Application security and coding requirements

Windows 10, Server 2019 users must patch serious zero-day

Another dangerous zero-day exploit is among 56 vulnerabilities patched by Microsoft in February’s Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Google Chrome update to patch serious zero-day

A serious heap buffer overflow vulnerability means Google Chrome users should patch their browsers as soon as possible Continue Reading

By

• Alex Scroxton, Security Editor

SolarWinds chases multiple leads in breach investigation

Investigators at SolarWinds are exploring multiple theories as to how the company’s systems were compromised Continue Reading

By

• Alex Scroxton, Security Editor

SolarWinds patches two critical CVEs in Orion platform

New vulnerabilities disclosed as SolarWinds reels from December 2020 Solorigate/Sunburst attack – but do not appear to have been exploited yet Continue Reading

By

• Alex Scroxton, Security Editor

Emergency Apple updates patch exploited zero-days

Three vulnerabilities could give attackers full control of their target Apple devices, and must be patched immediately Continue Reading

By

• Alex Scroxton, Security Editor

Malwarebytes also hit by SolarWinds attackers

The nation state group that attacked SolarWinds in December got inside Malwarebytes by exploiting privileged access to its Microsoft Office 365 tenant, the firm reveals Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: It’s time to secure the collaboration revolution

After a year of unprecedented disruption thanks to Covid-19, it looks like remote working is set to remain with us for now, which means security strategies will change in 2021. What will this change look like, and what tools and services will be selling like hotcakes? Continue Reading

By

• Paddy Francis

NCSC CyberFirst Girls 2021 contest kicks off

UK’s national cyber agency says it has already had hundreds of entrants in spite of the challenges presented by the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

APAC firms grapple with cyber security amid pandemic

Some aspects of cyber security have taken a backseat as companies across the Asia-Pacific region rush to shore up their infrastructure to cope with the demands of remote work Continue Reading

By

• Aaron Tan, TechTarget

Critical zero-day features in first Patch Tuesday of 2021

Microsoft releases fixes for 84 bugs on the first Patch Tuesday of 2021, including a critical zero-day vulnerability in Microsoft Defender Continue Reading

By

• Alex Scroxton, Security Editor

Palo Alto Networks opens Australia cloud location

The cyber security company’s Australia cloud location will address data localisation requirements amid growing adoption of cloud-based security services Continue Reading

By

• Aaron Tan, TechTarget

Mimecast latest security firm to be compromised

Users of a specific Mimecast certificate used to authenticate services to Microsoft Office 365 may be at risk of compromise in an attack that may relate to the ongoing SolarWinds incident Continue Reading

By

• Alex Scroxton, Security Editor

Early stage UK security startups face funding crisis

Overall cyber security funding since the advent of the pandemic is well up, but investment is dominated by safe, later-stage firms while those raising capital for the first time fall away Continue Reading

By

• Alex Scroxton, Security Editor

New SolarWinds CEO sets out rescue plan

Customers can expect to see more regular and thorough checks on SolarWinds products, alongside greater engagement with the security community Continue Reading

By

• Alex Scroxton, Security Editor

Kaspersky claims link between Solorigate and Kazuar backdoors

Researchers say they have found specific code similarities between the Solorigate/Sunburst malware and the Kazuar backdoor, suggesting some relationship Continue Reading

By

• Alex Scroxton, Security Editor

New Zealand central bank IT system breached in cyber attack

Bank is responding to a cyber attack after hackers breached the system of a third-party supplier Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Which? online banking investigation reveals ‘worrying gaps’ in security

Consumer rights organisation has ranked the security of UK online current account providers Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security Think Tank: Cyber effectiveness, efficiency key in 2021

After a year of unprecedented disruption thanks to Covid-19, it looks like remote working is set to remain with us for now, which means security strategies will change in 2021. What will this change look like, and what tools and services will be selling like hot cakes? Continue Reading

By

• Simon Persin, Turnkey Consulting

Security Long Reads: Cyber insiders reveal what’s to come in 2021

In this long read, we gather together the thoughts of cyber security insiders from across the industry to get their take on what will happen in 2021 Continue Reading

By

• Alex Scroxton, Security Editor

Top 10 cyber crime stories of 2020

Here are Computer Weekly’s top 10 cyber crime stories of 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Top 10 cyber security stories of 2020

