IT security

How to combat advanced persistent threats: APT strategies to protect your organisation

Simple defence strategies will go a long way to preparing businesses for APTs Continue Reading

By

• Warwick Ashford, Senior analyst

Demystifying IT Rules 2011: What it means for you

The first of a two-part series on the IT Rules 2011 notification under IT Act 2000, looking into its stipulations and their implications for businesses. Continue Reading

By

• Varun Haran, Reporter

Chinese software flaw makes infrastructure vulnerable, warns report

China's public infrastructure is vulnerable to cyber attack because of vulnerabilities in software used to run weapons systems, utilities and chemical plants, according to Reuters. Continue Reading

By

• Warwick Ashford

NHS pays £200m advance to CSC as contract renegotiation nears conclusion

The NHS has paid £200m to troubled supplier CSC as an advance while awaiting the conclusion of discussions on amendments to the controversial deal. Continue Reading

By

• Bryan Glick, Editor in chief

Leveraging ISO 27005 standard’s risk assessment capabilities

In this first of a series of articles on risk assessment standards, we look at the latest in the ISO stable; ISO 27005’s risk assessment capabilities. Continue Reading

By

• Dharshan Shanthamurthy

Government to create market for personal identity data

The government is preparing to create a marketplace for citizens' personal data to be used for accessing online public services, according to documents that were issued to industry in preparation for the coalition's next-generation identity scheme. Continue Reading

By

• Mark Ballard

Busy Patch Tuesday sees 16 Microsoft fixes coincide with Adobe security update release

IT administrators will find their hands full this month with Microsoft planning 16 security updates to fix 34 vulnerabilities on the same day as security updates from Adobe. Continue Reading

By

• Warwick Ashford, Senior analyst

Former T-Mobile employees ordered to pay nearly £80,000 for data theft

The Chester Crown Court has ordered two former employees of UK mobile operator T-Mobile to pay a total of £73,700 after stealing and selling customer data from the company in 2008. Continue Reading

By

• Warwick Ashford, Senior analyst

Nessus Android application extends vulnerability scanner’s mobile reach

Free Android app for Nessus Vulnerability scanner released by developers, Tenable Network Security Inc; extends Nessus’s existing support for iOS devices. Continue Reading

By

• SearchSecurity.in Staff

Adobe patches Flash to fix zero-day XSS vulnerability

‘Important’ cross-site scripting vulnerability in Flash Player on all platforms mitigated to combat zero-day attacks in the wild. Continue Reading

By

• SearchSecurity.IN Staff

UK government to propose national website blocking list

The UK government is considering setting up a national blocking list of violent and unlawful websites in plans to tackle radicalisation to be unveiled by Home Secretary Theresa May. Continue Reading

By

• Warwick Ashford, Senior analyst

Hacker group Anonymous steals 10,000 Iranian government e-mails

Hacking group Anonymous has hacked into Iranian government servers and stolen more than 10,000 e-mail messages from the Ministry of Foreign Affairs, say US reports. Continue Reading

By

• Warwick Ashford, Senior analyst

E-mail accounts of senior US officials targeted in Chinese hack attack

Chinese hackers have accessed the accounts of hundreds of Gmail users, including senior US officials, Chinese political activists, military personnel, journalists and officials in several Asian countries, Google has said. Continue Reading

By

• Kathleen Hall, TechTarget

World IPv6 Day coming June 8 - what should you be doing?

