Hackers and cybercrime prevention

NCSC CEO: Why we should run towards crises to elevate cyber security

National Cyber Security Centre CEO Lindy Cameron, the 2022 Computer Weekly UKtech50 Most Influential Person in UK IT, reflects on a career immersed in crisis management, and how she is using this to elevate cyber security standards across the country Continue Reading

By

• Alex Scroxton, Security Editor

How to get the right level of cyber insurance

In this week’s Computer Weekly, we look at how the market for cyber insurance is evolving and how to avoid buying the wrong level of cover. We find out what role hydrogen technologies could play in reducing datacentre carbon emissions. And we hear how a 125-year-old bicycle maker is embracing digital innovation. Read the issue now. Continue Reading

MPs call for ban on Chinese surveillance camera technology

Nearly 70 MPs have called on the government to ban Chinese camera technology that is widely used by UK government agencies despite links to human rights abuses in China Continue Reading

By

• Bill Goodwin, Computer Weekly

Assange appeals against Priti Patel’s extradition order

WikiLeaks founder is expected to raise concerns over the political nature of his prosecution, the likelihood of him receiving a fair trial, and the risk of a coercive plea bargain Continue Reading

By

• Bill Goodwin, Computer Weekly

Cyber insurance: What does a CISO need to know?

We look at how the market for cyber insurance is evolving and how IT security chiefs can avoid buying the wrong level of cover Continue Reading

By

• Stephen Pritchard

New cyber extortion op appears to have hit AMD

Semiconductor specialist AMD has confirmed it is investigating reports that a ‘bad actor’ has stolen hundreds of gigabytes of its data Continue Reading

By

• Alex Scroxton, Security Editor

Romance scammers exploit Ukraine war in cynical campaign

Romance scammers can make easy money exploiting people looking for love, but in this newly observed campaign linked to the Ukraine war they are playing on deeper emotions Continue Reading

By

• Alex Scroxton, Security Editor

Avast uncovers ‘thieves’ kitchen’ of malware-writing teens

Researchers stumble across online community of 11 to 18-year-olds constructing, exchanging and spreading malware Continue Reading

By

• Alex Scroxton, Security Editor

Russia-aligned hacktivists behind Lithuania DDoS attack

Killnet hacktivist collective targeted Lithuania with distributed denial of service attacks after its government angered the Kremlin Continue Reading

By

• Alex Scroxton, Security Editor

Collaboration key to IT sector sustainability

In this week’s Computer Weekly, as sustainability rises up the corporate agenda, IT leaders say more collaboration is needed to meet climate goals. Microsoft faces further calls for greater transparency over software tools used to monitor employees. And the cyber security industry warns over an increasing loss of talent. Read the issue now. Continue Reading

Commercial cyber products must be used responsibly, says NCSC CEO

NCSC’s Lindy Cameron is to speak out on responsible regulation of cyber capabilities at an event in Tel Aviv, Israel Continue Reading

By

• Alex Scroxton, Security Editor

LockBit ransomware gang launches bug bounty programme

A bug bounty programme is among a number of features LockBit’s developers have added to ‘version 3.0’ of the ransomware Continue Reading

By

• Alex Scroxton, Security Editor

The cyber security impact of Operation Russia by Anonymous

The campaign against the Russian government by Anonymous surprised many with the depth and scale of the cyber attacks. What can we learn from this online war? Continue Reading

By

• Peter Ray Allison

CW APAC: Tech career guide to cyber security

The demands placed on those fighting against hackers are constantly evolving. In this handbook, focused on cyber security in the Asia-Pacific region, Computer Weekly looks at the skills required to make it in the industry, how Singapore’s critical systems remain protected, the short-term options for tech stack management and how organisations can support cyber professionals’ mental health. Continue Reading

Black Basta ransomware crew aiming for ‘big leagues’

Emergent Black Basta ransomware gang has hit more than 50 countries since bursting onto the scene earlier this year, says Cybereason Continue Reading

By

• Alex Scroxton, Security Editor

Assessment and knowledge: Your key tools to secure suppliers

There is no silver bullet that will resolve all the issues arising from today’s interconnected businesses and complex supply chains, but there are some key tools at your disposal Continue Reading

By

• Andrew Morris, Turnkey Consulting

Developers grapple with open source software security

Software developers are taking longer to fix vulnerabilities and many do not know about the dependencies of open source software components they are using, study finds Continue Reading

By

• Aaron Tan, Informa TechTarget

Ukraine cyber agency enlists Radware to protect government networks

Ukraine’s State Service of Special Communications and Information Protection is using Radware cloud DDoS protection and web application firewall services to protect the government from persistent Russian attacks Continue Reading