Here are Computer Weekly’s 10 top cyber security stories of 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Patching: Balancing technical requirements with business considerations

With an increasing reliance on subscription models alongside the regular patching of software, updates have become an essential part of modern business practices. However, care needs to be taken to ensure the optimum patching process is implemented Continue Reading

By

• Peter Ray Allison

Finnish government tables laws to protect data from cyber criminals

Government is strengthening its legal framework to protect data from hackers in the wake of a massive breach at a psychotherapy centre Continue Reading

By

• Gerard O'Dwyer

Dodgy browser extensions put social media users at risk

More than three million users of third-party browser extensions for Instagram, Facebook, Vimeo and others have been infected with malware, according to Avast Continue Reading

By

• Alex Scroxton, Security Editor

FireEye and partners release SolarWinds kill-switch

A so-called kill-switch for the dangerous SolarWinds Sunburst attack should allay some user fears, but is not a full fix for the issue Continue Reading

By

• Alex Scroxton, Security Editor

How security will be different after Covid-19

In this week’s Computer Weekly, the world of cyber security will probably never return to its pre-pandemic state – we look ahead. The combination of remote working and streaming video is putting extra strain on networks. And we look at how digital transformation is changing the way contact centres are run. Read the issue now. Continue Reading

Disputed PostgreSQL bug exploited in cryptomining botnet

PGMiner cryptomining botnet remained unnoticed by exploiting a disputed CVE in PostgreSQL Continue Reading

By

• Alex Scroxton, Security Editor

Amnesia:33 IoT flaws dangerous and patches unlikely, say experts

The disclosure of multiple flaws by Forescout has raised big questions for the developers of connected products, and for their users Continue Reading

By

• Alex Scroxton, Security Editor

Patch Tuesday: Microsoft presents just 58 CVEs for Christmas

The final Patch Tuesday of 2020 contains 58 fixes, a minnow compared to some recent drops, but many are still of high importance Continue Reading

By

• Alex Scroxton, Security Editor

Russian state actors exploiting VMware bug to hijack data, users warned

Russian APT groups are actively exploiting a vulnerability in VMware products to access protected data, according to latest warnings Continue Reading

By

• Alex Scroxton, Security Editor

Grindr and others patch critical Android bug

Fixes for CVE-2020-8913 deployed as app developers shore up their defences against a disclosed Google Play vulnerability Continue Reading

By

• Alex Scroxton, Security Editor

Avast and Borsetta to support Intel’s AI security project

Security firm Avast and AI security specialist Borsetta have signed up to support an Intel-led artificial intelligence security research project Continue Reading

By

• Alex Scroxton, Security Editor

Lax Android app developers putting millions of users at risk

Eight months after Google patched a critical vulnerability, developers have failed to update their apps, putting millions of users of apps such as dating services Bumble and Grindr at risk Continue Reading

By

• Alex Scroxton, Security Editor

Singapore government remains ‘juicy target’ for cyber attackers

The government is baking security into the design and implementation of its IT systems and looking to increase bug bounties to fend off cyber threats Continue Reading

By

• Aaron Tan, TechTarget

APAC plagued by APT, ransomware attacks

The Asia-Pacific region was a primary target of advanced persistent threat groups, mostly from China, Iran, North Korea and Russia, that carried out 34 campaigns between June 2019 to June 2020 Continue Reading

By

• Aaron Tan, TechTarget

Belgian security researcher hacks Tesla with Raspberry Pi

Belgian security researcher Lennert Wouters once again succeeds in hacking a Tesla vehicle, this time by exploiting the Bluetooth Low Energy standard Continue Reading

By

• Alex Scroxton, Security Editor

How Covid-19 has accelerated tech innovation in the NHS

Of all the terrible things that Covid is, what it has done is accelerate the digital journey. In this issue of Computer Weekly, we look at the track and trace app, which was redeveloped and enhanced at breakneck speed, and explore how the pandemic has accelerated the roll-out of new technology such as artificial intelligence and video conferencing tools at NHS trusts. We also present some research into how Covid has affected IT spending. Read the issue now. Continue Reading

Cyber security is next frontier for open source

Open security will facilitate the interoperability and capabilities of cyber security tools while alleviating vendor lock-in for enterprises, says IBM Continue Reading