On 8 June, 2011, a number of large networks will offer their content over IPv6 for a 24-hour “test flight”. Continue Reading

By

• Stephen Gillies, Editor

Four handy botnet detection techniques and tools: A tutorial

This tutorial will help you determine the right techniques and tools for effective botnet detection. Continue Reading

By

• Karthik R, Contributor

Case study: Invensys saves £546,000 with SMS tokens for 150,000 users

Engineering firm Invensys is embarking on a global roll-out of software-based tokens from SecurEnvoy to replace physical token-based authentication. Continue Reading

By

• Cliff Saran, Managing Editor

DWP prepares alternative to identity cards for Universal Credit

The Department for Work and Pensions (DWP) is grooming a British tech start-up to play a key role in its £2bn Universal Credit benefits system. Continue Reading

By

• Mark Ballard

Cross-site scripting attack on Hotmail highlights personal e-mail risk to business

A vulnerability in the Hotmail site has enabled hackers to steal an unknown number of messages from users' accounts, according to security firm Trend Micro. Continue Reading

By

• Warwick Ashford, Senior analyst

The computers that won the war: Bletchley Park's codebreaking equipment is rebuilt

The Tunny Gallery, opened at The National Museum of Computing at Bletchley Park on 26 May 2011, tells the incredible story of the interception and decryption of German High Command radio teleprinter messages during World War Two. Continue Reading

Apple issues Max OS X update to remove fake AV MacDefender malware

Apple is to release a Mac OS X update to tackle fake antivirus software or "scareware" known as MacDefender, MacSecurity and MacProtector. Continue Reading

By

• Warwick Ashford, Senior analyst

Virtual desktop benefits include tighter security, hot desking

With the help of hot desking and other virtualisation technologies, the Basildon Borough Council was able to centralise its security administration and reduce its number of desks by more than 30%. Continue Reading

By

• Ron Condon

Three automated penetration testing tools for your arsenal

Automated penetration testing tools provide effective exploit libraries and processes to detect network, as well as application vulnerabilities. Our picks. Continue Reading

By

• Harikrishnan R, Contributor

Future of NHS National Programme for IT in critical condition following NAO report

The remaining NHS National Programme for IT could be scrapped entirely, as the project's aim to deliver electronic records for every patient has fallen far below expectations, according to a National Audit Office report. Continue Reading

By

• Kathleen Hall, TechTarget

Government vigilance steps up after George Osborne reveals extent of cyber attacks

Security experts have called for UK government departments to be vigilant after chancellor George Osborne revealed that 20,000 e-mails are sent by hostile intelligence agencies to the UK government each month. Continue Reading

By

• Warwick Ashford, Senior analyst

VA/PT technical report writing best practices for pen testers

A good technical report is indispensible to vulnerability analysis/penetration testing (VA/PT) exercises. Guidelines on how to write concise VA/PT reports. Continue Reading

By

• Gaurav Srivastava and Antriksh Shah

Analysis: Will Android dominance increase IT security threats for business?

The Android Market is forecast to become the world's biggest mobile content platform by August 2011, according to research by mobile application research firm Distimo. Continue Reading

By

• Warwick Ashford, Senior analyst

New ICO guidance issued on EU cookie law

The Information Commissioner's Office has released practical guidance for companies to comply with the new EU cookie law. Continue Reading

By

• Ron Condon

Hackers plan third attack on Sony

Hackers are planning a third attack on Sony in retaliation for its handling of the PlayStation Network and Online Entertainment services data breaches, according to US reports. Continue Reading

By

• Warwick Ashford, Senior analyst

What cloud risks should business consider after Amazon's EC2 outage?

Amazon's recent outage has raised questions over the reliability of cloud services. If Amazon, with its global reach, cannot get IT right, how can CIOs expect other operators to cope? Jenny Williams investigates. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Oracle JDeveloper review

Tim Anderson finds that Oracle's home-grown tool for Java development, JDeveloper, may have a traditional feel, but its smart editor and productivity tools make it particularly useful if you are working with the powerful Oracle ADF. Continue Reading

By

• Tim Anderson

Demystifying wardriving: An overview

With companies like Google being criticized for wardriving, this tip aims at decoding the concept and the associated legal implications. Continue Reading

By

• Antriksh Shah and Varun Haran

Store dealing with dishonest employees uses internal theft prevention software

A London-based sushi chain expects to save almost £1 million this year with the help of new fraud-detection software. Continue Reading

