IT security

Rhysida gang stole hundreds of gigabytes of British Library data

The Rhysida ransomware gang behind the cyber attack on the British Library has published almost 600GB of stolen data to its dark web leak site Continue Reading

Law enforcement dismembers major ransomware operation in Ukraine

A joint law enforcement operation between the Ukrainian authorities, Europol and Eurojust has seem five ransomware operators taken into custody Continue Reading

Scope of Okta helpdesk breach widens to impact all users

Okta has widened the scope of the October breach of its systems to include every customer that has used its helpdesk service, after new information came to light Continue Reading

Meta faces GDPR complaint over processing personal data without 'free consent'

Paid-for service means data protection is only available to those who can afford it, privacy group argues in data protection complaint Continue Reading

Scope of British Library data breach widens

Personal data on British Library users has appeared for sale on the dark web following a Rhysida ransomware attack, as the scope of the still-developing incident widens again Continue Reading

Volume of unique malware samples threatens to overwhelm defenders

A massive increase in malware volumes could cause problems for security teams tasked with adapting their defences against them Continue Reading

How passwordless authentication aids identity security

Enterprise Strategy Group's Jack Poller discusses survey results on user authentication practices and explains the security benefits of passwordless methods. Continue Reading

The Security Interviews: Zeki Turedi, field CTO Europe, CrowdStrike

Organisations are racing to keep their security up to date against the latest threats. CrowdStrike’s Zeki Turedi explains how to protect against novel and innovative cyber attacks Continue Reading

NCSC publishes landmark guidelines on AI cyber security

The NCSC and its US counterpart CISA have brought together tech companies and governments to countersign a new set of guidelines aimed at promoting a secure-by-design culture in AI development Continue Reading

DORA raises the stakes for cloud use in financial services

The EU's DORA regulations will raise the stakes for cloud in financial services but resilience is more than just a tech issue, says NetApp's Steve Rackham Continue Reading

UK police plan national roll-out of facial-recognition phone app

UK police chiefs plan to expand use of facial-recognition technology through a nationwide roll-out of mobile-based tools and increases in retrospective facial-recognition, but oversight problems persist Continue Reading

Was the devil's greatest trick making you think tech CEOs are just people?

It’s been one of those weeks where tech makes headlines for all the wrong reasons. (Sadly, the wrong reasons are often the only reasons tech makes national headlines, but anyway…) There was much ... Continue Reading

APAC organisations warm to microsegmentation

Nearly two-thirds of organisations in the APAC region see microsegmentation as a way to protect their IT assets, but lack the skills to deploy the technology Continue Reading

MOVEit incident spurred UK decision makers to spend big on cyber

The MOVEit cyber attacks that unfolded in the spring and summer of 2023 seem to have driven an increase in both ransomware awareness and spend, according to a report Continue Reading

Expereo on tap for Carlsberg to deliver connectivity in 40 countries

SD-WAN/SASE and internet provider brings brewing giant ‘unrivalled’ connectivity in global network Continue Reading

Navigating the DPDI Bill: A transformative shift ahead

The Data Protection and Digital Information (No. 2) Bill, or DPDI, is set to reshape the UK’s data protection framework. Louise Brooks of DQM GRC considers the implications Continue Reading

North Korean APTs go all in on supply chain attacks, warns NCSC

Threat actors linked to the North Korean regime are becoming more adept at targeting software supply chains in the service of their cyber attacks Continue Reading

Australia ups ante on cyber security

Australia’s new cyber security strategy will focus on building threat blocking capabilities, protecting critical infrastructure and improving the cyber workforce, among other priorities Continue Reading

An inside look at a Scattered Spider cyber attack

Threat researchers at ReliaQuest share the inside track on a Scattered Spider cyber attack they investigated Continue Reading

Palantir awarded NHS FDP data contract

NHS England has awarded a £330m, seven-year contract to US data specialist Palantir, prompting concerns from data privacy practitioners Continue Reading

CISA reveals how LockBit hacked Boeing via Citrix Bleed

As alarm grows around the world about the impact of the so-called Citrix Bleed vulnerability, Boeing has shared details of its experience at the hands of the LockBit ransomware crew Continue Reading

How do cybercriminals steal credit card information?