By

• Alex Scroxton, Security Editor

What the world can learn from Saudi Arabia’s fight against industrial control system attacks

Iran learned from attacks on its infrastructure and unleashed similar malware on Saudi Arabia. The world has now gained valuable lessons from the Saudi response Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Security Think Tank: Supply chain security demands systematic approach

Supply chain security measures need to be systematic and assessed so as to minimise the complexity and cost to the business Continue Reading

By

• Paddy Francis

How TDCX is building a people-centric business

Every digital tool deployed by the Singapore-based services firm is aimed at augmenting the performance and experience of its employees, says TDCX’s group CIO, Byron Fernandez Continue Reading

By

• Aaron Tan, Informa TechTarget

Security Think Tank: Balanced approach can detangle supply chain complexity

Achieving an appropriate balance between people, processes and technology can help to detangle the complexities of the supply chain and create better security practices Continue Reading

By

• Francesca Williamson, Information Security Forum

CNI leaders’ attitude to ransomware lackadaisical at best

A survey of security decision-makers in sectors regarded as critical national infrastructure reveals a disappointing attitude to ransomware threats Continue Reading

By

• Alex Scroxton, Security Editor

Lords move to protect cyber researchers from prosecution

A cross-party group in the House of Lords has proposed an amendment to the Product Security and Telecommunications Infrastructure Bill that would address concerns about security researchers or ethical hackers being prosecuted in the course of their work Continue Reading

By

• Alex Scroxton, Security Editor

Complex Russian cyber threat requires we go back to basics

The situation in Russia is anything but simple, but it is the fundamentals of cyber security hygiene that pose the best defence against the country’s digital threat, as Mandiant’s Jamie Collier explains Continue Reading

By

• Matthew Staff

Aussie mobile users most vulnerable to security threats

Australia has the highest percentage of mobile app threats detected on a per-device basis, with iPhone users more likely to download a risky app than an Android user, study finds Continue Reading

By

• Aaron Tan, Informa TechTarget

TalkTalk hacker Daniel Kelley gives up his black hat for good

After serving a four-year prison sentence for his role in the 2015 TalkTalk hack and other cyber offences, Daniel Kelley now wants to pursue a legitimate cyber security career Continue Reading

By

• Nicholas Fearn

Dundee security research centre opens with support from SBRC

An £18m hub at Abertay University in Dundee forms the centrepiece of Scotland’s first security research cluster Continue Reading

By

• Alex Scroxton, Security Editor

Office 365 loophole may give ransomware an easy shot at your files

Researchers at Proofpoint have discovered potentially dangerous Microsoft Office 365 functionality that they believe may give ransomware a clear shot at files stored on SharePoint and OneDrive Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Best practices for boosting supply chain security

In a highly connected world, managing the supply chain landscape requires an adaptation of the ‘traditional’ approach to managing cyber risk Continue Reading

By

• Carl Nightingale

Interpol arrests thousands in global cyber fraud crackdown

A two-month operation saw law enforcement agencies in 76 countries crack down on organised cyber fraud Continue Reading

By

• Alex Scroxton, Security Editor

$2k to access your organisation on the dark web

Dark web brokers will sell access to company networks and systems for an average of $2,000 to $4,000 Continue Reading

By

• Alex Scroxton, Security Editor

UK, US prepare to launch PET project

A transatlantic prize challenge to accelerate development of privacy-enhancing technologies is set to begin Continue Reading

By

• Alex Scroxton, Security Editor

Government recommits to UK’s cyber future in Digital Strategy

New strategy leans heavily on cyber security but stops short of announcing any initiatives that have not already been launched or heavily trailed Continue Reading

By

• Alex Scroxton, Security Editor

New warning over tech suppliers in thrall to hostile governments

Ukraine war could lead to shakeup of dual-use tech exports, says former UK intelligence officer Continue Reading

By

• Joe Fay

Qatar bolsters cyber security in preparation for World Cup

With hackers honing their cyber weapons to target the upcoming football World Cup, Qatar is busy developing countermeasures and raising awareness Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Snake Keylogger climbing malware charts, says Check Point

Cyber criminals behind Snake Keylogger campaigns have been switching up their tactics in the past few weeks, say researchers Continue Reading

By

• Alex Scroxton, Security Editor

Researchers find eight CVEs in single building access system

A series of eight vulnerabilities in Carrier LenelS2 building access panels could enable malicious actors to obtain physical access to their targets Continue Reading

