News

Security policy and user awareness

• March 08, 2023 08 Mar'23

  How ForgeRock is tackling identity management

  ForgeRock CEO Fran Rosch has set the identity and access management software supplier on a path to deliver a frictionless identity experience without compromising security or privacy

• March 07, 2023 07 Mar'23

  Nine in 10 enterprises fell victim to successful phishing in 2022

  Egress annual email security risk report breaks down impacts of email-based phishing attacks and data loss, and the effect these can have on organisations in terms of staff retention and morale

• March 07, 2023 07 Mar'23

  Taking back control: Could a distributed model breed a better AI?

  AI tools such as ChatGPT are trained on datasets scraped from the web, but you don’t have much say if your data is used. Technologist Bruce Schneier says it’s time to give control of AI training data back to the people

• March 07, 2023 07 Mar'23

  APAC IT leaders bullish on tech spending

  Over half of respondents in this year’s IT Priorities study have bigger IT budgets as they continue to make strategic investments in cyber security, cloud and automation, among other areas

• March 03, 2023 03 Mar'23

  White House unveils National Cybersecurity Strategy

  The strategy will focus on ensuring closer collaboration on cyber security between government and industry, while giving software and other tech companies a bigger role in combatting threats due to their resources and expertise

• March 02, 2023 02 Mar'23

  WH Smith staff data accessed in cyber attack

  The retailer has said that customer data has not been affected by the incident as it is held in different systems, and that investigations into the attack are ongoing

• February 22, 2023 22 Feb'23

  UK forces lead live-fire cyber war exercise

  The seven-day Defence Cyber Marvel 2 exercise put cyber responders from 11 countries through their paces

• February 22, 2023 22 Feb'23

  Half of cyber leaders to switch jobs by 2025, citing stress

  A substantial number of cyber security leaders are plotting their great escape, saying the industry is leaving them too stressed to go on, according to a study

• February 20, 2023 20 Feb'23

  Singapore organisations struggle to operationalise threat intelligence

  Organisations in the city-state were satisfied with the quality of their threat intelligence, but they struggled to operationalise the information due to talent shortages and other challenges

• February 20, 2023 20 Feb'23

  Twitter 2FA changes bring more risks than benefits

  Twitter’s approach to nudging users away from insecure SMS-based 2FA is being questioned over its logic

• February 16, 2023 16 Feb'23

  How to tame the identity sprawl

  Organisations should find a comprehensive way to gain full visibility into their digital identities and leverage automation to tame the identify sprawl

• February 15, 2023 15 Feb'23

  Multi-purpose malwares can use more than 20 MITRE ATT&CK TTPs

  Report warns of the development of increasingly sophisticated, multi-purpose malwares, and calls on defenders to play close attention to the MITRE ATT&CK framework to ward them off

• February 15, 2023 15 Feb'23

  Microsoft fixes three zero-days in February update

  February’s Patch Tuesday update contains fixes for three previously unpublicised zero-days in Microsoft Office, Windows Graphics Component and Windows Common Log File System Driver

• February 14, 2023 14 Feb'23

  Vidar, nJRAT re-emerge as prominent malware threats in January

  Trojans and infostealers once again dominate the list of most commonly observed threats, according to Check Point’s latest telemetry

• February 14, 2023 14 Feb'23

  UK authorities clamp down on illegal crypto ATMs

  The Financial Conduct Authority and West Yorkshire Police have disrupted a number of illegal crypto ATMs

• February 14, 2023 14 Feb'23

  OSC&R framework to stop supply chain attacks in the wild

  The backers of a new MITRE ATT&CK style framework called OSC&R hope to help organisations get to grips with threats to their software supply chains

• February 10, 2023 10 Feb'23

  Social media platform Reddit breached in phishing attack

  An unspecified threat actor obtained access to internal documents, code and business systems at Reddit after stealing employee credentials in a phishing attack

• February 09, 2023 09 Feb'23

  UK imposes sanctions on Conti ransomware gang leaders

  Seven Russian nationals associated with the Conti and Ryuk ransomware operations have been sanctioned by the UK

• February 09, 2023 09 Feb'23

  How Check Point is keeping pace with the cyber security landscape

  Check Point Software CEO Gil Shwed talks up the company’s growth areas, its approach to cloud security and the impact of generative AI on cyber security

• February 08, 2023 08 Feb'23

  Russian hacking group Seaborgium targets SNP MP Stewart McDonald

  Scottish National Party MP Stewart McDonald says his personal emails have been hacked by a group linked to the Russian state in a targeted phishing attack

• February 08, 2023 08 Feb'23

  Campaigners lament lack of movement on Computer Misuse Act reform

  Westminster has opened a new consultation on proposed reforms to the Computer Misuse Act of 1990, but campaigners who want the law changed to protect cyber professionals have been left disappointed

• February 06, 2023 06 Feb'23

  Online banks still riddled with cyber security flaws, report says

  Online bank Virgin Money was found to have the weakest online and application security measures in a Which? study but Nationwide, TSB and The Co-Operative Bank all failed on multiple points, too.

• February 06, 2023 06 Feb'23

  The Security Interviews: How to overcome data protection compliance challenges

  Complying with the vast swathe of data protection legislation around the world is complex, especially for smaller organisations without the necessary expertise. Could the compliance process be simplified, and if so, how?

• February 06, 2023 06 Feb'23

  Ransomware operator turns their fire on two-year-old VMware bug

  A vulnerability in VMware ESXi servers that users should have patched in 2021 is now being exploited to spread ransomware

• February 05, 2023 05 Feb'23

  Australian organisations underinvesting in cyber security

  Over half of Australian organisations failed to invest enough in cyber security over past three years, though awareness is improving in aftermath of high-profile data breaches

• February 02, 2023 02 Feb'23

  North Korea’s Lazarus gang exposes itself in opsec failure

  WithSecure researchers linked a campaign of cyber attacks targeting medical research and energy firms to North Korea’s infamous Lazarus APT after a group member accidentally screwed up

• February 02, 2023 02 Feb'23

  Arnold Clark customer data was stolen in Play ransomware attack

  Arnold Clark confirms data leaked on dark web was stolen from its systems in ransomware attack

• February 01, 2023 01 Feb'23

  Romance fraudsters stole £65m from Brits since 2020

  Online romance fraudsters have scammed Brits out of £65m in the past three years, according to retail bank TSB

• February 01, 2023 01 Feb'23

  Cisco fixes two bugs that could have led to supply chain attacks on users

  Two vulnerabilities uncovered in Cisco hardware could have opened the door to serious supply chain cyber attacks, according to the Trellix researchers who found them

• February 01, 2023 01 Feb'23

  CryptoRom scam abuses Apple and Google app stores to claim victims

  Sophos researchers report on two fake apps used by romance scammers to lure victims into parting with their money, both of which were able to escape the attention of Apple and Google app store safeguards

• February 01, 2023 01 Feb'23

  Malware variant can block contactless payments

  Kaspersky warns that the latest variant of the Prilex malware can block contactless payments to force people to insert cards, enabling criminals to steal money

• February 01, 2023 01 Feb'23

  UK Cyber Council and ISACA launch audit, assurance programme

  The UK Cyber Security Council has teamed up with ISACA to partner on a new audit and assurance programme for security pros

• January 31, 2023 31 Jan'23

  Cyber training firm launches £20k data protection scholarship

  Training specialist Freevacy has launched a £20,000 scholarship fund to train data privacy and protection professionals

• January 31, 2023 31 Jan'23

  GitHub warns Desktop, Atom users after code-signing certificates pinched

  Threat actors stole encrypted code-signing certificates for GitHub’s Desktop and Atom applications in December 2022, prompting warnings for users

• January 31, 2023 31 Jan'23

  MI5 unlawfully collected and held millions of people’s data

  Secretive court finds MI5 knowingly acted unlawfully in use of bulk surveillance warrants, and the Home Office continued granting warrants despite information the agency was operating outside the law

• January 31, 2023 31 Jan'23

  Royal Mail recovers more International Tracked services

  Royal Mail is making further progress in recovering IT systems hit by a ransomware attack, and has re-enabled another tranche of international export services

• January 31, 2023 31 Jan'23

  ATO renews major Macquarie deal

  The contract renewal will enable the Australian Tax Office to tap Macquarie’s security operations centre, among other services, to secure its IT environment and protect sensitive data

• January 30, 2023 30 Jan'23

  Data of 10 million JD Sports customers accessed in cyber attack

  Data on 10 million people who shopped online at JD Sports over a two-year period was accessed and potentially stolen in a cyber attack

• January 27, 2023 27 Jan'23

  Hive ransomware gang taken down after FBI hacks back

  The FBI hacked into Hive’s servers, stole its decryption keys and then took down its servers in a major action that has successfully disrupted a prolific and dangerous ransomware operation

• January 25, 2023 25 Jan'23

  NCSC exposes Iranian, Russian spear-phishing campaign targeting UK

  Spear-phishing campaigns likely linked to Iranian and Russian espionage activity are targeting persons of interest in the UK, warns the NCSC

• January 25, 2023 25 Jan'23

  Boards struggle to resolve cyber risk in digital supply chains

  Accelerated digitisation of supply chains is introducing more cyber risk for which many organisations seem unprepared, according to the BSI’s annual report on supply chain risk

• January 24, 2023 24 Jan'23

  Chinese IoT suppliers expose UK businesses to espionage and data theft

  Chinese companies supplying network components, known as IoT modules, post a greater long-term threat to UK security than the now banned 5G supplier Huawei, according to a study by a Chinese expert and former diplomat

• January 24, 2023 24 Jan'23

  UK insurers need to up their game on cyber gaps, says PRA

  Gaps and limitations in how insurers respond to cyber risk need to be addressed, according to the Bank of England regulator, the Prudential Regulation Authority

• January 24, 2023 24 Jan'23

  SSRF attacks hit 100,000 businesses globally since November

  There has been a dramatic increase in attacks exploiting the ProxyNotShell/OWASSRF exploit chains to target Microsoft Exchange servers

• January 24, 2023 24 Jan'23

  Fake online contest makes Yahoo! most phished brand of Q4 2022

  Yahoo! was the most frequently phished brand during the last three months of 2022, according to a report

• January 23, 2023 23 Jan'23

  Trellix automates patching for 62,000 vulnerable open source projects

  Since revealing startling statistics about the prevalence of a 15-year-old Python vulnerability, Trellix says it has helped fix almost 62,000 vulnerable projects in the past four months

• January 23, 2023 23 Jan'23

  NCSC warning over cyber risk to charity sector

  Cash-strapped charities without the resource to tackle their resilience deficit are increasingly at risk from malicious actors, says the NCSC

• January 22, 2023 22 Jan'23

  Royal Mail making limited progress on ransomware recovery

  Royal Mail asks customers to hold back from sending post overseas as some services get back on track, while a report warns that disruptive attacks on critical infrastructure are set to become more common

• January 19, 2023 19 Jan'23

  KFC, Pizza Hut parent shuts UK restaurants after cyber attack

  A ransomware attack on Yum! Brands, the parent organisation of restaurants including KFC and Pizza Hut, was forced to shut approximately 300 outlets in the UK following a ransomware attack by an unspecified group

• January 19, 2023 19 Jan'23

  Mailchimp suffers third breach in 12 months

  Email marketing service Mailchimp has suffered its third data breach in a year, but has been praised for being open about its latest attack