Cybercriminals have various methods at their disposal to hack and exploit credit card information. Learn what they are, how to prevent them and what to do when hacked. Continue Reading

Over half of SME cyber incidents now ‘malware-free’

The age of malware-driven cyber attacks may have peaked, at least when it comes to incidents affecting small and medium sized enterprises Continue Reading

Canada’s Mounties among government employees hit by LockBit

A LockBit attack on a specialist supplier of relocation services has engulfed multiple government agencies in Canada Continue Reading

The ‘application generation’ demands more from developers

The latest Cisco AppDynamics poll of consumers has identified a new breed of app user that has emerged post-pandemic Continue Reading

Why transparency and accountability are important in cyber security

If we accept that the humans who build technology and systems are naturally fallible and mistakes inevitable, and then deal with that with good grace, we could do much to improve cyber standards, writes Bugcrowd's Casey Ellis Continue Reading

Internal documents leaked as Rhysida claims responsibility for British Library ransomware attack

Ransomware group Rhysida threatens to sell documents stolen from the British Library to the highest bidder Continue Reading

Can AI take education to a new level?

In this week’s Computer Weekly, we examine how large language models are being used to teach, support and assess students, enhancing education rather than impairing it. We look at how the AI revolution is impacting the semiconductor sector as the big tech companies put off server upgrades. And we find out how generative AI is changing the way enterprise software works. Read the issue now. Continue Reading

Kingfisher develops AI-agnostic platform to power DIY assistant

The platform provides a framework for security and compliance and enables developers to test different large language models Continue Reading

Cubbit DS3 Composer brings DIY cloud to object storage pool

Cubbit customers can now build and configure S3-compatible clouds from unused capacity and offer MSP-grade services with high levels of resilience, security and data sovereignty Continue Reading

IT not ready for AI, Pure Storage survey finds

Storage, compute and networking hardware won’t cope without upgrades, and that often means total IT infrastructure overhaul Continue Reading

Defence lawyers seek appeal of tribunal ruling on police EncroChat cryptophone hack

Defence lawyers are seeking leave to appeal against a tribunal ruling that found the National Crime Agency had lawfully obtained warrants to access messages from 9,000 cryptophones used in the UK Continue Reading

Security incident response teams are human, too

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

Walmart’s enterprise software: A Computer Weekly Downtime Upload podcast

We speak to Walmart’s David Glick about the build/buy debate and how the retailer works with large language models Continue Reading

Microsoft and Meta quizzed on AI copyright

Large language models are trained using vast amounts of public data – but do the hyperscalers comply with copyright laws? Continue Reading

Royal Mail spent £10m on cyber measures after LockBit attack

Royal Mail has spent approximately £10m on recovery and improved cyber resilience measures in the wake of the January 2023 LockBit ransomware attack Continue Reading

Custom chatbots and model gardens: putting Private AI to work

Part 2: More to think about It’s essential to decide where to run your Private AI - or who you will get to run it for you, in some cases - but that is just the start. Assuming that you also want ... Continue Reading

Outgoing police tech watchdog warns of declining oversight

The outgoing biometrics and surveillance camera commissioner for England and Wales discusses police deployment of powerful new surveillance technologies, and the declining state of oversight in this area Continue Reading

Ransomware gang grasses up uncooperative victim to US regulator

The ALPHV/BlackCat ransomware gang has added a new tactic to its playbook, going to ever more extreme lengths in search of a pay-off Continue Reading

British Library’s Halloween cyber scare was ransomware

The British Library has provided an update on an ongoing cyber incident affecting its systems, confirming it to be the result of a ransomware attack Continue Reading