CW APAC: Expert advice on zero-trust security

Zero trust is a security model that eliminates the traditional perimeter and assumes that no user or device can be trusted until proven otherwise. In this handbook, Computer Weekly looks at how enterprises can take a zero-trust approach to securing their network, devices and workforce. Continue Reading

How Mastercard is taking digital payments into a new era

In this week’s Computer Weekly, we talk to Mastercard about how the credit card giant is using new technologies to take digital payments into a new era. After months of unprecedented uncertainty, we ask CIOs how they are planning for the next 12 months. And we examine how the growth in remote working will affect IT salaries. Read the issue now. Continue Reading

Microsoft drops fix for serious zero-day among 112 Patch Tuesday updates

November’s Patch Tuesday contains fixes for 112 bugs, including a potentially serious zero-day exploit that malicious actors are already taking advantage of Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2020: After Covid-19, security goes back to basics

This year’s transition to remote working highlighted big gaps in the fundamentals of security, as updated TechTarget/Computer Weekly data reveals Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft to support next generation of security startups

Tech giant lends its support to the NCSC Cyber Accelerator scheme, which is seeking its seventh cohort of startups Continue Reading

By

• Alex Scroxton, Security Editor

Trump supporters targeted by cryptocurrency scammers

The successful breach of Donald Trump’s official website shows up lax security on his campaign team and is yet another timely warning that nobody is immune to cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Barracuda eyes Indochina markets

Barracuda is looking to expand its local presence and headcount in fast-growing emerging markets of Vietnam, Cambodia and Laos Continue Reading

By

• Aaron Tan, TechTarget

NSA’s top CVE list a timely reminder to patch

Many of the CVEs detailed on the NSA’s top 25 chart are golden oldies Continue Reading

By

• Alex Scroxton, Security Editor

Trump and Biden campaign apps easy targets for cyber criminals

You don’t need a stellar IQ to exploit the dangerous StrandHogg Android vulnerability, and users of both Donald Trump’s and Joe Biden’s mobile apps are at risk of falling victim to it Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft fixes 87 bugs in October 2020 Patch Tuesday

Smaller October Patch Tuesday update includes fixes for critical bugs in Windows 10 and Windows Server 2019 Continue Reading

By

• Alex Scroxton, Security Editor

Suppliers neglecting virtual appliance security, putting users at risk

Software suppliers are often distributing their products on virtual appliances that contain known vulnerabilities or are running outdated or unsupported operating systems, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Five Eyes spy group again demands access to private messages

Spooks are once again calling for the tech industry to break end-to-end encryption in messaging platforms Continue Reading

By

• Alex Scroxton, Security Editor

Cyber security skills ad branded ‘crass’ by minister

Security skills campaign advert depicting a ballet dancer comes in for criticism as the arts sector struggles in the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Making sense of zero-trust security

Implementing zero-trust security is not an easy feat, but enterprises can still get it right if they approach it from a process perspective and get a handle on their infrastructure footprint Continue Reading

By

• Aaron Tan, TechTarget

Magecart strikes website of school payments service Wisepay

Magecart credit card skimmer harvested financial data of users of Wisepay’s platform over a two-day period Continue Reading

By

• Alex Scroxton, Security Editor

NCSC relaunches SME security guide with home working focus

The NCSC is issuing an updated version of its guide to security for SMEs, reflecting the long-lasting changes to the world of work seen in 2020 Continue Reading

By

• Alex Scroxton, Security Editor

MosaicRegressor APT campaign using rare malware variant

Kaspersky researchers have shared details of a APT campaign utilising a rarely seen and hard-to-stop variety of malware Continue Reading

By

• Alex Scroxton, Security Editor

Find and fix your Adobe Flash dependencies, says NCSC

As Adobe’s Flash Player approaches end-of-life, the National Cyber Security Centre is urging organisations to fix their Flash dependencies Continue Reading

By

• Alex Scroxton, Security Editor

GitHub makes code vulnerability scanning feature public

Code-scanning service is now out of beta and generally available, helping teams to bake security into their code at the development stage Continue Reading

By

• Alex Scroxton, Security Editor

NCSC expands schools programme to north-east England and Northern Ireland

Following an initial roll-out in Gloucestershire and Wales, the NCSC’s CyberFirst Schools programme is being extended to north-east England and Northern Ireland Continue Reading