By

• Ron Condon

HSBC Insurance works with IBM to solve Solvency II

HSBC Insurance in the UK is using IBM Global Services to support its European Solvency... Continue Reading

By

• Cliff Saran, Managing Editor

Infosec 2011: APT attacks a real threat to business, says security panel

Advanced Persistent Threats are a reality and cannot be dismissed as a myth or media hype, according to a panel of experts debating the top threats at Infosecurity Europe 2011 in London. Continue Reading

By

• Warwick Ashford, Senior analyst

Shutting down a botnet, US Government disables Coreflood

Coreflood, a botnet almost ten years old, has been taken down by the FBI and US Department of Justice by obtaining permission to hijack the command and control servers and send a 'stop' command to infected PCs. Is this overstepping the privacy line? Continue Reading

By

• Stephen Gillies

Infosec 2011: Cisco announces new tools for securing the mobile enterprise

Cisco has introduced new security products to its Borderless Networks portfolio to help IT departments manage mobile devices, changing workforce habits and the impact of video on the network. Continue Reading

By

• Warwick Ashford, Senior analyst

Secure SDLC best practices

While focus on technicalities is a given during the SDLC, this tip explains how to secure the SDLC, from the analysis phase right through to deployment. Continue Reading

By

• Puneet Mehta, SDG

Growth of NFC to drive overhaul of Chip and PIN equipment

The growth of near-field communication (NFC) in the UK will drive the replacement of retailers' Chip and PIN point of sale (PoS) equipment, according to an analyst. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Building an Olympics network

Preparation is clearly the key to Olympic success, as players on 27 July 2012 will see years of finely honed practice condensed into one gruelling fortnight Continue Reading

By

• Kathleen Hall, TechTarget

Infosec 2011: Charity sector shows the way to balance budget and security

Tackling security project by project is an effective way of securing data on a limited budget, says Matt Holland, head of information security at children's charity NSPCC. Continue Reading

By

• Warwick Ashford, Senior analyst

Infosec 2011: Compliance the biggest security juggernaut, says security expert

The biggest security compliance juggernaut for businesses is concentrating on achieving compliance rather than changing they way they work, says Des Ward, president of the Cloud Security Alliance UK and Ireland chapter. Continue Reading

By

• Warwick Ashford, Senior analyst

Manageability issues impede adoption of virtualisation

Virtual infrastructure management challenges are hindering the adoption of virtualisation within businesses, according to research. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Identity and access management (IAM) program implementation guidelines

The first part of this identity and access management (IAM) program guide details how to optimally structure the implementation’s foundation. Continue Reading

Motivated, information security policye-aware employees are the best defence

Keeping employees motivated is the best way to ensure you have satisfied customers, and if it is an employee's responsibility to keep the customers happy,...

 Continue Reading

By

• Chris Parker

Admins face huge April Patch Tuesday security update from Microsoft

Microsoft has announced that it will release 17 security bulletins to address 64 vulnerabilities Continue Reading

By

• Warwick Ashford, Senior analyst

In 1966 England won the World Cup and Computer Weekly launched the world's first weekly IT newspaper

After 45 years in print, Computer Weekly, the award-winning title for senior IT decision-makers, is to become a 100% online publication. Here is a celebration of 45 years in print. Continue Reading

By

• Cliff Saran, Managing Editor

After breach at RSA, two-factor authentication options abound

Companies specialising in two-factor authentication hope to boost business following the breach of RSA's SecurID, and many plan to capitalise with new products at Infosecurity Europe. Continue Reading

By

• Ron Condon

Sophisticated cyber thieves behind Epsilon data breach, says parent company

US marketing firm Epsilon was hit by one of the biggest data thefts to date, the work of highly sophisticated cyber thieves, says parent company Alliance... Continue Reading

By

• Warwick Ashford, Senior analyst

Botnet detection through DNS behavior and clustering analysis

Botnets are fast emerging as one of the most serious threats to Internet security today. This expert tip looks at how botnets can be detected analyzing their unique fast flux characteristics. Continue Reading

By

• Nilesh Sharma and Pulkit Mehndiratta

Sex offence technology helps business avoid legal liability

Technology that cross references image hash codes against child sexual abuse material will help businesses avoid legal liability. Continue Reading

By

• Warwick Ashford, Senior analyst

City of York falls foul of data protection act following printer mix-up

The City of York Council has fallen foul of the Data Protection Act after having accidentally disclosed personal data following a printer mix-up. Continue Reading

By

• Kathleen Hall, TechTarget

RSA discloses phishing-attack data breach details

RSA, the security division of EMC, has revealed the firm's data breach in mid March was the result of a spear phishing attack. The spear phishing attack exploited an Adobe Flash vulnerability that was unpatched at the time. Continue Reading

By

• Warwick Ashford, Senior analyst

Secure your SCADA architecture by separating networks

Many critical national infrastructure systems include supervisory control and data acquisition (SCADA) functionality. These systems can be viewed as the set of software, computers and networks that provide remote co-ordination of controls systems for tangible infrastructures such as power generation systems, chemical plants, manufacturing equipment and transportation systems Continue Reading

By

• Edward Amoroso

Microsoft publishes report on its Security Development Lifecycle

Microsoft has published a new report that outlines nine years of progress in developing, improving and sharing the Security Development Lifecycle (SDL) process. Continue Reading

By

• Warwick Ashford, Senior analyst

Two-factor authentication alternatives

Worried by the breach at RSA? Here are some two-factor authentication alternatives to consider. Continue Reading

By

• Simon Sharwood

Advanced Wireshark tutorial: Packet and network security analysis

This Wireshark tutorial will familiarize you with Wireshark’s advanced features, such as analyzing packets and undertaking packet level security analysis. Continue Reading

By

• Karthik R, Contributor

Open Group launches guide to boost ISO 27005 efforts

A new guide from the Open Group is designed to help organisations meet ISO 27005 standards, but some risk management professionals feel it may not be so effective. Continue Reading

By

• Ron Condon

Spotify hit by malicious ads

Spotify, the popular streaming music service, has been displaying malicious advertisements to users of its Free version. Continue Reading

By

• Warwick Ashford, Senior analyst

Businesses spend over £600k a week on data security abroad

Companies are spending up to £624,000 a week to secure their most sensitive business data abroad, a study has revealed. Continue Reading

By

• Warwick Ashford, Senior analyst

Hackers steal member email details from TripAdvisor site

A number of TripAdvisor members may receive spam after hackers stole email details from the travel website. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Mature data loss prevention: 8 questions to ask your vendor

To determine if a data loss prevention (DLP) solution truly meet your organization’s needs, there are certain clarifications you always require. Continue Reading

By

• Lior Arbel, Contributor

SAP combines GRC and BI in new platform

SAP has launched a new governance, risk and compliance platform that combines and integrates existing GRC and business intelligence technologies. Continue Reading

By

• Warwick Ashford, Senior analyst

Budget 2011: UK public worried spending cuts will impact data security

A large proportion of the UK public is worried that government spending cuts will have a negative effect on data security, a survey has revealed. Continue Reading

By

• Warwick Ashford, Senior analyst

How to stop a DDoS attack after initiation

In this expert response, Nick Lewis explains how to stop a DDoS attack after it has been initiated. Continue Reading

By

• Nick Lewis

Shodan search engine for penetration tests: How-to

A very handy yet simple to use VA/PT tool, Shodan can be of great use to ethical hackers. Here’s a quick Shodan tutorial. Continue Reading

By

• Harikrishnan R, Contributor

What is OpenID? How to use OpenID SSO in your organisation

An OpenID SSO system allows organisations to simplify website user authentication management. But is OpenID security an issue? Expert Michael Cobb explains. Continue Reading

By

• Michael Cobb

RSA hit by advanced persistent threat attacks

RSA, the security division of EMC, has revealed that attackers have stolen information from the company's IT systems Continue Reading

By

• Warwick Ashford, Senior analyst

Twitter increases security with HTTPS encrypted tweets setting

Twitter has added a new profile setting to increase the level of security when accessing the mobile blogging site over an unsecured Wi-Fi connections. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Ban threat looms for Blackberry services as India demand corporate data access

India could block Research in Motion (RIM) from 31 March 2011 after government officials expressed dissatisfaction with access to Blackberry services. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Trusteer debuts no-software malware protection

Secure web access firm Trusteer has announced a web login and transaction monitoring service to detect malware without installing software. Continue Reading

By

• Warwick Ashford, Senior analyst

RIM urges Blackberry users to disable Javascript after web browsing vulnerability revealed

Research in Motion (RIM) is advising Blackberry smartphone users to disable Javascript to protect against a security vulnerability in its web browser. Continue Reading

By

• Jenny Williams, University of Gloucestershire

IT failures blamed for immigration system faults

IT failures have been blamed for failures of the points based immigration system in a National Audit Office (NAO) report. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Adobe warns of zero-day vulnerability in Adobe Flash

Adobe has published a security advisory for a critical vulnerability in Adobe Flash that can be used to take control of an attacked machine. Continue Reading

By

• Warwick Ashford, Senior analyst

Top 7 anti rootkit software for Windows

It can be quite a tough task to kick out rootkits from infected Windows systems. Our list of top anti rootkit software will prove handy. Continue Reading

By

• Aditya Lad, Contributor

Most organisations approach IAM in the wrong way, says Gartner

Most organisations are approaching identity and access management (IAM) in the wrong way, by planning deployments around technologies, says Gartner. Continue Reading

By

• Warwick Ashford, Senior analyst

Advanced persistent threats - are businesses prepared?

Businesses usually attain adequate levels of IT defences at the point that it becomes more cost effective for cyber criminals to target someone else. Continue Reading

By

• Warwick Ashford, Senior analyst

Industry calls on employers to say what security skills are needed

The National Skills Academy for IT is calling on employers to address the cyber security skills gap by sharing views on the most useful courses and qualifications. Continue Reading

By

• Jenny Williams, University of Gloucestershire

PCI DSS compliance checklist for virtualized environments

A comprehensive Payment Card Industry Data Security Standard (PCI DSS) compliance checklist for protection of cardholder data in virtual environments. Continue Reading

By

• Swati Sharma, contributor

Exclusive: Free software guru Richard Stallman on government IT and why he hates the cloud

The founding father of the free software movement tells Computer Weekly why government just doesn't "get it" Continue Reading

By

• Mark Ballard

France's G20 files target of cyber attack

France's files on the G20 meetings were the target of a cyber attack, the country's finance minister has confirmed. Continue Reading

By

• Kathleen Hall, TechTarget

Western Digital bids $4.3 billion for Hitachi Global Storage Technologies

Western Digital has tabled a bid of $4.25m (£2.6bn) to acquire Hitachi Global Storage Technologies ending the Japanese HDD vendor's previous preparations for an IPO. Continue Reading

By

• Paul Kunert

HSBC uses token to secure smartphone banking

HSBC is sending four million online banking customers a security token which will enable them to log in to their online bank account wherever they are, without using a card reader. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Malvertising, pop-up ad virus problems demand more user protection

A recent pop-up ad infection on the London Stock Exchange's website highlights the growing scourge of malicious advertising, or malvertising. Continue Reading

By

• Ron Condon

Employee information awareness training: PCI policy templates

To comply with PCI DSS -- and keep cardholder data secure -- organisations must train their employees on data handling best practices. This tip explains how. Continue Reading

By

• Mathieu Gorge, VigiTrust

Intel finalises £5bn acquisition of McAfee

Intel has confirmed the completion of its $7.7bn (£5bn) acquisition of security software giant McAfee. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Data dedupe: A natural fit with backup

The Spring edition of Storage Europe featured articles and the lastest information on data deduplication, backup, and cloud technologies. Download it now for all this and more. Sponsored by: Hewlett-Packard Company, EMC and Dell Compellent. Continue Reading

10 identity and access management (IAM) implementation mistakes

An overview of the common issues organizations overlook while deploying an identity and access management (IAM) solution. Continue Reading

By

• Nilesh Shirke

nullcon 2011 Day Zero: Photo feature

Botnet detection, fuzzing intricacies, Zeus MitMo, VoIP attacks, and more. nullcon Day Zero saw considerable action worth the capture. Continue Reading

By

• Harshal Kallyanpur

ISC releases security fix for Bind DoS vulnerability

The Internet Systems Consortium has published an advisory and an update for the Bind domain name system software versions 9.7.1 to 9.7.2-P3. Continue Reading

By

• Warwick Ashford, Senior analyst

Exxon, Shell, BP hacked in Night Dragon attacks

Exxon Mobil, Royal Dutch Shell and BP were among the oil companies targeted by hackers working through internet servers in China, say US reports. Continue Reading

By

• Warwick Ashford, Senior analyst

Microsoft fixes security flaw in malware protection engine

Microsoft has patched a flaw in its malware protection engine that could be exploited to gain control of victim's computer. Continue Reading

By

• Warwick Ashford, Senior analyst

Legacy kit and lack of skills hold back digital video surveillance

A huge legacy investment in analogue equipment and a lack of data integration skills are holding back more widespread adoption of fully digital video surveillance systems, according to research just published. Continue Reading

Middle East governments stepping up internet control, study shows

The internet has proved to be a powerful tool for rallying social and political change, but Middle East governments have also recognised their capability to disrupt communications Continue Reading

By

• Warwick Ashford, Senior analyst

Information security tutorials

SearchSecurity.co.uk's tutorials offer a variety of online information security training courses you can take on your own time at your own pace specifically for UK readers. They are designed to arm you with the foundational and tactical information you need to deal with the increasingly challenging job of keeping your organization's information secure. Continue Reading

Quick and dirty Wireshark tutorial

Wireshark has become a very useful tool for many infosec pros. This hands-on Wireshark tutorial will acquaint you with the network sniffer’s capabilities. Continue Reading

By

• Karthik R and Pramod S

RSA 2011: Microsoft promotes co-ordinated vulnerability disclosure

Software producers remain largely unresponsive to input from security researchers, according to Aaron Portnoy, manager of the security research team HP TippingPoint. Continue Reading

By

• Warwick Ashford, Senior analyst

RSA 2011: Top attacks business will face in 2011

Social networking will be the attacker platform of choice in 2011, says Ed Skoudis, founder and senior security consultant with InGuardians. Continue Reading

By

• Warwick Ashford, Senior analyst

New SMB vulnerability identified in Windows XP and Server 2003

A new SMB vulnerability discovered in Windows could open systems to DoS attacks and remote access. The vulnerability, tagged as CVE-2011-0654, has been rated "critical" and confirmed on Windows Server 2003 SP2 and Microsoft Windows XP SP3. Continue Reading

By

• Ron Condon

RSA 2011: RSA, EMC and VMWare advise on defending against advanced persistent threats

Security leaders have outlined ways organisations can better defend against advanced persistent threats (APTs) in a paper published by RSA, the security division of EMC. Continue Reading

By

• Warwick Ashford, Senior analyst

Optus email rejects shortened URLs

Optus has adjusted its email security regime to repel incoming emails that use URLs shortened by services like bit.ly or TinyURL. Continue Reading

By

• Simon Sharwood