By

• Alex Scroxton, Security Editor

SolarWinds CEO offers to commit staffers to government cyber agencies

A new proposal from SolarWinds’ outspoken CEO, Sudhakar Ramakrishna, could see software companies commit key staff to work with government cyber agencies to improve cooperation and incident response Continue Reading

By

• Alex Scroxton, Security Editor

Cyber researchers step in to fill Patch Tuesday’s shoes

Afraid you’ll miss Patch Tuesday when it’s gone? You’re not alone, but security analysts at Recorded Future are taking action to help the community come to terms with its loss Continue Reading

By

• Alex Scroxton, Security Editor

CW Europe: Russia escalates cyber war on Ukraine

Microsoft has given details of cyber attacks on Ukrainian civilian communications, nuclear safety authorities, and the exploitation of the destruction of Mariupol in a phishing campaign. Also read about a report on the European Artificial Intelligence Act that suggests a limited ban on predictive policing systems. Continue Reading

Russia plumbs new depths in cyber war on Ukraine

 Continue Reading

China using top consumer routers to hack Western comms networks

An advisory from US cyber authorities shares details of multiple vulnerabilities exploited by Chinese state actors to hack into Western telecoms networks Continue Reading

By

• Alex Scroxton, Security Editor

ProxyLogon, ProxyShell may have driven increase in dwell times

The median network intruder dwell time was up 36% to 15 days last year, thanks to massive exploitation of the ProxyLogon and ProxyShell vulnerabilities by IABs, according to new Sophos data Continue Reading

By

• Alex Scroxton, Security Editor

Weak IT and SecOps collaboration in ANZ opens doors to cyber attacks

The weak collaboration between IT and security teams in Australia and New Zealand is exposing their organisations to data loss, business disruption and other potential consequences of cyber attacks Continue Reading

By

• Aaron Tan, Informa TechTarget

APAC buyer’s guide to backup and recovery software

In this buyer’s guide, learn more about the market for backup and recovery software and key data protection capabilities to look for Continue Reading

By

• Aaron Tan, Informa TechTarget

EU must stand ground on cyber security, says Finland’s WithSecure

Russian threat is serving to focus minds on cyber security across Europe, say executives at enterprise security company’s inaugural conference Continue Reading

By

• Joe Fay

The importance of making information security more accessible

Robin Smith, CSO of Aston Martin Lagonda, talks about how an accessible approach to cyber is helping him to keep the organisation secure Continue Reading

By

• Robin Smith, chief security officer, Aston Martin Lagonda

Researchers discover zero-day Microsoft vulnerability in Office

Malicious Word documents have been used to invoke a previously undisclosed vulnerability in Microsoft Office without user interaction through Windows utility functions Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Attack of the clones: the rise of identity theft on social media

The proliferation of social media has resulted in the rise of identity theft on these platforms, with accounts copied for fraudulent or malicious purposes. What can be done to mitigate it? Continue Reading

By

• Peter Ray Allison

Industrial systems not safe for the future, say Dutch ethical hackers

Ethical hackers in the Netherlands say operational technology and IT networks need to be integrated to prevent cyber attacks penetrating their operations Continue Reading

By

• Kim Loohuis

Trial and error – why the law on computer evidence must change

In this week’s Computer Weekly, the Post Office IT scandal highlighted the problem with computer evidence – we examine the need for legal reform. We assess the nuclear option for sustainable datacentre power. And we find out how IT experts can improve their soft skills and boost their career prospects as a result. Read the issue now. Continue Reading

Log4Shell: How friendly hackers rose to the challenge

HackerOne CISO Chris Evans looks back at how the security community successfully rose to the challenge of Log4Shell, and saved end-user organisations millions Continue Reading

By

• Chris Evans, CISO and chief hacking officer, HackerOne

Two-thirds of UK organisations defrauded since start of pandemic

Nearly two out of three UK companies say they have experienced some form of fraud or economic crime in the past two years, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Most CFOs being left out of ransomware conversations

Barely a tenth of CFOs are actively involved in planning for cyber attacks, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

New inquiry looks at the state of UK chips

Foreign Affairs Committee is fishing for evidence in a new inquiry assessing skills, security and end-to-end semiconductor supply chain concerns Continue Reading

By

• Cliff Saran, Managing Editor

Rubrik charts data security path

Backup and recovery software provider Rubrik now sees itself as a cyber security company that helps organisations recover from ransomware and other data security threats Continue Reading

By

• Aaron Tan, Informa TechTarget

Ransomware volumes grew faster than ever in 2021

Verizon’s annual DBIR assessment of the security landscape highlights an unprecedented boom in ransomware volumes, to the surprise of nobody Continue Reading

By

• Alex Scroxton, Security Editor

Bad bots make up a quarter of APAC’s web traffic

Bots that run automated tasks have been responsible for stealing personal information among other malicious activities in the Asia-Pacific region, study finds Continue Reading

By

• Aaron Tan, Informa TechTarget

Need a CISO? No need to look for that tech boffin

This is a guest post by Yvette Lejins, resident CISO at Proofpoint Asia-Pacific and Japan The role of the CISO (chief information security officer) has become increasingly important as more ... Continue Reading

By

• Aaron Tan, Informa TechTarget

Did the Conti ransomware crew orchestrate its own demise?