By

• Alex Scroxton, Security Editor

TikTok ban stayed after last-minute court case

TikTok’s lawyers have staved off an imminent ban for the time being, after successfully arguing that it infringed rights guaranteed under the Constitution of the United States Continue Reading

By

• Alex Scroxton, Security Editor

Security now main driving force behind digital transformation

Organisations are urgently remodelling their core technology stack in the light of the Covid-19 pandemic, and this is pushing security to the top of the agenda Continue Reading

By

• Alex Scroxton, Security Editor

Third-party code bug left Instagram users at risk of account takeover

A critical vulnerability in Instagram’s image processing could have allowed attackers to take over not just their victim’s account, but their entire device Continue Reading

By

• Alex Scroxton, Security Editor

Race to patch as Microsoft confirms Zerologon attacks in the wild

Don’t be the organisation that made the headlines because it failed to patch. Microsoft says it is seeing cyber attacks ramping up around the Zerologon CVE-2020-1472 bug Continue Reading

By

• Alex Scroxton, Security Editor

Scam mobile apps spreading via rogue TikTok accounts

Malicious TikTok accounts are promoting a number of adware scam mobile apps Continue Reading

By

• Alex Scroxton, Security Editor

Big questions to be answered over TikTok and WeChat reprieve

TikTok and WeChat seem to have received a stay of execution, but big questions and contradictions remain Continue Reading

By

• Alex Scroxton, Security Editor

Saudi Arabia sees cyber security boom as coronavirus bites

Saudi Arabian CIOs have been forced to increase their security posture as the Covid-19 pandemic transforms working methods Continue Reading

By

• Alicia Buller

Retailers urged to get to grips with Magento as attacks spike

A huge spike in online retailers being hacked with Magecart credit card skimmers is being blamed on unsupported versions of Adobe Magento Continue Reading

By

• Alex Scroxton, Security Editor

Lorca security scaleups to get Splunk data expertise

Lorca inducts Splunk onto its co-marketing programme, giving security scaleups access to new data expertise Continue Reading

By

• Alex Scroxton, Security Editor

Risky development practice leaves company access keys exposed

Database stores, cloud storage and myriad other services are being put at risk by the accidental exposure of company access keys during development Continue Reading

By

• Alex Scroxton, Security Editor

TikTok-Oracle partnership moves forward for consideration

Joint venture proposal could create thousands of jobs and secure TikTok’s future outside China Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft drops out of TikTok talks, paves way for Oracle partnership

Microsoft confirms it is dropping out of the running to acquire the US operations of TikTok, leaving the way clear for an imminent partnership deal with Oracle Continue Reading

By

• Alex Scroxton, Security Editor

Cyber security is next frontier for open source

Open security will facilitate the interoperability and capabilities of cyber security tools while alleviating vendor lock-in for enterprises, says IBM Continue Reading

By

• Aaron Tan, TechTarget

Lorca security scaleups hit funding milestone

£153m of investment has been raised by Lorca cohort companies in just two years, almost four times the original target Continue Reading

By

• Alex Scroxton, Security Editor

September’s Patch Tuesday heavy on RCE vulnerabilities

Microsoft’s September update contains patches for 129 common vulnerabilities and exposures, including a high number of remote code execution issues Continue Reading

By

• Alex Scroxton, Security Editor

Why predictive threat intelligence is key

Threat intelligence startup Cyfirma is using virtual agents to gather intelligence on potential cyber attacks that are being coordinated in underground forums before they occur Continue Reading

By

• Aaron Tan, TechTarget

Northumbria University suffers major disruption after cyber attack

Some exams cancelled as university appoints external specialists to investigate incident Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security Think Tank: Security at the distributed edge

That datacentre security is a complex subject is not in doubt, and given the trend to move beyond centralised datacentres to distributed environments, this is not going to change. How can security professionals ensure such setups are just as secure as the traditional centralised model? Continue Reading

By

• Anup Deb, Palo Alto Networks

TikTok takes Trump to court

Under-fire video app TikTok files a formal complaint in the federal courts challenging the Trump administration’s attempt to ban it in the US Continue Reading

By

• Alex Scroxton, Security Editor

Reports Oracle to enter TikTok bidding war

Oracle may be about to make a bid to acquire the US operations of TikTok from its Chinese parent ByteDance, according to the FT Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches two zero-days with active exploits