Understanding the rise and role of Private AI

Part 1: AI hype vs fear and doubt The leakage of proprietary IP and other data has been one of the biggest corporate fears around generative AI since the launch of ChatGPT. Some companies even ... Continue Reading

BlackCat affiliate seen using malvertising to spread ransomware

Researchers at eSentire identified a wave activity from an ALPHV/BlackCat ransomware affiliate which has adopted a somewhat unusual approach to delivering its locker Continue Reading

Russian cyber criminal pleads guilty to running IPStorm botnet

Sergey Manikin faces years in jail after his illicit proxy botnet service was taken down by US law enforcement Continue Reading

November Patch Tuesday heralds five new MS zero-days

Microsoft pushes fixes for five new zero-days in its latest monthly update Continue Reading

US government reinforces ICBC hack link to Citrix Bleed

US Treasury adds weight to reports that a ransomware gang gained access to the systems of Chinese bank ICBC by exploiting a critical Citrix flaw Continue Reading

How Gigamon is making its mark in deep observability

Gigamon CEO Shane Buckley talks up the company’s ability to inspect encrypted network traffic for malicious activity, how it stands out with its deep observability capabilities and the tailwinds that are fuelling its growth Continue Reading

Fast-acting cyber gangs increasingly disabling telemetry logs

Sophos guidance for security practitioners and defenders highlights a growing trend for threat actors to disable or wipe telemetry logs to cover their tracks Continue Reading

The UK AI Safety Summit – what did it achieve?

In this week’s Computer Weekly, we look back at the UK government’s AI Safety Summit and assess what it achieved – and what it didn’t. Our latest buyer’s guide examines the future of business software and modernising legacy applications. And we find out how the UK Product Security and Telecommunications Infrastructure Act aims to protect your smart devices. Read the issue now. Continue Reading

Rogue state-aligned actors are most critical cyber threat to UK

The prospect of rogue nation-state-aligned attackers bringing down the UK’s critical infrastructure is keeping the NCSC up at night Continue Reading

Lloyds Bank warns over rising threat of crypto scams

Report by Lloyds Banking Group finds there has been a 23% increase in cryptocurrency scams in 2023 compared with last year, targeting mostly younger investors Continue Reading

Encrypted mail service Tuta says it was wrongly accused of being a front for intelligence services

German encrypted email service Tuta, formerly known as Tutanota, has denied claims by a former Canadian police intelligence officer accused of passing secrets to criminals that it was compromised by intelligence services Continue Reading

Victims’ legal action over 2015 Carphone Warehouse breach moves forward

A class action against Currys Retail over the 2015 data breach of Carphone Warehouse customers has been granted permission to move forward in the courts Continue Reading

ICO alerted after technical ‘issue’ exposed college files to student barristers

A training college for barristers has reported a data breach that left sensitive data on hundreds of current and former students accessible to other trainees Continue Reading

Breached? Don't panic… if you created a robust IR plan

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

UN disarmament body calls for global action on autonomous weapons

UN draft resolution highlighting the dangers of autonomous weapons passes with overwhelming majority Continue Reading

How the Online Safety Act will impact businesses beyond Big Tech 

The Online Safety Act will impact an estimated 100,000 online services in the UK and overseas Continue Reading

Ransomware attack on major Chinese lender disrupts financial markets

The financial services arm of one of the world’s largest banks was taken offline by a supposed LockBit ransomware attack, causing problems for US markets Continue Reading

APAC cyber security workforce hits record high

The cyber security workforce in Asia-Pacific now stands at just under a million people, but demand for cyber security talent in the region continues to outpace supply Continue Reading

Revealed: How Russia’s Sandworm ramped up attacks on Ukraine’s critical infrastructure

New Mandiant intelligence reveals how the APT known as Sandworm has been evolving its playbook, twisting legitimate executables known as LoLBins into malicious tools as it seeks to disrupt daily life in Ukraine Continue Reading

