixing their vulnerable Exchange servers

• March 16, 2021 16 Mar'21

  Government calls for input into Covid-19 vaccine passports

  Evidence gathering exercise will inform the development of the UK’s proposed Covid-19 vaccine passport scheme

• March 15, 2021 15 Mar'21

  Microsoft Exchange ProxyLogon attacks spike 10 times in four days

  Exploitations of the Microsoft Exchange ProxyLogon vulnerabilities have increased tenfold in just four days

• March 12, 2021 12 Mar'21

  NCSC issues emergency alert on Microsoft Exchange patch

  UK’s national cyber agency calls on organisations affected by the ProxyLogon vulnerabilities to patch their Microsoft Exchange Servers immediately

• March 12, 2021 12 Mar'21

  IR35 private sector reforms: IT contractors ‘growing reluctant’ to work for ‘blanket banning’ firms

  IT-focused staffing company Ellis Recruitment Group shares its take on how the contracting market is responding to the private sector firms enforcing blanket bans

• March 12, 2021 12 Mar'21

  Web founder calls for ubiquitous, safe internet access for young people

  Internet access has a direct correlation to GDP. On the 32nd birthday of the world wide web, its founder calls for improvements to safe access

• March 12, 2021 12 Mar'21

  DearCry ransomware targets vulnerable Exchange servers

  As predicted, ransomware gangs have started to target vulnerable instances of Microsoft Exchange Server, making patching an even greater priority

• March 12, 2021 12 Mar'21

  Brewer Molson Coors targeted in cyber attack

  Cyber criminals have disrupted beer production at Molson Coors, one of the world’s largest brewers

• March 11, 2021 11 Mar'21

  UK digital regulators set out plans to strengthen cooperation

  Digital Regulation Cooperation Forum outlines plans for the coming year, marking a shift towards a more collaborative regulatory approach

• March 11, 2021 11 Mar'21

  Attack on surveillance cameras a warning over security, ethics

  The attack on a video surveillance startup by a hacktivist group raises questions not just over cyber security, but the use and extent of surveillance technology

• March 11, 2021 11 Mar'21

  Norwegian government falls victim to Microsoft attacks

  Norway’s parliament, the Storting, suffers second major cyber incident in a year as threat groups capitalise on vulnerable Microsoft Exchange Servers

• March 10, 2021 10 Mar'21

  Met Police chooses Capgemini as strategic IT infrastructure services provider

  Capgemini has a history of providing the force with day-to-day technology services, and will now deliver its infrastructure services under the Pegasus programme