Microsoft drops another major Patch Tuesday update, including fixes for two zero-day exploits that are already being exploited by cyber criminals Continue Reading

By

• Alex Scroxton, Security Editor

Citrix users urged to patch five XenMobile CVEs

Patches are available for CVEs 2020-8208 through 8212 and should be installed as soon as possible Continue Reading

By

• Alex Scroxton, Security Editor

Don’t believe the hype: AI is no silver bullet

We want to believe AI will revolutionise cyber security, and we’re not necessarily wrong, but it’s time for a reality check Continue Reading

By

• Mike Lloyd, RedSeal

Qualcomm chip vulnerability puts millions of phones at risk

Qualcomm has patched multiple vulnerabilities in its chip hardware that left hundreds of millions of smartphones open to compromise by malicious actors Continue Reading

By

• Alex Scroxton, Security Editor

New foundation to bolster security of open source software

The Open Source Security Foundation will bring together key open source security initiatives across the industry to improve and support the security of open source software Continue Reading

By

• Aaron Tan, TechTarget

Microsoft offers way out of TikTok impasse

Microsoft offers to buy TikTok from its Chinese parent to ease security fears in the US Continue Reading

By

• Alex Scroxton, Security Editor

Labour Party is latest victim of Blackbaud ransomware attack

Widening Blackbaud data breach ensnares the Labour Party as the cloud software firm continues to duck questions about its behaviour Continue Reading

By

• Alex Scroxton, Security Editor

Businesses underestimate negative impact of bot traffic

Research from Netacea finds that although awareness of malicious bot activity is high, many are underestimating its true impact Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus shines spotlight on cyber security

Programme committee chair of this year's RSA Conference Asia-Pacific and Japan talks up the challenges that IT security professionals in APAC are facing to mitigate security risks amid the Covid-19 pandemic Continue Reading

By

• Aaron Tan, TechTarget

Patch Tuesday: Microsoft fixes 123 bugs in July 2020 update

The bugs start coming and they don’t stop coming; Microsoft has issued yet another bumper Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Check Point unearths critical SigRed bug in Windows DNS

SigRed vulnerability is highly dangerous, but is being fixed as part of the July 2020 Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Recon vulnerability puts thousands of SAP customers at risk

Users of multiple SAP products including S4/HANA should apply the security update as soon as possible to protect their systems Continue Reading

By

• Alex Scroxton, Security Editor

Australian enterprises facing more cyber attacks

The volume of cyber attacks in Australia jumped from 90% in October 2019 and 81% in February 2019, underscoring the worsening threat landscape in the country Continue Reading

By

• Aaron Tan, TechTarget

Zoom zero-day a reminder to stop using Windows 7

Researchers have disclosed a newly discovered zero-day vulnerability to videoconferencing service Zoom, which only affects users of Windows 7 systems Continue Reading

By

• Alex Scroxton, Security Editor

More Joker malware apps chucked off Google Play Store

Infamous Joker billing fraud malware continues to sneak past Google’s security controls Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: The past and future of security automation

Artificial intelligence and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation being gravely overestimated? Continue Reading

By

• Paddy Francis

Security funding soars despite Covid-19 slump, but problems lie ahead

The overall cyber security funding ecosystem in the UK is healthier than ever despite Covid-19, but the figures mask stark and concerning disparities in where the money is going Continue Reading

By

• Alex Scroxton, Security Editor

Cyber4Summer scheme to divert young people from cyber crime

Cyber4Summer platform will offer 100 different tracks covering a range of security skills to divert them from falling into a life of cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Balancing human oversight with AI autonomy

Artificial intelligence and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation gravely overestimated? Continue Reading

By

• Richard Absalom, Information Security Forum

Lorca scale-ups bring diverse security to the fore

London Office for Rapid Cybersecurity Advancement announces the cyber security scale-ups that will make up its fifth cohort Continue Reading

By

• Alex Scroxton, Security Editor

North Korea behind spate of Magecart attacks

The Magecart credit card skimmer found on the website of retailer Claire’s Accessories was likely put there by the Lazarus or Hidden Cobra North Korean APT group, reports Sansec Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: SIEM and AI – a match made in heaven?

Artificial intelligence and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation gravely overestimated? Continue Reading

By

• Petra Wenham