Analysts examining the shutdown of the Conti ransomware syndicate suggest the cyber crime collective orchestrated its own demise Continue Reading

By

• Alex Scroxton, Security Editor

How Ivanti views patch management with a security lens

Bringing development, operations and security teams together will help organisations to improve their visibility of IT assets and vulnerabilities while keeping threat actors at bay Continue Reading

By

• Aaron Tan, Informa TechTarget

Applying international law to cyber will be a tall order

Many in the security community have voiced their support for the UK government’s ambitions to work towards agreement with other countries on the application of international law to cyber space, but not without some reservations Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft drops emergency patch after Patch Tuesday screw up

Microsoft fixed a certificate mapping issue that caused server authentication failures on domain controllers for users that had installed the most recent Patch Tuesday updates Continue Reading

By

• Alex Scroxton, Security Editor

Chinese cyber spooks exploit western sanctions on Russia

The actor behind an ongoing Chinese espionage campaign targeting Russian defence research bodies is taking advantage of the Ukraine war in their phishing lures Continue Reading

Defensive cyber attacks may be justified, says attorney general

Speaking ahead of a speech at the Chatham House think tank, the UK’s attorney general has suggested defensive cyber attacks against hostile countries may be legally justifiable Continue Reading

By

• Alex Scroxton, Security Editor

Top cyber criminal earnings outpace those of business leaders

Cyber crime can pay significantly better than leading a FTSE 100 organisation, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Nature of cyber war evolving in real time, says Microsoft president

The past three months have seen the rapid evolution of the very nature warfare to incorporate cyber attacks, Microsoft’s Brad Smith tells the audience at its Envision conference in London Continue Reading

By

• Alex Scroxton, Security Editor

Red teaming will be standard in Dutch governmental organisations by 2025

The Dutch government wants to include the testing of the digital security of systems, processes and people – also known as red teaming – in all of its governmental organisations’ test planning and budgeting by 2025 at the latest Continue Reading

By

• Kim Loohuis

Security Think Tank: Yes, zero trust can help you understand attack paths

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Paul Holland, Information Security Forum

Singapore opens security testing centre

Joint centre set up by the Cyber Security Agency of Singapore and a local university will facilitate security testing and train security evaluation talent Continue Reading

By

• Aaron Tan, Informa TechTarget

Mastercard biometric programme will allow payment authentication by smile

Mastercard is inviting banks and merchants to join a programme to set standards for biometric payments technology Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Veeam outlines data protection vision

Veeam is looking to achieve an “outsized market leading position” by tapping its strengths in data protection and doubling down on innovation to help enterprises secure emerging workloads Continue Reading

By

• Aaron Tan, Informa TechTarget

Australian CISOs least prepared for cyber attacks

Australian CISOs are under pressure and feel the least prepared globally to deal with the consequences of a cyber attack, study finds Continue Reading

By

• Aaron Tan, Informa TechTarget

The limits and risks of backup as ransomware protection

Backups can provide a sound means of recovery from ransomware infection, but they are not 100% certain to foil attackers. We look at the limits and risks of depending on backups Continue Reading

By

• Stephen Pritchard

APAC career guide: Becoming a cyber security pro

The region’s burgeoning cyber security industry has attracted more talent last year, but it takes more than just technical knowhow to succeed in the field Continue Reading

By

• Aaron Tan, Informa TechTarget

Nerbian RAT enjoys using Covid-19 phishing lures

The world is slowly coming to terms with Covid-19, but fear of the coronavirus is no less useful to cyber criminals because of it, as Proofpoint researchers have discovered Continue Reading

By

• Alex Scroxton, Security Editor

Emotet has commanding lead on Check Point monthly threat chart

Emotet remains by some margin the most prevalent malware, according to Check Point’s latest monthly statistics Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: Five Eyes focuses on MSP security

The western intelligence community has set out practical steps IT service providers and their customers can take to protect themselves Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: Data-sharing service to protect public from scams

A new data-sharing service set up by the NCSC and industry partners will give ISPs access to real-time threat data that they can use to block fraudulent websites Continue Reading