The best IR plans are well-revised and deeply familiar

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

NCSC makes annual Black Friday plea to consumers

Ahead of the annual festival of retail avarice, the NCSC is once again asking consumers to do the bare minimum to avoid falling victim to scams Continue Reading

Suspected ransomware attack hits Scottish council

Systems at Comhairle nan Eilean Siar were downed on 7 November in a suspected ransomware attack Continue Reading

UK government does not see need for specific AI legislation

The UK government does not currently see the need for new artificial intelligence legislation, as many regulators are already dealing effectively with AI-related harms Continue Reading

The Security Interviews: Why cyber needs to integrate better

Cyber security is an intensely technical field, but we shouldn’t ignore the soft skills of communication and collaboration. Wipro’s Tony Buffomante explains why a robust security posture is dependent on a security team engaging with the wider organisation Continue Reading

Why IT governance is a coding issue

Two new pieces of research point to benefits of policy as code Continue Reading

Heineken lets the data flow

In this month’s CW EMEA ezine, we find out about Heineken’s mission to make the most out of the data it holds through an enterprise-wide data ecosystem. We also look at how the UK has turned its back on the German government-funded Gaia-X data platform, why cyber experts are urging the EU to rethink vulnerability disclosure plans, and how the IT industry is responding to the software developer skills shortfall. Read the issue now. Continue Reading

Data-sharing management gap highlights cyber risk, says report

Organisations are struggling to secure their use of communications tools to share data with third-party partners and suppliers, and in the process are exposing themselves to heightened levels of risk, according to a report Continue Reading

The plan for the inevitable cyber attack: Get the gist of NIST

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

Iconic Singapore hotel caught up in major data breach

The Marina Bay Sands resort in Singapore uncovered a data breach of its guest loyalty programme last month Continue Reading

King’s Speech misses the mark on cyber law reform, says campaign

A group of activists who want to reform the UK’s computer misuse laws to protect bona fide cyber pros from prosecution have been left disappointed by a lack of legislative progress Continue Reading

The Security Interviews: ISC2’s Clar Rosso on cyber diversity and policy

Computer Weekly catches up with ISC2 CEO Clar Rosso to talk about diversifying the cyber workforce and supporting cyber pros as they keep up with growing compliance and security policy demands Continue Reading

Researchers ‘break’ rule designed to guard against Barracuda vulnerability

Vectra AI researchers found that a Suricata rule designed to detect exploitation of a dangerous Barracuda Email Security Gateway flaw was not entirely effective Continue Reading

Enhancing security: The crucial role of incident response plans

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

Unesco unveils seven-point anti-disinformation plan

United Nations body outlines seven proposals for civil society, governments, regulators and tech platforms to adopt to combat the source of disinformation Continue Reading

AI Safety Summit review

Computer Weekly takes stock of the UK government’s AI Safety Summit and the differing perspectives around its success Continue Reading

How ExxonMobil is leading with data

In this week’s Computer Weekly, we talk to the leader of ExxonMobil’s data organisation, about the energy giant’s strategy to establish enterprise-wide principles for the use of data. As the UK’s Online Safety Act comes into force, we examine the tech sector’s concerns over the laws around end-to-end encryption. And we look at the software tools available to HR teams to help improve staff retention. Read the issue now. Continue Reading

IR plans: The difference between disaster and recovery

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

Shadow IT use at Okta behind series of damaging breaches

Okta now believes the initial access vector in a series of damaging breaches was one of its own employees who used a corporate device to sign into their personal Google account Continue Reading

How Trellix’s CISO keeps threat actors at bay

Trellix’s chief information security officer, Harold Rivas, outlines how the company mitigates security threats through containment and by helping security analysts to respond faster to cyber incidents Continue Reading

Tech firms flag risk to end-to-end encryption as Online Safety Bill gets royal assent

