IT security

Signalgate is a signal to revisit security onboarding and training

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Mike Gillespie and Ellie Hurst, Advent IM

Zero-trust is redefining cyber security in 2025

The future of zero-trust is about embedding resilience into every facet of an organisation. To achieve this, SRM leaders must reimagine their strategies to address emerging challenges and prioritise key areas. Continue Reading

By

• Dale Koeppen, Gartner

RSAC rewind: Agentic AI, governance gaps and insider threats

AI was naturally a major theme of this year's RSAC conference, but we maybe failed to anticipate how it is coming to dominate every conversation. Continue Reading

By

• James Robinson, Netskope

AI and compliance: Staying on the right side of law and regulation

Without careful planning, AI projects risk blundering into a legal and regulatory minefield. We look at the risks from hallucinations, basic errors and coming regulation Continue Reading

By

• Stephen Pritchard

AI compliance: Dealing with data change and proliferation

Podcast: We talk with Vigitrust CEO Mathieu Gorge about staying on top of compliance and artificial intelligence, where the danger is data that changes during AI processing and can also proliferate Continue Reading

By

• Antony Adshead, Storage Editor

Gov.uk Wallet open to public sector bodies

Government departments can soon begin to add documents to Gov.uk Wallet, as the Government Digital Service publishes guidance for public sector bodies on how to use the smartphone app Continue Reading

By

• Lis Evenstad

UK biometric surveillance exists in ‘legal grey area’

The rapid proliferation of ‘biometric mass surveillance technologies’ throughout the UK’s public and private sectors is taking place without legal certainty or adequate safeguards for the public Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Adidas confirms customer data was accessed during cyber attack

Sportswear manufacturer Adidas has confirmed its systems were infiltrated by an unauthorised third party Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Remote purchase fraud surges 14%, says banking industry

Brits lost over £1bn to payment fraud in its many forms last year, according to the latest banking industry numbers Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Maturing UK fintechs increase tech and cyber security hiring

Increased hiring reflects that fintechs are maturing and now require more cyber security and compliance experts Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

US makes fresh indictments over DanaBot, Qakbot malwares

US charges the operators of two malwares, DanaBot and Qakbot, whose actions led to millions of dollars worth of cyber theft and fraud Continue Reading

By

• Alex Scroxton, Security Editor

Armed forces charity steps in to address cyber mental health crisis

CIISec and military charity PTSD Resolution hope to address a gathering mental health crisis among frontline cyber professionals Continue Reading

By

• Alex Scroxton, Security Editor

Building resilient cyber threat intelligence communities

Cyber threat intelligence is no longer a luxury: intelligence sharing communities must mature, and there are many common lessons to learn. Continue Reading

By

• Rob Dartnall, SecAlliance

Security vs. usability: Why rogue corporate comms are still an issue

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Elliott Wilkes, ACDS

When leaders ignore cyber security rules, the whole system weakens

The US ‘Signalgate’ debacle is a case study in how security collapses when leadership treats basic rules as optional Continue Reading

By

• Raihan Islam, defineXTEND

Preparation and appreciation – the human factor in incident response

A typical incident response effort is highly technical, so where do soft skills come in and how do you know how effective your team is? We look at a measurement option and the human consideration in these scenarios Continue Reading

By

• Dan Raywood

Why we must reform the Computer Misuse Act: A cyber pro speaks out

Britain’s outdated hacking laws are leaving the UK’s cyber practitioners hamstrung and afraid. Security professional Simon Whittaker reveals how he nearly ran afoul of the Computer Misuse Act, and why he’s speaking out for reform. Continue Reading

UK eVisa: Ethical or harmful?

In this week’s Computer Weekly, we examine the criticism being levelled at government proposals to use electronic visa data and biometrics to surveil migrants living in the UK. We also hear from a noted cyber pro about why he thinks the Computer Misuse Act is ripe for reform. And we find out everything there is to know about retrieval augmented generation architectures and how they can be used to infuse generative artificial intelligence (AI) into a business context. Read the issue now. Continue Reading

What are the best practices for securing AWS tech stacks?

An AWS tech stack can aid business growth and facilitate efficient operations, but misconfigurations have become all too common and stall this progress Continue Reading

By

• Nicholas Fearn

Essex Police discloses ‘incoherent’ facial recognition assessment

An equality impact assessment of Essex Police live facial recognition deployments is plagued by inconsistencies and poor methodology, undermining the force’s claim that its use of the technology will not be discriminatory Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Microsoft raises posse to target dangerous Lumma malware

Microsoft, along with a consortium of partners, has seized and disrupted a significant part of the Lumma malware-as-a-service network used to steal data and funds Continue Reading

By

• Alex Scroxton, Security Editor

How to tackle your infrastructure technical debt

Gartner analysts explain how infrastructure and operations teams can address the accumulation of outdated systems and make a compelling business case for upgrades Continue Reading

By

• Stephen Withers

M&S cyber attack disruption likely to last until July

M&S says it has moved into recovery mode after a ransomware attack, but expects some disruption to persist throughout the coming weeks Continue Reading

By

• Alex Scroxton, Security Editor

NCSC: Russia’s Fancy Bear targeting logistics, tech organisations

The NCSC and its partner agencies have blown the whistle on an extensive campaign of malicious cyber attacks orchestrated by the Russian state Fancy Bear operation Continue Reading

By

• Alex Scroxton, Security Editor

What is a passkey?

A passkey is an alternative user authentication method that eliminates the need for usernames and passwords. Continue Reading

By

• Mary E. Shacklett, Transworld Data
• Amanda Stevens

Podcast: RSA 2025 – AI’s risk surface and the role of the CISO

We review RSA 2025 with Vigitrust CEO Mathieu Gorge who looks at the impacts on compliance of AI’s expanding risk surface, the role of the CISO, and a changed supplier approach Continue Reading

By

• Antony Adshead, Storage Editor

UK Fraud Bill targets benefit claimants for mass surveillance

The UK government’s proposed Fraud Bill will disproportionately place millions of benefit claimants under constant surveillance, creating a two-tier system where people are automatically suspected of wrongdoing for seeking welfare Continue Reading

By

• Anna Dent

Capital One pushes out data tokenisation

Organisations using the Databricks and Snowflake platforms will be able to use Capital One’s Databolt tool to secure their data Continue Reading

By

• Cliff Saran, Managing Editor

Ransomware attacks dropped by a third last month

Reported ransomware attacks eased off during April following a dramatic spike in the first quarter of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

Strong fintech security posture at risk via third-party weak links

Despite having a strong security posture, the financial technology sector could be open to attack via third parties Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

How to create a remote access policy, with template

Remote work, while beneficial, presents numerous security risks. Help keep your organization's systems safe with a remote access policy. Continue Reading

By

• Paul Kirvan

Dell unveils disaggregated infrastructure strategy

Dell makes push for disaggregated infrastructure, aiming to offer enterprises the independent scaling of three-tier architectures with the operational benefits of hyperconverged systems Continue Reading

By

• Aaron Tan, Informa TechTarget

Hacking contest exposes VMware security

In what has been described as a historical first, hackers in Berlin have been able to demo successful attacks on the ESXi hypervisor Continue Reading

By

• Cliff Saran, Managing Editor

Retail cyber attacks hit food distributor Peter Green Chilled

Cold chain services provider Peter Green Chilled, which supplies the likes of Aldi, Sainsbury’s and Tesco, has been forced to halt operations after succumbing to a ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Tackling the UK’s cyber threats

In this week’s Computer Weekly, we report from the National Cyber Security Centre’s annual update on the state of UK security and examine the emerging threats. The chief data officer of Standard Chartered bank discusses preparing for artificial intelligence. We also look at the networking implications of GPU-based AI datacentres. Read the issue now. Continue Reading

UK at risk of Russian cyber and physical attacks as Ukraine seeks peace deal

UK cyber security chief warns of ‘direct connection’ between Russian cyber attacks and physical threats to the UK Continue Reading

UK critical systems at risk from ‘digital divide’ created by AI threats

GCHQ’s National Cyber Security Centre warns that a growing ‘digital divide’ between organisations that can keep pace with AI-enabled threats and those that cannot is set to heighten the UK's overall cyber risk Continue Reading

Chinese cyber spooks lure laid-off US government workers

A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits Continue Reading

By

• Alex Scroxton, Security Editor

Legal Aid Agency breach may encompass millions of people

Legal Aid Agency says the data of anybody who applied for legal aid over the past 15 years has been compromised in a cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Calm settles over digital identity market - for now... (Hark, is that Big Tech on the horizon?)

A relative calm has settled over the digital identity sector after months of worry and vitriol – for now, at least. Digital ID players have largely welcomed the government’s announcement of the ... Continue Reading

By

• Bryan Glick, Editor in chief

What is Universal 2nd Factor (U2F)?

Universal 2nd Factor (U2F) is a physical device that can act as a form of authentication for an account. Continue Reading

By

• Gavin Wright

What is a firewall and why do I need one?

A firewall is a network security device that prevents unauthorized access to a network by inspecting incoming and outgoing traffic using a set of predetermined security rules. Continue Reading

By

• Kinza Yasar, Technical Writer
• Ben Lutkevich, Site Editor

What is compliance risk?

Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting from its failure to act in accordance with industry laws and regulations, internal policies or prescribed best practices. Continue Reading

By

• Katie Terrell Hanna
• Francesca Sales

CW APAC – Trend Watch: API management

Application programming interfaces are subject to the pros and cons of emerging technologies. In this handbook, focused on API management in the Asia-Pacific region, Computer Weekly looks at governance and security, gateway tools, and strategic approaches to creating an automation framework Continue Reading

Jump in cyber attacks should put businesses on high alert

Three principles to help businesses get on top of cyber security Continue Reading

By

• Jason Pyle, Managing Director, Harvey Nash USA & Canada

Gartner: Most firms not tapping cloud’s full potential

Organisations have not fully leveraged the full potential of cloud and must navigate emerging trends such as artificial intelligence, multicloud complexity and security perceptions to stay competitive Continue Reading

By

• Stephen Withers

No workaround leads to more pain for VMware users

There are patches for the latest batch of security alerts from Broadcom, but VMware users on perpetual licences may not have access Continue Reading

By

• Cliff Saran, Managing Editor

Security tests reveal serious vulnerability in government’s One Login digital ID system

A ‘red teaming’ exercise to simulate cyber attacks on the government’s flagship digital identity system has found that One Login can be compromised without detection Continue Reading

By

• Bryan Glick, Editor in chief

How digital identity will empower people and drive economic growth

The government has finally plotted out the future of digital identity in the UK in a way that makes sense for private sector, public sector, and citizens. Now let's make it happen Continue Reading

By

• David Crack, Association of Digital Verification Professionals

The Security Interviews: David Faugno, 1Password

David Faugno, co-CEO of 1Password, discusses how his background led to him joining the company and why maintaining profitability is a key factor in overcoming the challenges of switching markets. Continue Reading

By

• Peter Ray Allison

What is risk appetite?

Risk appetite is the amount of risk an organization or investor is willing to take in pursuit of objectives it deems have value. Continue Reading

By

• Alexander S. Gillis, Technical Writer and Editor

NHS asks suppliers to sign up to cyber covenant

NHS digital and security leaders call on their suppliers to commit to a cyber security charter as the health service works to improve its resilience in the face of growing threat levels Continue Reading

By

• Alex Scroxton, Security Editor

How close is quantum computing to commercial reality?

At a recent event, experts explored the progress towards logical qubits and how these will be applied to empower business IT Continue Reading

By

• Cliff Saran, Managing Editor

Government starts private sector engagement on digital ID and Gov.uk Wallet

Following concerns from the digital identity industry that Gov.uk Wallet would dominate the market, the government has offered private sector providers a ‘critical role’ in its future, as it revealed further details on the wallet Continue Reading

By

• Lis Evenstad

Is IPSIE the game changer that SaaS security demands?

It started with an announcement in October 2024, and now it seems the vision of secure identity in the enterprise is becoming a reality. We look at the prospects for IPSIE Continue Reading

By

• Dan Raywood

Scattered Spider retail attacks spreading to US, says Google

Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK Continue Reading

By

• Alex Scroxton, Security Editor

Enisa launches European vulnerability database

The EU’s new vulnerability database is designed to offer a broader, more transparent source of information on new cyber vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

It's time to get to grips with DORA

It's not really a surprise so many organisations missed the EU's DORE compliance deadline, but there's no excuse for delaying, says Azul EMEA VP James Johnston Continue Reading

By

• James Johnston, Azul

Why we must reform the Computer Misuse Act: A cyber pro speaks out

Britain’s outdated hacking laws are leaving the UK’s cyber practitioners hamstrung and afraid. Security professional Simon Whittaker reveals how he nearly ran afoul of the Computer Misuse Act, and why he’s speaking out for reform Continue Reading

By

• Alex Scroxton, Security Editor

What is business resilience?

Business resilience is an organization's ability to adapt quickly to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Continue Reading

By

• Paul Kirvan

What is penetration testing?

A penetration test, also called a 'pen test,' is a simulated cyberattack on a computer system, network or application to identify and highlight vulnerabilities in an organization's security posture. Continue Reading

By

• Kinza Yasar, Technical Writer
• Puneet Mehta, SDG

New security paradigm needed for IT/OT convergence

Industry leaders and policymakers highlight growing cyber threats from the integration of IT and operational technology systems, calling for collaboration and regulatory frameworks to protect critical systems, among other measures Continue Reading

By

• Aaron Tan, Informa TechTarget

May Patch Tuesday brings five exploited zero-days to fix

Microsoft fixes five exploited, and two publicly disclosed, zero-days in the fifth Patch Tuesday update of 2025 Continue Reading

By

• Alex Scroxton, Security Editor

The top 4 sustainable marketing challenges

Sustainable marketing shows consumers that an organization takes environmental and social responsibility seriously. Yet, marketers must use careful language to avoid greenwashing. Continue Reading

By

• Tim Murphy, Site editor

M&S forces customer password resets after data breach

M&S is instructing all of its customers to change their account passwords after a significant amount of data was stolen in a DragonForce ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Gov.uk One Login loses certification for digital identity trust framework

The government’s flagship digital identity system has lost its certification against the government’s own digital identity system trust framework Continue Reading

By

• Bryan Glick, Editor in chief

Australian data breaches hit record high in 2024

More than 1,100 data breaches were reported in Australia last year, a 25% jump from 2023, prompting calls for stronger security measures across businesses and government agencies Continue Reading

By

• Aaron Tan, Informa TechTarget

Ransomware: What the LockBit 3.0 data leak reveals

An administration interface instance for the ransomware franchise's affiliates was attacked on 29 April. Data from its SQL database has been extracted and disclosed Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef

What is a security operations center (SOC)?

A security operations center (SOC) is a command center facility in which a team of information technology (IT) professionals with expertise in information security (infosec) monitors, analyzes and protects an organization from cyberattacks. Continue Reading

By

• Kinza Yasar, Technical Writer
• Paul Kirvan
• Sarah Lewis

UK government set to finally meet with digital identity providers - but will anything change?

Wednesday 14 May is set to be an important day in the long, slow, painful evolution of the use of digital identity in the UK. For the first time since the government announced its digital wallet ... Continue Reading

By

• Bryan Glick, Editor in chief

What is risk reporting?

Risk reporting is a method of identifying risks tied to or potentially impacting an organization's business processes. Continue Reading

By

• Brien Posey

What is the Sarbanes-Oxley Act? Definition and summary

The Sarbanes-Oxley Act of 2002 (SOX) is a federal law that established sweeping auditing and financial regulations for public companies. Continue Reading

By

• Katie Terrell Hanna
• Ben Lutkevich, Site Editor

Government will miss cyber resiliency targets, MPs warn

A Public Accounts Committee report on government cyber resilience finds that the Cabinet Office has been working hard to improve, but is likely to miss targets and needs a fundamentally different approach Continue Reading

By

• Alex Scroxton, Security Editor

Preparing for post-quantum computing will be more difficult than the millennium bug

The job of getting the UK ready for post-quantum computing will be at least as difficult as the Y2K problem, says National Cyber Security Centre CTO Ollie Whitehouse Continue Reading

By

• Bill Goodwin, Computer Weekly

What are the top 10 spyware threats?

The top 10 spyware list describes the most common spyware threats behind famous spyware attacks and is frequently identified by leading antispyware tools from vendors like Webroot, Norton and Malwarebytes. Continue Reading

By

• Katie Terrell Hanna
• Andrew Zola

US tells CNI orgs to stop connecting OT kit to the web

US authorities have released guidance for owners of critical national infrastructure in the face of an undisclosed number of cyber incidents Continue Reading

By

• Alex Scroxton, Security Editor

UK government websites to replace passwords with secure passkeys

Government websites are to replace difficult-to-remember passwords with highly secure passkeys that will protect against phishing and cyber attackers Continue Reading

By

• Bill Goodwin, Computer Weekly

Meta awarded $167m in court battle with spyware mercenaries

WhatsApp owner Meta is awarded millions of dollars in damages and compensation after its service was exploited by users of mercenary spyware developer NSO’s infamous Pegasus mobile malware Continue Reading

By

• Alex Scroxton, Security Editor

Chaos spreads at Co-op and M&S following DragonForce attacks

No end is yet in sight for UK retailers subjected to apparent ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Europe leads shift from cyber security ‘headcount gap’ to skills-based hiring

Research from Sans Institute reveals European organisations are leading a global shift in hiring priorities, driven by regional regulatory frameworks Continue Reading

By

• Kim Loohuis

Oxford Uni adds cyber resilience module to MBA programme

Oxford University’s Saïd Business School is working with cyber response specialist Sygnia to help future business leaders get on top of security Continue Reading

By

• Alex Scroxton, Security Editor

UK at risk of Russian cyber and physical attacks as Ukraine seeks peace deal

UK cyber security chief warns of ‘direct connection’ between Russian cyber attacks and physical threats to the UK Continue Reading

By

• Bill Goodwin, Computer Weekly

DSIT aims to bolster expertise with year-long secondments

To drive forward its Plan for Change, the Labour government is looking to hire 25 experts for the Department for Science, Innovation and Technology Fellowship programme Continue Reading

By

• Cliff Saran, Managing Editor

UK critical systems at risk from ‘digital divide’ created by AI threats

GCHQ’s National Cyber Security Centre warns that a growing ‘digital divide’ between organisations that can keep pace with AI-enabled threats and those that cannot is set to heighten the UK's overall cyber risk Continue Reading

By

• Bill Goodwin, Computer Weekly

Government industrial strategy will back cyber tech in drive for economic growth

With over 2,000 cyber security businesses across the UK, the government plans to target cyber as a priority to grow the economy  Continue Reading

By

• Bill Goodwin, Computer Weekly

Unspoken risk: Human factors undermine trusted platforms

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Aditya K Sood, Aryaka

Data issues cost Australian businesses nearly A$500k annually

Research reveals Australian organisations are losing an average of nearly half a million dollars annually due to poor data integrity, hindering their ability to leverage AI and eroding their competitive edge Continue Reading

By

• Aaron Tan, Informa TechTarget

Beyond the hook: How phishing is evolving in the world of AI

Phishing attacks are evolving. Gone are the days of clumsy, error-ridden emails that were easy to spot – today’s campaigns harness advanced techniques to bypass even the latest defences. A new approach is needed Continue Reading

By

• Isla Sibanda

Security and verification concerns dog debate over Data (Use & Access) Bill

With the long-awaited Data (Use & Access) Bill returning to the House of Commons on 7 May, there remain pros and cons in the bill in relation to financial crime and cyber security Continue Reading

By

• Andrew Churchill

What is segregation of duties (SoD)?

Segregation of duties (SoD) is an internal control mechanism designed to prevent errors and fraud by ensuring at least two individuals are responsible for the separate parts of any task. Continue Reading

By

• Katie Terrell Hanna
• Rahul Awati

Security Think Tank: What CISOs can learn from Signalgate

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what can CISOs can learn from this potentially fatal error. Continue Reading

By

• Javvad Malik, KnowBe4

Retail cyber crime spree a ‘wake-up call’, says NCSC CEO

The National Cyber Security Centre confirms it is providing assistance to M&S, Co-op and Harrods as concerns grow among UK retailers Continue Reading

By

• Alex Scroxton, Security Editor

Government and Ofcom disagree about scope of Online Safety Act

MPs heard different views from the online harms regulator and the UK government about whether and how the Online Safety Act obliges platforms to deal with disinformation Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Explaining what’s happening in a cyber attack is hard but crucial

The recent attacks on Marks and Spencer, Harrods and the Co-op show why it is essential for organisations to have a strategy to communicate effectively with customers affected Continue Reading

By

• Mikey Hoare, Kekst CNC

Harrods becomes latest UK retailer to fall victim to cyber attack

Harrods confirms it is the latest UK retailer to experience a cyber attack, shutting off a number of systems in an attempt to lessen the impact Continue Reading

By

• Alex Scroxton, Security Editor

Signalgate: Learnings for CISOs securing enterprise data

A leak of information on American military operations caused a major political incident in March 2025. The Security Think Tank considers what CISOs can learn from this potentially fatal error Continue Reading

By

• Todd Thiemann, Principal Analyst

Co-op instructs staff to be wary of lurking hackers

Co-op tells staff to stop using their VPNs and be wary that their communications channels may be being monitored, as a cyber attack on the organisation continues to develop Continue Reading

By

• Alex Scroxton, Security Editor

Thomas Herdman’s legal battle over Sky ECC encrypted phone distribution set to enter fifth year

Computer Weekly speaks to Julie Kawai Herdman, daughter of Thomas Herdman, the only person in custody for distributing Sky ECC encrypted phones Continue Reading

By

• Bill Goodwin, Computer Weekly
• Rebecca Tidy

Is the Investigatory Powers Tribunal powerless?

Five judges have found the Investigatory Powers Tribunal has no statutory powers to impose financial sanctions against police and intelligence services. Their findings raise significant and serious concerns about the integrity of our legal system. Continue Reading

By

• Maria Theodoulou, Partner at Stokoe Partnership Solicitors

Current SaaS delivery model a risk management nightmare, says CISO

JPMorgan Chase security chief Patrick Opet laments the state of SaaS security in an open letter to the industry and calls on software providers to do more to enhance resilience Continue Reading

By

• Alex Scroxton, Security Editor