By

• Alex Scroxton, Security Editor

Analysts confirm return of REvil ransomware gang

Secureworks CTU analysis has found that the REvil ransomware is undergoing active development, possibly heralding a new campaign of cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Cyber accreditation body Crest forges new training partnerships

Crest says partnerships with Hack The Box and Immersive Labs will enhance its members’ defensive and offensive security skills Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: Cyber leaders affirm UK’s whole-of-society strategy

On the opening day of CyberUK 2022, GCHQ director Jeremy Fleming and NCSC CEO Lindy Cameron have spoken of their commitment to the government’s ambition for a whole-of-society cyber strategy Continue Reading

By

• Alex Scroxton, Security Editor

NCSC pins Viasat cyber attack on Russia

UK authorities have attributed the 24 February cyber attack on the network of satellite comms company Viasat to Russia Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: NCSC refreshes cloud security guidance

The National Cyber Security Centre is revising its cloud guidance as increasing uptake of potentially vulnerable cloud services puts more organisations at risk of compromise Continue Reading

By

• Alex Scroxton, Security Editor

NSO Group faces court action after Pegasus spyware used against targets in UK

Three human rights activists whose phones were targeted by spyware traced to Saudi Arabia and the United Arab Emirates have begun legal action against both countries and Israel’s NSO Group Technologies Continue Reading

The spies who hack you – the growing threat of spyware

In this week’s Computer Weekly, after 10 Downing Street was hit by a spyware attack, fears about targeted mobile phone hacks are increasing. Our salary survey highlights the diversity challenge in IT, with men’s support for women in IT declining. And we look at how datacentre heat reuse can help reduce carbon emissions. Read the issue now. Continue Reading

CyberUK 22: NCSC’s ACD programme blocks 2.7 million scams

On the opening day of its annual CyberUK event, the NCSC reveals how organisations around the country have used its Active Cyber Defence programme to their advantage Continue Reading

By

• Alex Scroxton, Security Editor

parameter tampering

Parameter tampering is a type of web-based cyber attack in which certain parameters in a URL are changed without a user's authorization. Continue Reading

By

• Rahul Awati

IT infrastructure used to launch DDoS attack on Russian targets

Organisations could unwittingly be participating in hostile activity against the Russian government as compromised IT infrastructure is used without their knowledge to launch denial of service attacks Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Five companies join NCSC for Startups to deal with ransomware

The NCSC has invited five startups to join the NCSC for Startups programme to develop tech that can help deal with the threat of ransomware Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Security Think Tank: Identify, assess and monitor to understand attack paths

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Rob McElvanney

NHS email accounts hijacked for phishing campaign

Microsoft credentials targeted in phishing operation using hijacked NHSMail accounts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Intellectual property theft operation attributed to Winnti group

Winnti conducted a prolonged cyber espionage campaign that went undetected for years, allowing it to exfiltrate massive amounts of corporate data and intellectual property Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

PeerGFS to add AI/ML anomaly detection to distributed file system product

Peer will add AI/ML-based anomaly detection as it ramps up security protection in its PeerGFS distributed file management software, with Linux server support also to come in 2022 Continue Reading

By

• Antony Adshead, Storage Editor

Five TLS comms vulnerabilities hit Aruba, Avaya switching kit

Five new vulnerabilities in the implementation of transport layer security communications leave several popular switches vulnerable to remote code execution Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Information security in 2022 – managing constant change

It’s been an unprecedented couple of years for everyone – but a particularly frantic one for cyber security leaders. The pandemic led to a huge rise in remote working, with all the extra risks involved in putting users outside the corporate perimeter. The home environment then became a new attack vector, and as a result there was a huge increase in ransomware, affecting individuals and enterprises. And then, just as lockdowns started to ease, Russia’s invasion of Ukraine brought new nation-state threats that may yet become even more serious. For chief information security officers (CISOs), managing constant change and emerging threats is becoming the norm. In this essential guide to information security in 2022, we examine the key strategies, latest innovations and leadership insights – and highlight the importance of collaboration across the cyber community to keep everyone secure. Continue Reading

Attackers enlist cloud providers in large HTTPS DDoS hit

A recent large-scale DDoS incident shows how cyber criminals are switching up their tactics to conduct more sophisticated attacks Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware recovery costs dwarf actual ransoms

The cost of recovering from a ransomware attack far outweighs the ransoms now being demanded by cyber criminals, according to recent data Continue Reading

By

• Alex Scroxton, Security Editor

Manufacturer sues JPMorgan after cyber criminals stole $272m

Manufacturer files lawsuit alleging that US bank failed to inform it of suspicious transaction activity Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA