IT security

Concerned about tablet security issues? Some are, others not so much

Users love their tablets, but security pros are concerned about tablet security issues. However, though tablets bring new threats, not everyone is ringing the alarm. Continue Reading

By

• Ron Condon

One in four IT security staff abuse admin rights, survey shows

At least one in four IT security staff use their privileged login rights to look at confidential information, a survey has revealed. Continue Reading

By

• Warwick Ashford, Senior analyst

Breaking the code: Are passwords destined for obscurity?

User passwords for websites, email and social networks are often the weakest link in the security chain. The winter edition of IT in Europe: Information Security e-zine investigated the state of passwords in the UK and presented alternatives to the ubiquitous authenticator. Continue Reading

United Nations Development Programme investigates hacking claims

The United Nations Development Programme (UNDP) is investigating claims from hacker group Team Poison that it extracted over 100 e-mail addresses and login details belonging to UN staff. Continue Reading

By

• Warwick Ashford, Senior analyst

BackTrack 5 guide 4: How to perform stealth actions

With BackTrack 5, how to include stealth into attacks is a necessary skill for penetration testers. Our BackTrack 5 how to tutorial shows you the way Continue Reading

By

• Karthik Poojary, Amazon

Framework accelerates safety-critical defence systems development

Manufacturers and academics are collaborating in a 3.5 million project to create a software modelling framework that will speed up the development and certification of safety-critical systems used in aerospace and defence. Continue Reading

By

• Bill Goodwin, Investigations Editor

Bridging the information gap

The pace at which modern business tends to move has resulted in a situation where centralised decision-making struggles to keep up. Continue Reading

By

• Andrew Buss, IDC Manufacturing Insights

Forensics key to effective info security, says E&Y

Intelligence-led security strategies are the most effective in eliminating vulnerabilities and preventing IP theft through enabling informed change, says consultancy firm Ernst & Young. Continue Reading

By

• Warwick Ashford, Senior analyst

IT security not always part of cloud decision, says IDC

Cloud adoption is outstripping security concerns, says Eric Domage, programme manager for IDC in Europe. Continue Reading

By

• Warwick Ashford, Senior analyst

EDF fined £1.3m for hacking into Greenpeace computers

A Paris court has fined French energy firm EDF £1.3m for hacking into Greenpeace computers to find out about the environmental group’s plans to block four planned nuclear power plants in the UK. Continue Reading

By

• Warwick Ashford, Senior analyst

The market landscape for print security

This report is gives an overview of the security risks of the print environment , the market landscape, best practices for a print security strategy. Continue Reading

— CW Bitpipe

London cybersecurity conference: a missed opportunity?

World leaders gathered in London. Our prime minister and foreign secretary hosted all the luminaries and dignitaries. Was it worth it? Continue Reading

— Computerweekly.com

Quocirca: The market landscape for print security

This report by Quocirca analyst Louella Fernandes provides an overview of the inherent risks when operating an insecure print environment, best practice and the current market. Continue Reading

— Computerweekly.com

Analysis: Intelligence key to security business case

Information security is becoming an increasingly important part of any business as the value of information assets continually grow, as do the threats from cyber crime and espionage. Continue Reading

By

• Warwick Ashford, Senior analyst

US and EU hold first joint cybersecurity exercise

The US and EU are holding their first joint cybersecurity exercise in Brussels on 3 November 2011, involving more than 20 EU member states and supported by the EU's cybersecurity agency Enisa and the US Department of Homeland Security. Continue Reading

By

• Warwick Ashford, Senior analyst

The consumerisation of IT: it’s a trickle, not a tide, but you still need to be ready

If media headlines and supplier claims are to be believed, organisations today are faced with an unstoppable tide of many different types of personal device connected to the corporate network Continue Reading

By

• Bill Goodwin, Investigations Editor

The top five SME security challenges

Best practice in IT security and compliance for small and medium-sized enterprises (SMEs) is often seen as a "grudge purchase", but SMEs face the same threat as larger organisations - just without their budgets. Continue Reading

By

• Lisa Kelly

MoD calls on academics, industry and inventors to pitch cyber security ideas

The Ministry of Defence is calling for innovative solutions from academia and industry to protect and secure UK interests in cyberspace. Continue Reading

By

• Warwick Ashford, Senior analyst

Government trials voice recognition for Universal Credit benefit claims

The Department for Work and Pensions (DWP) is testing a voice recognition system to authenticate claimants of its flagship Universal Credits system, as part of the department's work on identity assurance (IDA). Continue Reading

By

• Kathleen Hall, TechTarget

Hague calls for collaboration to realise full potential of cyberspace

It is increasingly clear that countries with weak cyber defences and capabilities will find themselves at a serious strategic disadvantage given the rise of state-sponsored cyber attacks, according to foreign secretary William Hague. Continue Reading

By

• Warwick Ashford, Senior analyst

Japan may be facing sustained cyber attack

Japan's mapping agency is the latest in a series of government agencies to be targeted by hackers, raising fears that the breaches are part of a series of sustained attacks. Continue Reading

By

• Warwick Ashford, Senior analyst

Facebook admits to 600,000 cyber attacks a day

Facebook has revealed that every 24 hours it receives around 600,000 logins to the social networking website from impostors attempting to access users' messages, photos and other personal information. Continue Reading

By

• Warwick Ashford, Senior analyst

UK security strategy draws on growing expertise across Whitehall

The UK's soon-to-be-released cyber security strategy includes input from policy makers across government, says Nigel Harrison of the Office of Cyber Security and Information Assurance (OCSIA). Continue Reading

By

• Warwick Ashford, Senior analyst

BackTrack 5 Guide II: Exploitation tools and frameworks

Our BackTrack 5 guide looks at exploitation and privilege escalation techniques. This part of our guide will improve penetration testing skills. Continue Reading

By

• Karthik Poojary, Amazon

New batch of IDS, IPS evasion techniques are hitting their targets

Stonesoft has discovered 163 new advanced evasion techniques (AET), claiming these AETs can pass below the radar of some IDS, IPS products. Continue Reading

By

• Ron Condon

The Metasploit Framework Tutorial PDF compendium: Your ready reckoner

Get our Metasploit Framework tutorial installments in one place, with the aid of this Metasploit tutorial PDF collection. Continue Reading

By

• SearchSecurity.in Staff

Symantec uses visual maps to identify e-mail-based targeted attacks

Symantec has developed a way of detecting targeted attacks through mapping e-mail patterns to identify single gang activity. Continue Reading

By

• Warwick Ashford, Senior analyst

Computer Weekly wins prestigious journalism award

Computer Weekly has won a prestigious award for its journalism. Freelance contributor and Computer Weekly blogger Mark Ballard won the Best Cybercrime Feature of the Year prize at this year's BT Information Security Journalism Awards. ... Continue Reading

By

• Computer Weekly Staff

85 sub-postmasters seek legal support in claims against Post Office computer system

Over 80 sub-postmasters are interested in taking legal action against the Post Office in relation to an allegedly faulty computer system. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

UBS systems detected $2bn rogue trader fraud, admits CEO Sergio Ermotti

UBS interim CEO Sergio Ermotti has admitted systems in the banks IT infrastructure detected the unauthorised trading of the rogue trader who cost UBS over $2bn, but nothing was done about the warning signals. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

BackTrack 5 tutorial Part I: Information gathering and VA tools

Our BackTrack 5 tutorial covers information gathering and vulnerability assessment using BackTrack 5. Continue Reading

By

• Karthik Poojary, Amazon

Cisco patches IOS in major rollout, releases 10 security advisories

19 bugs and 10 security advisories released to address flaws in Cisco’s IOS network OS, Unified Communication Manager and Series 10000 routers. Continue Reading

By

• SearchSecurity.in Staff

Universal Credit deadline forced DWP to use “unproven” agile development

Tight deadlines left the Department for Work and Pensions with little choice but to use "unproven" agile methods to develop its £2bn Universal Credit (UC) system, said the Cabinet Office Major Projects Authority (MPA) in a confidential report obtained by Computer Weekly. Continue Reading

By

• Mark Ballard

GPU cracks six-character password in four seconds

A £30 nVidia GeForce GT220 graphics card is capable of cracking strong passwords in a matter of hours. Continue Reading

By

• Cliff Saran, Managing Editor

Identifying the business value of SAM best practice frameworks and standards

Businesses are cautious when it comes to taking up best practice frameworks and standards that could help them manage their software assets more effectively. Continue Reading

By

• Bill Goodwin, Investigations Editor

IBM signs £525m DWP contract to provide Universal Credit systems

The Department for Work and Pensions (DWP) has signed a seven-year contract with IBM worth £75m per year to provide systems, which will include the delivery of its flagship Universal Credit programme. Continue Reading

By

• Kathleen Hall, TechTarget

How BP made its supplier ecosystem work

Oil and gas giant BP spent 65% of its $3bn annual IT budget with 3,000 suppliers in 2008, but now it outsources to only seven and has reduced its annual IT budget by $800m as a result. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Self-encrypting drives: SED the best-kept secret in hard drive encryption security

The SED solves many common data loss problems and is easy to use and manage with minimal impact on system performance – yet relatively few businesses and governments use SEDs. Continue Reading

By

• Warwick Ashford, Senior analyst

Police IT not fit for purpose, police-led ICT company needs a lot of work, says Home Office report

A Home Office report into policing has labelled police IT as not being fit for purpose and made recommendations to shake up a mess of different IT systems across 43 forces which is hindering police attempts to fight crime. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Anti-piracy group FAST applauds government business guide to navigating UK IP law

The government has published a guide to UK intellectual property law for businesses, providing information on IP policies; procurement of goods and services; reporting IP crime; and auditing IP. The Federation Against Software Theft (FAST) said it welcomed the initiative. Continue Reading

By

• Warwick Ashford, Senior analyst

Government pulls plug on ailing £11bn NHS IT programme

The troubled £11bn NHS National Programme for IT is to be axed, the government is expected to announce later today. Continue Reading

By

• Kathleen Hall

Researchers claim to have broken SSL/TLS encryption

Two security researchers claim to have found a way of breaking the SSL/TLS encryption that is widely used to guarantee the reliability and privacy of data exchanged between web browsers and servers. Continue Reading

By

• Warwick Ashford, Senior analyst

SQL injection attacks increasing in number, sophistication and potency, researchers find

The prevalence and intensity of SQL injection attacks are increasing, according to Imperva. Continue Reading

By

• Warwick Ashford, Senior analyst

Gartner: Best defence against social media threats is monitoring and education

Blocking social media in the enterprise encourages bad behaviour by employees but does not prevent access, warns Gartner. Continue Reading

By

• Warwick Ashford, Senior analyst

Gartner: Keep encryption simple and standardised to cut cost and complexity

Businesses should consider self-encrypting drives (SEDs) for new installations that hold significant volumes of sensitive data, says Gartner. Continue Reading

By

• Warwick Ashford, Senior analyst

Defense in depth a dying philosophy: Eddie Schwartz

The approach to information security needs to evolve, says Edward Schwartz, CISO at RSA. Agility, dynamism, and fresh security paradigms a need of the hour. Continue Reading

By

• Varun Haran, Reporter

Step-by-step aircrack tutorial for Wi-Fi penetration testing

Aircrack-ng is a simple tool for cracking WEP keys as part of pen tests. In this aircrack tutorial, we outline the steps involved in cracking WEP keys. Continue Reading

By

• Sanoop Thomas, Contributor

Cyber attacks are becoming lethal, warns US cyber commander

Cyber attacks are escalating from large-scale theft and disruption of computer operations to more lethal attacks that destroy systems and physical equipment, according to the head of the US Cyber Command. Continue Reading

By

• Warwick Ashford, Senior analyst

IT development underpinning Universal Credits comes under fire from MPs and experts

The delivery of Universal Credits is coming under fire as observers are casting an increasingly critical eye on the IT systems underpinning the politically sensitive project. Continue Reading

By

• Kathleen Hall

Security update: Light Microsoft Patch Tuesday with low application impact plus critical Adobe fixes

Microsoft's September Patch Tuesday security update is relatively light with only five security updates. Continue Reading

By

• Warwick Ashford, Senior analyst

Metasploit guide 4: Armitage cyber attack management GUI

In part four of our Metasploit guide we look at Armitage, the GUI-based cyber attack management tool. This completes the Metasploit guide series. Continue Reading

By

• Karthik Poojary, Amazon

GlobalSign web certificate authority back online after breach by hacker

Belgian web certificate authority (CA) GlobalSign is back online after investigating claims by the hacker who breached the Dutch DigiNotar CA that its systems had also been breached. Continue Reading

By

• Warwick Ashford, Senior analyst

Web security certificate breach widens

GlobalSign, the fifth largest digital certificate issuer, has suspended the issuing of authentication certificates for websites after the DigiNotar hacker claimed to have breached its systems Continue Reading

By

• Warwick Ashford, Senior analyst

University challenge: using IT to improve services and reduce costs

Universities face a balancing act as they become increasingly expected to improve the experiences of more demanding students while making budgets go further, and IT is a critical tool in finding this balance. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Nike+ problems demonstrate the risk of social media success

The rewards for creating a customer-focused online community are huge. But success comes at a price, as recent issues encountered by Nike's Nike+ running site illustrate. Matt Scott investigates. Continue Reading

By

• Matt Scott, TechTarget

DigiNotar certificate authority breach: Why it matters

There has been much speculation around the identity and motive of the hacker who was able to breach DigiNotar and issue fraudulent digital certificates for hundreds of websites, but putting such speculation aside, what is the broader significance of the incident? Continue Reading

By

• Warwick Ashford, Senior analyst

ICO slams Scottish Children’s Reporter Administration for data breaches

The Information Commissioner's Office has criticised the Scottish Children's Reporter Administration for twice leaking sensitive personal information about young children in breach of the Data Protection Act. Continue Reading

By

• Warwick Ashford, Senior analyst

Orange restores broadband customers' e-mail account access but loses data

A problem with Orange e-mail – which locked out broadband customers – has been partly fixed as access to the accounts is restored, but weeks of e-mails may be lost. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Facebook pays security bug bounty hunters $40,000 in three weeks

Facebook has revealed its security bug bounty initiative has paid out more than $40,000 in just three weeks – but has not revealed how many security vulnerabilities have been reported or how many have been fixed. Continue Reading

By

• Warwick Ashford, Senior analyst

Lack of soft skills training is curbing IT career progression

Employers are failing to provide IT professionals with the business... Continue Reading

By

• Jenny Williams, University of Gloucestershire

Map your data classification policy to controls effectively: How-to

Data classification policy plays an important role in control implementation and effectiveness. We take a look at the involved parameters. Continue Reading

By

• Vishal Gupta

Scholarships aim to encourage women to pursue cybersecurity careers

To boost the percentage of women in IT security careers, (ISC)2 has instituted two new scholarships, each totalling up to $40,000 per year. Continue Reading

By

• Ron Condon

OpenVAS how-to: Creating a vulnerability assessment report

In this OpenVAS how-to, learn how to use the free scanner to create a vulnerability assessment report and assess threat levels. Continue Reading

By

• Mike McLaughlin, Contributor

A handy Nessus tutorial

A powerful vulnerability scanner, Nessus is a utility that infosec pros swear by. If you plan to adopt this tool, our Nessus tutorial has all the details. Continue Reading

By

• SearchSecurity.in Staff

Metasploit tutorial 3 – Database configuration & post exploit affairs

Part three of our Metasploit tutorial covers database configuration in Metasploit and what needs to be done subsequent to exploitation using Metasploit. Continue Reading

By

• Karthik Poojary, Amazon

Why major IT projects are more likely to fail than any others

Major IT projects are 20 times more likely to fail than other business initiatives because project managers are ignoring unpredictable events, says a major research study by Oxford University. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Failed IT projects demolish big businesses and executive careers, say researchers

IT projects spinning out of control in the public and private sector are ending the careers of senior executives and causing entire businesses to collapse. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Social Engineer Toolkit (SET) tutorial for penetration testers

A social engineering toolkit helps address the human element aspect of penetration testing. Learn how to use Social Engineer Toolkit with this tutorial. Continue Reading

By

• Karthik R, Contributor

IT and marketing: working together for business success

The IT department builds things that scale and last, while marketing wants the next big thing - and needed it yesterday. How can heads of technology work effectively with marketing? Cliff Saran investigates Continue Reading

By

• Cliff Saran, Managing Editor

What does HP's Autonomy acquisition mean for the UK tech sector?

HP's bombshell announcement that it is to acquire Autonomy has left many questioning where this leaves the UK software industry. Computer Weekly asks the experts what the deal means for UK home-grown tech talent and what HP is likely to achieve with the latest addition to its portfolio. Continue Reading

By

• Kathleen Hall, TechTarget

Customers may think twice about HP as PC business looks uncertain

As HP announces a major shake-up of its product range and services, analysts warn customers could think twice about HP contracts as a result of uncertainty surrounding its PC business. Continue Reading

By

• Jenny Williams, University of Gloucestershire

NHS trusts already planning a way out of National Programme contracts

NHS trusts in the National Programme for IT's beleaguered southern region have already begun drafting specifications for systems that may replace those supplied under the controversial project. Continue Reading

By

• Mark Ballard

UK business should educate internally to get the right IT security skills at lower cost

UK businesses should look to internal training to meet future IT security needs rather than paying high prices by competing to recruit scarce skills externally, warn experts. Continue Reading

By

• Warwick Ashford, Senior analyst

IPv6: The security risks to business

IT security professionals say the security holes that will open up in many business organisations as the world moves over to internet protocol version six (IPv6) constitute a substantial security concern Continue Reading

By

• Warwick Ashford, Senior analyst

Information Commissioner calls for more privacy improvements at Google

The Information Commissioner's Office says an audit at Google's London office shows the company has taken reasonable steps to improve its privacy policies, but could do more. Continue Reading

By

• Warwick Ashford, Senior analyst

Government must change the way it stores citizens' personal data, calls the EHRC

The government must bring in changes to better protect personal information, calls the Equality and Human Rights Commission. Continue Reading

By

• Kathleen Hall

Adobe issues security updates for Flash, Shockwave, Photoshop and RoboHelp

Adobe has issued fixes for vulnerabilities in Flash, Shockwave, Photoshop, RoboHelp and Flash Media Server in the latest security update. Continue Reading

By

• Warwick Ashford, Senior analyst

Ten-year-old hacker exposes exploitable flaws in Apple and Android games

A 10-year-old Californian hacker has exposed a new type of security vulnerability in many mobile games at a hacker conference in Las Vegas. Continue Reading

By

• Warwick Ashford, Senior analyst

Blackberry to co-operate with police after youths used BBM to organise riots

Research in Motion has said that it will co-operate with the police after it was revealed that London rioters used Blackberry Messenger rather than Twitter to organise looting sprees across the capital, with violence later spreading to Birmingham, Liverpool, Nottingham and Bristol. Continue Reading

By

• Kathleen Hall, TechTarget

Customer data privacy program poised to roll out at Airtel

Airtel’s customer data privacy program will roll out in phases. With the pilot almost completed, Airtel is confident of meeting data privacy regulations. Continue Reading

By

• Varun Haran, Reporter

Best practices for audit, log review for IT security investigations

Device logs can be one of the most helpful tools infosec pros have, or they can be a huge waste of space. Continue Reading

By

• Michael Cobb

US standards body issues warning to energy suppliers over cyber attacks

A US energy industry standards body has warned suppliers to improve their defences against cyber attacks. Continue Reading

By

• Warwick Ashford, Senior analyst

Toxic National Programme for IT contracts to be housed under one body

Billions of pounds of toxic IT contract exposures at the Department for Health could be housed under one central unit, according to reports. Continue Reading

By

• Kathleen Hall, TechTarget

Microsoft slots 22 patches for August Patch Tuesday

Windows, IE, Visio, .Net, Visual Studio and Report Viewer to get security updates; updated version of Windows Malicious Software Removal Tool on charts. Continue Reading

By

• SearchSecurity.in Staff

NIST SP 800-30 standard for technical risk assessment: An evaluation

Risk assessment with NIST SP 800-30 focuses on securing IT infrastructure. Find out NIST SP 800-30 strengths, and learn how it differs from other standards. Continue Reading

By

• Dharshan Shanthamurthy

Case Study: Data encryption at the Salvation Army

The Salvation Army in the UK supports flexible working from home using laptops owned by the charity, but says finding a good way of protecting data was a challenge. Continue Reading

By

• Warwick Ashford

Missing USB drive, found in pub, contained unencrypted data

The ICO says two housing groups must improve data security after a contractor’s missing USB drive, containing unencrypted data, was found in a pub. Continue Reading

By

• Ron Condon

Hotmail makes sign-in changes, can't please everyone

The Hotmail sign-in page is in the news this week, with subtle changes to browser auto-complete behaviour to provide wider browser compatibility. Continue Reading

By

• Stephen Gillies, editor

NHS trust forced to adopt National Programme patient records system or face £8.8m fine

An NHS trust was forced to buy care records software through the National Programme for IT or face the threat of an £8.8m fine - even though it had a longstanding supplier in place. Continue Reading

By

• Mark Ballard

Former government CIO John Suffolk joins Huawei as head of cybersecurity

Former government CIO John Suffolk has joined China-based IT company Huawei as global head of cybersecurity. Continue Reading

By

• Kathleen Hall, TechTarget

Highlights from 'A recipe for rip-offs' - the Select Committee report on government IT

The Public Administration Select Committee has published a scathingly critical report on government's use of IT. We've chosen a selection of the highlights from the report. Continue Reading

By

• Bryan Glick, Editor in chief

Website secure login: Alternatives to out-of-wallet questions

Learn about alternatives to static knowledge-based authentication and out-of-wallet questions for secure website logins in this tip. Continue Reading

By

• Michael Cobb

Metasploit Pro 4.0 adds support for cloud, SIEM systems

Rapid7 releases Metasploit Pro version 4 with improved automation features and new SIEM and cloud-based pen-testing support. Continue Reading

By

• SearchSecurity.in Staff

Computer glitch halts Post Office card transactions

Customers have been unable to complete card transactions at the Post Office after a computer glitch across all branches... Continue Reading

By

• Jenny Williams, University of Gloucestershire

Metasploit tutorial part 2: Using meterpreter

Part two of our Metasploit tutorial covers usage details of the meterpreter post-exploitation tool in Metasploit to create exploits that evade detection. Continue Reading

By

• Karthik Poojary, Amazon

US House of Representatives committee approves cybersecurity standards bill

The US House of Representatives has passed a bill designed to increase education, research and development to counteract cyberthreats. Continue Reading

By

• Warwick Ashford, Senior analyst

Automated web application attacks are the top security threat, study reveals

Websites are attacked about 27 times an hour or once every two minutes on average, peaking at 25,000 attacks a minute or seven a second, according to research... Continue Reading

By

• Warwick Ashford

UK confirms international cyber rules conference

UK foreign secretary William Hague has confirmed that the government is to host an international conference on cyberspace in London on 1 and 2 November 2011. Continue Reading

By

• Warwick Ashford, Senior analyst

British Computer Society – the case for change

A year on from the BCS extraordinary general meeting (EGM), Amit Bhagwat looks at how BCS has evolved, why the EGM came about and gave the results that it did, what has followed since and, how BCS might consider its future from here. Continue Reading

By

• Amit Bhagwat

Securitytube.net releases WLAN security megaprimer

The Hacker News (THN) has reported that the latest SecurityTube.net release includes a 4.2Gb DVD containing over 40+ HD quality videos of their WLAN Security Megaprimer. Continue Reading

By

• Stephen Gillies, editor