IT security

BYOI (bring your own identity)

BYOI (bring your own identity) is an approach to digital authentication in which an end user's username and password are managed by a third party. BYOI is increasingly being used for website authentication. Continue Reading

By

• Robert Sheldon
• Sharon Shea, Executive Editor

St Helens Council in Merseyside hit by ransomware attack

St Helens Borough Council is investigating a suspected ransomware incident targeting its systems, and is advising residents to be on the alert for follow-on phishing attacks Continue Reading

By

• Alex Scroxton, Security Editor

Cyber attacks in 2023 develop quicker as average dwell times plummet

The median attacker dwell time shrunk from 10 to eight days in the first seven months of 2023, and in the case of ransomware attacks it is down to just five days Continue Reading

By

• Alex Scroxton, Security Editor

Singapore to bolster OT security capabilities

Cyber Security Agency of Singapore teams up with Dragos and the US Cybersecurity and Infrastructure Security Agency to bolster the country’s OT security capabilities Continue Reading

By

• Aaron Tan, Informa TechTarget

Clop’s MOVEit attacks drive ransomware volumes to record high

Such has been the scope of Clop’s activity since May that ransomware attack volumes have more than doubled year on year, according to the latest data Continue Reading

By

• Alex Scroxton, Security Editor

Police worker could have put investigation into EncroChat encrypted phone network at risk

A police intelligence analyst admitted tipping-off a criminal contact that police had infiltrated the EncroChat encrypted phone network Continue Reading

By

• Bill Goodwin, Computer Weekly

Cyber attack on Aussie energy services firm may hit UK CNI

Energy One, an Australia-based supplier of tech services to the energy sector, is investigating the possibility that some UK customers may have been caught up in an ongoing cyber attack on its systems Continue Reading

By

• Alex Scroxton, Security Editor

Cyber Explorers programme reaches 50,000 11-14 year olds in 18 months

The government-backed Cyber Explorers programme has reached 50,000 students in its first 18 months, and more schools are being invited to sign up for the Autumn Term Continue Reading

By

• Alex Scroxton, Security Editor

NatWest customer calls bank’s handling of breach of his data ‘disgusting’

A second NatWest customer has contacted Computer Weekly after finding out from a whistleblower that his sensitive personal data has been in her home for 14 years Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

MongoDB secures IRAP certification

MongoDB’s certification from Australia’s Information Security Registered Assessor Program will pave the way for federal government agencies to use its Atlas database service for protected workloads Continue Reading

By

• Aaron Tan, Informa TechTarget

Researchers demo fake airplane mode exploit that tricks iPhone users

Exploit chain that tricks a victim into believing their iOS device is offline in airplane mode when it is not could open the door to grave privacy concerns Continue Reading

By

• Alex Scroxton, Security Editor

Top marks for graduates of CIISec vocational cyber course

132 young people who sat the UK’s first Extended Project Qualification in Cyber Security have received their results today Continue Reading

By

• Alex Scroxton, Security Editor

CyberArk eyes growth beyond PAM

CyberArk is seeing exponential growth in the broader identity security market as the company expands its capabilities beyond privileged access management Continue Reading

By

• Aaron Tan, Informa TechTarget

AI is the most hyped technology of 2023

Gartner's 2023 hype cycle puts generative AI at the peak of inflated expectations in its latest analysis of emerging tech trends Continue Reading

By

• Cliff Saran, Managing Editor

BT flies into NATS network, cyber security project

Organisation tasked with managing air travel in the UK implements ‘transformational’ technology programme to keep skies safe and support customers worldwide Continue Reading

By

• Joe O’Halloran, Computer Weekly

NCSC expands Cyber Incident Response service more widely

The NCSC has added a level to its CIR programme to enable more cyber attack victims to take advantage of the service, which offers access to assured incident response specialists Continue Reading

By

• Alex Scroxton, Security Editor

Top 12 risk management skills and why you need them

Effective risk management is necessary in all parts of a business. Here are a dozen skills that risk managers need to be successful in their jobs. Continue Reading

By

• Andy Patrizio

6 open source GRC tools compliance professionals should know

Organizations must meet a variety of regulatory compliance requirements today. Here's a look at six open source GRC tools and related resources that might help. Continue Reading

By

• Ed Moyle, SecurityCurve

ITAM influence on cyber risk becoming a factor in credit ratings

Credit agency S&P Global Ratings warns that organisations that pay inadequate attention to IT asset management as a factor in their cyber risk management processes may find their creditworthiness takes a dive Continue Reading

By

• Alex Scroxton, Security Editor

Norfolk and Suffolk police hit by FoI-linked data breach

Latest UK police data breach relates to crime suspects, victims and witnesses across East Anglia, and comes just days after a similar incident at the Northern Irish service Continue Reading

By

• Alex Scroxton, Security Editor

Top 4 information security strategy essentials CIOs need

Right now, hackers are targeting your organization. Fight back by learning how CIOs can create a resilient and strong information security foundation. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Online safety message failing to get through to women

The security community could be doing a lot more to make its advice and guidance more accessible to women, according to a study Continue Reading

By

• Alex Scroxton, Security Editor

Unconventional career: A Computer Weekly Downtime Upload podcast

Cyber security expert Junade Ali, talks about his non-academic route to a PhD. He was recently elected as a fellow of the IET Continue Reading

By

• Cliff Saran, Managing Editor

Healthcare cybersecurity risks and management

Healthcare institutions are rich in what cybercriminals want: sensitive data like PII and financial information. Learn the danger and what an effective strategy must include. Continue Reading

By

• Brenda L. Horrigan, Executive Managing Editor

NatWest offers compensation to customer affected by data breach exposed by whistleblower

NatWest bank has offered compensation to a former customer affected by a data breach alongside around 1,600 other former and current customers Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

US Cyber Board to probe cloud security after latest Exchange hack

CSRB review of cloud security comes in the wake of a major Chinese cyber attack on US government bodies orchestrated through Microsoft’s cloud services Continue Reading

By

• Alex Scroxton, Security Editor

Directory Services Restore Mode (DSRM)

Directory Services Restore Mode (DSRM) is a Safe Mode boot option for Windows Server domain controllers. Continue Reading

By

• Rahul Awati

Datacentre management vulnerabilities leave public clouds at risk

At the annual DEF CON hacking convention, researchers from Trellix have disclosed multiple vulnerabilities in key datacentre products underpinning the world’s public cloud infrastructure Continue Reading

By

• Alex Scroxton, Security Editor

Whose needs are UK Cyber Skills policies intended to meet?

Among those businesses that do not outsource incident management, 4 in 10 (41%) are not very or not at all confidence that they would be able to deal with a cyber security breach or attack compared ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Google speeds up security update frequency for Chrome

Changes to Google’s security update policy are supposed to help close the gap in which cyber criminals can exploit n-day vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

A non-conventional career journey into IT security

GCSEs and A-levels are not the only route to higher education. We speak to an IT security expert who left school with no formal qualifications Continue Reading

By

• Cliff Saran, Managing Editor

PSNI investigating second breach after laptop stolen

Just hours after accidentally disclosing the personal details of 10,000 personnel, the Police Service of Northern Ireland has notified a second data breach after a police issue laptop and documents were stolen from a parked car Continue Reading

By

• Alex Scroxton, Security Editor

Three UK expands business offering with device management proposition

Cloud-based offering to enable UK operator to offer businesses ability to manage over-the-air configuration of devices, simplifying complex IT admin while securely increasing employee productivity Continue Reading

By

• Joe O’Halloran, Computer Weekly

Microsoft addresses Office vulnerability attacked by Russian spooks in latest update

Microsoft has issued fixes for over 70 vulnerabilities in its August Patch Tuesday drop, including remedies for CVE-2023-36884, which was disclosed without a fix in July and has been the subject of Kremlin-backed cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

crisis management

Crisis management is the application of strategies designed to help an organization deal with a sudden and significant negative event, while maintaining business continuity. Continue Reading

By

• Nick Barney, Technology Writer
• Brien Posey

Northern Irish police expose staff data in botched FoI response

Human error is being blamed for the leak of personally identifiable information on all serving officers and civilian staff at the Police Service of Northern Ireland Continue Reading

By

• Alex Scroxton, Security Editor

MPs warn about growing prevalence of tech-enabled domestic abuse

The UK government must take action to prevent perpetrators from being able to use connected or smart technologies to conduct their domestic abuse, a select committee has warned Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

UK voter data hacked in cyber attack on election watchdog

An unknown threat actor who attacked the UK’s Electoral Commission had access to data on millions of UK voters for over a year, the watchdog has revealed Continue Reading

By

• Alex Scroxton, Security Editor

Black Basta, Hive and Royal ransomware gangs may share real-world connection

At Black Hat USA, Sophos X-Ops researchers share data revealing potential connections between three active ransomware crews Continue Reading

By

• Alex Scroxton, Security Editor

Workplace monitoring needs worker consent, says select committee

Employers looking to monitor their employees through connected devices should only to so with the consent of those affected due to negative impacts such surveillance can have on work intensification and mental health Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Many UK organisations considering ChatGPT bans on employee devices

More than 60% of organisations in the UK have either banned, or are considering banning, the use of generative AI tools on employee- or business-owned devices Continue Reading

By

• Alex Scroxton, Security Editor

NHS trust suspends two governors as whistleblower email dispute continues

Governors at an NHS trust have been suspended after asking questions about emails used to bring a General Medical Council investigation against a whistleblower Continue Reading

By

• Tommy Greene

Microsoft fixes Azure flaw that was subject of researcher criticism

Microsoft has confirmed a potentially-dangerous flaw in the Azure platform has now been fully fixed, and moved to reassure customers that despite criticism it is committed to responsible disclosure and timely fixes Continue Reading

By

• Alex Scroxton, Security Editor

Rise in fraudsters spoofing the websites of leading UK banks

Despite safeguards to protect customers from scams, UK retail banks are still seeing high volumes of fake phishing websites exploiting their brands, and the problem seems to be increasing in scope and scale Continue Reading

By

• Alex Scroxton, Security Editor

Log4Shell, ProxyShell still among most widely exploited flaws

Statistics released by the collective Five Eyes cyber agencies reveals insight into the most exploited vulnerabilities of 2022, and unsurprisingly there are some old ‘friends’ on the list Continue Reading

By

• Alex Scroxton, Security Editor

Biden’s SBOM mandate a ‘shot heard around the world’, report says

Two years and three months after Joe Biden mandated new standards in supply chain security, over 40% of UK respondents to a survey say they have implemented new SBOM policies in direct response Continue Reading

By

• Alex Scroxton, Security Editor

Scottish NHS trust ducks fine after staff shared patient data via WhatsApp

NHS Lanarkshire has been issued a formal reprimand by the ICO after staff members used WhatsApp to share patients’ personal data with one another Continue Reading

By

• Alex Scroxton, Security Editor

Plexal takes on new cohort for cyber security leadership scheme

Six more cyber security startup founders have been selected to take part in Plexal’s latest Cyber Runway Ignite programme, which is designed to help them develop their leadership skills Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Cozy Bear hijacks SME Microsoft 365 tenants in latest campaign

Microsoft shares intelligence on a newly observed Cozy Bear campaign that saw the APT take over genuine Microsoft 365 tenants and subvert them to try to phish its victims Continue Reading

By

• Alex Scroxton, Security Editor

SOC 2 (System and Organization Controls 2)

SOC 2 (System and Organization Controls 2), pronounced "sock two," is a voluntary compliance standard for ensuring that service providers properly manage and protect the sensitive data in their care. Continue Reading

By

• Robert Sheldon
• Alex DelVecchio, Content Development Strategist

Microsoft attacked over ‘grossly irresponsible’ security practice

The CEO of Tenable has launched a scathing attack on Microsoft, asserting that the organisation is deliberately keeping its Azure cloud customers in the dark about dangerous vulnerabilities and accusing it of a culture of ‘toxic obfuscation’ Continue Reading

By

• Alex Scroxton, Security Editor

Pig butchers caught using ChatGPT to con victims

Romance scammers looking to con people out of their savings appear to be turning to generative AI tools to save time and effort Continue Reading

By

• Alex Scroxton, Security Editor

Ivanti MDM users told to patch against two dangerous flaws

Users of Ivanti’s mobile device management platform have been warned to act now to patch two vulnerabilities that were chained by a threat actor in a series of cyber attacks on the Norwegian government Continue Reading

By

• Alex Scroxton, Security Editor

Vigilance advised if using AI to make cyber decisions

The AI arms race is heating up, and the battle lines are being redrawn. Still, organisations should proceed cautiously and remain vigilant in scrutinising AI’s ability to ensure accurate, safe, and informed decision-making. Continue Reading

By

• Peter Gregory, GCI Communications
• Ejona Preci, Lindal Group

Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act (CFAA) of 1986 is United States legislation that imposes criminal penalties on individuals who intentionally access a protected computer without proper authorization or whose access exceeds their authorization. Continue Reading

By

• Robert Sheldon
• Ben Cole, Executive Editor

Singtel adds Zscaler SSE to managed security services portfolio

Singtel teams up with Zscaler to offer a managed security service edge service as it looks to ramp up its enterprise business Continue Reading

By

• Aaron Tan, Informa TechTarget

Hackers: We won’t let AI get the better of us

Artificial intelligence is changing how ethical hackers go about their work, but the community is convinced the technology will never be able to replicate the creativity of a flesh-and-blood hacker. Continue Reading

We’re doing AI all wrong

In this week’s Computer Weekly, AI is being imposed upon society from the top down and the socio-economic implications will cause problems – we talk to an expert who says there is a better way. We find out how hackers – the good kind – are turning to AI to make their work more effective. And we examine how generative AI will affect the datacentre. Read the issue now. Continue Reading

Common Access Card (CAC)

A Common Access Card (CAC) is a smart card issued by the Unites States Department of Defense for accessing DOD systems and facilities. Continue Reading

By

• Rahul Awati

AI has a place in cyber, but needs effective evaluation

Organisations that don’t leverage AI-based security solutions will find themselves more vulnerable than those that do., but cyber pros still need to ensure they can effectively evaluate AI-enhanced tech to ensure it meets their use case Continue Reading

By

• Jack Chapman

national identity card

A national identity card is a portable document, typically a plasticized card with digitally embedded information, that is used to verify aspects of a person's identity. Continue Reading

By

• Katie Terrell Hanna

Resisting AI

Technology is not neutral. It is always embedded in social, economic, and political relations built on systematic, structural imbalances of power. Welcome to capitalism. Including the Xi Jinping ... Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Lancaster Uni lends cyber support to nuclear decommissioning body

Lancaster University’s cyber team has joined with the Nuclear Decommissioning Authority to help support and protect its 300-year mission, while enhancing its own capabilities in the process Continue Reading

By

• Alex Scroxton, Security Editor

compliance audit

A compliance audit is a comprehensive review of an organization's adherence to regulatory guidelines. Continue Reading

By

• Kassidy Kelley

Scottish university hit by Rhysida ransomware gang

Data allegedly stolen from the University of Western Scotland has been put up for sale on the dark web by a ransomware gang going by the name Rhysida Continue Reading

By

• Alex Scroxton, Security Editor

Does AI have a future in cyber security? Yes, but only if it works with humans

Do AI and ML hold the promise of helping cyber pros achieving the holy grail of operating quicker, cheaper, and with higher efficiency? We shouldn’t hold our breath, says Nominet’s Paul Lewis Continue Reading

By

• Paul Lewis, Nominet

How Indian organisations are keeping pace with cyber security

Indian organisations are shoring up their defences to improve their cyber resilience amid intensifying cyber threats targeted at key sectors such as healthcare and logistics Continue Reading

By

• Pratima Harigunani

Cyber criminals pivot away from ransomware encryption

Cyber breaches that saw data theft and extortion without an encryption or ransomware component account for more and more incidents, in a possible indication that ransomware gangs are changing up their business models Continue Reading

By

• Alex Scroxton, Security Editor

AI-enhanced cyber has potential, but watch out for marketing hype

As AI is a hot topic right now, it is no surprise there are some cyber solutions coming to market that have been thrown together in haste, but that said, genuine AI-powered security products do exist and their abilities could yet prove transformative. Continue Reading

By

• Shailendra Parihar, Turnkey Consulting

US cyber breach reporting rules to have global impact

Organisations that operate as Foreign Private Issuers in the US will have to get to grips with strict new cyber breach reporting regulations handed down by the SEC in Washington Continue Reading

By

• Alex Scroxton, Security Editor

Meta results show impact of data fines and datacentre upgrade strategy

The owner of Facebook is battling with regulators over transferring EU data to the US. It is also seeing less improvements on CPUs Continue Reading

By

• Cliff Saran, Managing Editor

Ant Group teams with NTU to advance privacy-preserving technologies

The Chinese fintech giant is partnering with Singapore’s Nanyang Technological University on a cryptographic protocol that ensures the privacy of transacting parties Continue Reading

By

• Aaron Tan, Informa TechTarget

NATO countries must coordinate their cyber forces to combat the Russian threat  

The top item on the agenda at the Vilnius NATO Summit this month was the revamping the alliance’s defences. Continue Reading

By

• CEO of SimSpace and former military officer at US Cyber Command

Cyber attack on IT supplier hits two major ambulance trusts

Ambulance trusts serving millions across southern England have been hamstrung for the past week after a cyber attack took down their hosted patient records system Continue Reading

By

• Alex Scroxton, Security Editor

UK organisations lack confidence to carry out basic cyber tasks

Amid a shortfall of more than 10,000 cyber pros, UK businesses are still finding it difficult to fill their cyber security skills gaps, with even those in charge of security saying they lack confidence in themselves Continue Reading

By

• Alex Scroxton, Security Editor

Cisco, BT and others launch network security coalition

Network Resilience Coalition focuses on bringing together global expertise to improve data and network security Continue Reading

By

• Alex Scroxton, Security Editor

Tetra radio users’ comms may have been exposed for years

A number of flaws in the encryption algorithms used in the secure Tetra radio communications standard have potentially left users exposed to snooping Continue Reading

By

• Alex Scroxton, Security Editor

One month after MOVEit: New vulnerabilities found as more victims are named

Five weeks after the mass MOVEit breach, new vulnerabilities in the file transfer tool are coming to light as the Clop cyber crime group continues to terrorise victims. But has the gang bitten off more than it can chew? Continue Reading

Getting comfortable with data

In this week’s Computer Weekly, we talk to ‘Data Bob’ – the head of IT at furniture retailer DFS – about building trust in data. The vulnerabilities in MOVEit software continue to attract new victims – we assess the impact of the widespread breaches. And we find out how online investigators are trawling social media to gather evidence of war crimes. Read the issue now. Continue Reading

CIO interview: Sean Green, University of East Anglia

In his role as director of digital and data at the University of East Anglia, Sean Green provides high-performance computing to researchers and manages the diverse needs of a campus with the characteristics of a small town, all while finding the time to study one of his passions Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Citrix NetScaler users told to patch new zero-day urgently

A vulnerability disclosed and patched last week by Citrix appears to be being exploited by China-backed threat actors as a zero-day, prompting warnings from government cyber bodies Continue Reading

By

• Alex Scroxton, Security Editor

Tribunal investigates complaint that journalists’ phones were unlawfully monitored

The Investigatory Powers Tribunal has agreed to investigate complaints by Northern Ireland investigative journalists Trevor Birney and Barry McCaffrey that they were unlawfully placed under surveillance Continue Reading

By

• Bill Goodwin, Computer Weekly

802.11

802.11 is a family of evolving specifications for wireless local area networks (WLANs) developed and maintained by a working group of IEEE. Continue Reading

By

• Garry Kranz

Security AI and automation may reduce cost of data breaches

Organisations that go all in on security AI and automation tend to incur lower financial costs when they experience a data breach incident, according to an IBM report Continue Reading

By

• Alex Scroxton, Security Editor

Why cyber security should be part of your ESG strategy

The impact of data breaches and cyber threats on businesses, societies and the environment makes cyber security a key consideration in an environment, social and governance strategy Continue Reading

By

• Aaron Tan, Informa TechTarget

Future Cyber Threats: The four ‘horsemen of the apocalypse’

How to deal with emerging security threats from deep fake humans to the end of secure encryption  Continue Reading

By

• Jim Tiller, CISO, Nash Squared

Handbook helps Dutch organisations migrate to quantum-safe communication

Organisations must start implementing new cryptography standards – as migration is a lengthy process Continue Reading

By

• Kim Loohuis

The problem with ‘secure’ messaging

Secure instant messaging is becoming a norm for business communications but it raises three important security and compliance questions   Continue Reading

By

• Andersen Cheng, Executive Chairman, Post-Quantum  

invitation to tender (ITT)

An invitation to tender (ITT) is a formal document that is issued by a company or an organization inviting suppliers or contractors to submit a bid for a project or service. Continue Reading

By

• Katie Terrell Hanna

What the Product Security and Telecommunications Infrastructure Act means for UK industry

For years, many network-connected devices have lacked adequate security, putting their users and others at risk of cyber attacks. The UK’s PSTI Act aims to prevent this by mandating minimum security requirements, but what impact will this have on industry? Continue Reading

By

• Peter Ray Allison

Government boosts protection for encryption in Online Safety Bill but civil society groups concerned

House of Lords adopts amendment to require Ofcom to commission a report before requiring technology companies to scan encrypted messages, but drops proposals for judicial oversight Continue Reading

By

• Bill Goodwin, Computer Weekly

Online Safety Bill screening measures amount to ‘prior restraint’

The Open Rights Group is calling on Parliament to reform the Online Safety Bill, on the basis that its content-screening measures would amount to “prior restraint” on freedom of expression Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Renowned hacker and social engineer Kevin Mitnick dead at 59

Famed hacker and social engineer Kevin Mitnick, who was at one time one of the most wanted cyber criminals in the world, has died peacefully at the age of 59 from complications arising from pancreatic cancer, following a 14-month illness Continue Reading

By

• Alex Scroxton, Security Editor

How the DSMA balances security and privacy with press freedom

In a world of information sharing and 24-hour news cycles, the Defence and Security Media Advisory committee have to balance national security and data privacy with freedom of the press Continue Reading

By

• Peter Ray Allison

Attention-seeking KillNet hacktivists becoming more dangerous

The KillNet DDoS gang seems to be becoming more dangerous, but its primary goal remains to create a lot of noise and draw media attention, according to latest analysis Continue Reading

By

• Alex Scroxton, Security Editor

Enterprise communication security a growing risk, priority

Enterprise Strategy Group's Dave Gruber discusses survey results on security threats related to the use of email and other communication and collaboration tools. Continue Reading

By

• Craig Stedman, Industry Editor

At the gates – How to survive the era of cyber insecurity

Businesses face more legal risks, a mine field of regulation, and individual liability for failures. Getting the basis right is more important than ever. Continue Reading

By

• Alex Cravero, senior associate and Andrew Moir, partner, Herbert Smith Freehills

How to fit customer experience security into your strategy

Most organizations overlook security in their CX strategies. However, with collaboration, personalization, CIAM controls and more, organizations can offer a secure and positive CX. Continue Reading

By

• Jessica Groopman, Kaleido Insights

We have lift off… The opportunities and risks of generative AI

How you can use AI to benefit your business while navigating the risks Continue Reading

By

• Melanie Hayes, Nash Squared, and Bill Boorman, Technology & Talent Advisor

BlackCat and Clop gangs both claim cyber attack on Estée Lauder

Cosmetics conglomerate Estée Lauder is experiencing operational disruption in the wake of a cyber attack that seems to involve two different cyber crime gangs Continue Reading

By

• Alex Scroxton, Security Editor