Technology organisations remain concerned that the newly implemented Online Safety Act could undermine end-to-end encryption, despite government reassurances that it will ensure online safety. Continue Reading

SolarWinds hack explained: Everything you need to know

Hackers targeted SolarWinds by deploying malicious code into its Orion IT monitoring and management software used by thousands of enterprises and government agencies worldwide. Continue Reading

Incident response planning requires constant testing

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

Admins told to take action over F5 Big-IP platform flaws

Two vulnerabilities in the widely used F5 Networks Big-IP platform are now being exploited in the wild Continue Reading

UK workers exhibit poor security behaviours, report reveals

Report by KnowBe4 has found that four in five UK workers do not make security-conscious choices, whether in-office, remote or hybrid working Continue Reading

Use existing structures to build your incident response plan

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

How the UK crime agency repurposed Amazon cloud platform to analyse EncroChat cryptophone data

UK crime agency repurposed AWS-based analytics platform to triage EncroChat data and identify threats to life in messages sent on encrypted phone network Continue Reading

EU digital ID reforms should be ‘actively resisted’, say experts

Over 300 cyber security experts have called for the EU to rethink its proposals for eIDAS digital identity reforms, saying some of the provisions risk damaging user privacy and security Continue Reading

Incident response planning is vulnerable to legacy thinking

What goes into a good incident response plan, and what steps should security professionals take to ensure they are appropriately prepared for the almost inevitable attack, and secure buy-in from organisational leadership? Continue Reading

Lloyds bank kicks off Hyderabad operation

Lloyds Banking Group has opened its latest tech operation in Hyderabad, with plans to recruit around 600 IT experts Continue Reading

Darktrace CEO Poppy Gustafsson on her AI Safety Summit goals

As the AI Safety Summit at Bletchley Park takes place, Computer Weekly caught up with Darktrace CEO Poppy Gustafsson to find out what one of the UK’s most prominent AI advocates wants from proceedings Continue Reading

British Library falls victim to cyber attack

The British Library is experiencing a major IT outage following a cyber incident of an undisclosed nature Continue Reading

Biden’s AI plans focus on US workers’ protection

The US president has issued an Executive Order that sets out his administration’s strategy for AI safety and security Continue Reading

SEC sues SolarWinds, alleging serious security failures

SolarWinds and its CISO have been charged with fraud and internal control failures by the US authorities amid allegations of a series of cyber security failings leading up to the 2020 Sunburst attacks Continue Reading

The implications of biased AI models on the financial services industry

The Bank of England has warned of the risk artificial intelligence models present in creating bias that could pose a threat to the UK’s financial services sector. How do those risks emerge and how they might be mitigated?   Continue Reading

Frontier AI Taskforce starts recruitment drive

The second progress report from the Frontier AI Taskforce reveals new hires plus vacancy posts for software and research engineers Continue Reading

FDM Group partners with ISACA to boost cyber training programme

The FDM Group has announced a partnership with ISACA to help develop and boost their cyber training programmes and credentials Continue Reading

Reported major cyberattacks are falling – but watch out for the massive threats posed by gen AI

 The number of reported major cyberattacks is falling. Are we just getting used to them? Continue Reading

Greek data watchdog to rule on AI systems in refugee camps

A forthcoming decision on the compliance of surveillance and security systems in Greek refugee camps could set a precedent for how AI and biometric systems are deployed for ‘migration management’ in Europe Continue Reading

Tech firms cite risk to end-to-end encryption as Online Safety Bill gets royal assent

Tech firms continue to be concerned that the Online Safety Bill could undermine end-to-end encryption despite government reassurances Continue Reading

Domestic abuse charities surface fresh worries over NHS data sharing

With new NHS data access options coming into effect at the end of October, a group of campaigners including womens' charities and the BMA have warned that the revived GP-patient data sharing scheme risks putting vulnerable people at risk Continue Reading