IT security

Google debuts open source bug bounty programme

Google is calling on hackers to take pot-shots at its open source projects for the first time through a new vulnerability research programme Continue Reading

By

• Alex Scroxton, Security Editor

Norway has NOK200m plan to bolster cyber defences

Norway is investing heavily in its cyber defences amid heightened threat from Russia Continue Reading

By

• Gerard O'Dwyer

NHS staff fall further behind amid ransomware attack

While some NHS bodies are now recovering their services after the ransomware attack on a crucial software supplier, others are still being forced to rely on pen and paper, and some will be waiting months to recover Continue Reading

By

• Alex Scroxton, Security Editor

Four years into GDPR, Norway hopes for safer data transfer to US

Much of the data on the internet ends up on US servers at some point, and that is not always compatible with the General Data Protection Regulation, says Norwegian data protection authority Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

AI will make you surplus to requirements

We live in an age where it is possible for someone, irrespective of their level of talent, to create an artistic masterpiece, simply by keying a few descriptive words into an AI-powered art ... Continue Reading

By

• Cliff Saran, Managing Editor

Breaches You Don’t Hear About

I think it’s fair to say that, over the decades, if the general public had been alerted to all the attempted terrorist attacks tracked down and prevented by intelligence – as opposed to just the ... Continue Reading

By

• Steve Broadhead, Broadband Testing

IAM house Okta confirms 0ktapus/Scatter Swine attack

Following last week’s disclosureby Group-IB researchers of a major phishing campaign, Okta has warned its customers to be on their guard Continue Reading

By

• Alex Scroxton, Security Editor

UK government presses on with new cyber rules for telcos

Government has finalised new security rules for telecoms companies and will move to make them binding in the near future Continue Reading

By

• Alex Scroxton, Security Editor

LastPass breach limited in scale and well-managed, say experts

A breach of LastPass’s developer environment does not seem to have affected users of the password management service, but it may still be time for a credential reset Continue Reading

By

• Alex Scroxton, Security Editor

One Login digital identity project makes headway

Government services are lining up to work with the GDS on its One Login digital identity system, according to its director of digital identity, Natalie Jones Continue Reading

By

• Lis Evenstad

CIOs: Geopolitics impacts your IT strategy

Research from analyst Gartner illustrates how geopolitics is influencing IT strategies Continue Reading

By

• Cliff Saran, Managing Editor

Criminal 0ktapus spoofed IAM firm in massive phishing attack

Researchers at Group-IB have published research on a major phishing campaign that ensnared victims at the likes of Cloudflare and Twilio Continue Reading

By

• Alex Scroxton, Security Editor

James Hatch, BAE Systems: Computer Weekly Downtime Upload podcast

We speak to the chief digital officer at BAE Systems’ Digital Intelligence business about the challenges of “digital” in high-trust organisations Continue Reading

By

• Cliff Saran, Managing Editor

Adaptive RedAlert, Monster ransomwares go cross-platform

Kaspersky researchers have shared new intelligence on two emergent cyber criminal groups that have adapted their ransomwares to target different operating systems at the same time Continue Reading

By

• Alex Scroxton, Security Editor

CW Nordics: Norway struggles to keep up with demand for tech specialists

The growing importance of IT in all industries, along with a shortage in skills, make for an excellent high-tech job market for candidates in Norway. Read how recruiters are struggling to keep up with demand. Also read how the Danish government encourages research in strategic fields to attract tech companies. Continue Reading

Millions of Plex users may be at risk in password breach

Up to half of Plex’s 30 million users may have had their personal data stolen by an unknown threat actor Continue Reading

By

• Alex Scroxton, Security Editor

Security pros fret about stress and promotion over cyber attacks

CIISec’s annual report on the state of the security profession reveals some home truths for security leaders Continue Reading

By

• Alex Scroxton, Security Editor

LockBit 3.0 cements dominance of ransomware ecosystem

Ransomware attacks were up 47% in July compared with the previous month, according to the latest threat data from NCC Group, with the LockBit family largely to blame Continue Reading

By

• Alex Scroxton, Security Editor

Most CISOs think they’ve been attacked by a nation state

Most organisations have made changes to their cyber strategies and policies following Russia’s invasion, and almost two-thirds suspect they have been directly targeted or impacted by a nation-state cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Alleged Twitter security failings spell trouble ahead

Twitter’s former security head, Peiter Zatko, has alleged a number of serious cyber failures at the social media platform, raising the spectre of investigations and sanctions Continue Reading

By

• Alex Scroxton, Security Editor

Sweden and GDPR – four years on

 Continue Reading

DevSecOps: Software developers lack sufficient security focus

GitLab survey shows developers want to produce high-quality code, but ‘shifting’ security left is hard to achieve Continue Reading

By

• Cliff Saran, Managing Editor

NCSC shares cyber guidance for large infrastructure builds

Balfour Beatty and McAlpine are among the large construction firms to have input into latest NCSC guidance for ensuring the security of major infrastructure projects Continue Reading

By

• Alex Scroxton, Security Editor

How digital technology rescued Merlin

In this week’s Computer Weekly, we talk to the CTO of Merlin Entertainments – operator of Legoland, Sea Life and Alton Towers – to find out how digital saved the company when Covid shut all its theme parks. We look at how software and data analytics can help to track – and reduce – greenhouse gas emissions. And Southern Water explains how data helps to support its most vulnerable customers. Read the issue now. Continue Reading

State of open source: Computer Weekly Downtime Upload podcast

In this special edition of the Computer Weekly Downtime Upload podcast, OpenUK’s Amanda Brock speaks to Cliff Saran about open source challenges Continue Reading

By

• Cliff Saran, Managing Editor

Kaspersky threat data added to Microsoft Sentinel service

Microsoft and Kaspersky have agreed a collaboration to integrate Kaspersky’s threat data feeds into Microsoft’s cloud-native SIEM/SOAR service Continue Reading

By

• Alex Scroxton, Security Editor

Lloyd’s to end insurance coverage for state cyber attacks

Lloyd’s of London has instructed its members to exclude nation state cyber attacks from insurance policies beginning in 2023, saying they pose unacceptable levels of risk Continue Reading

By

• Alex Scroxton, Security Editor

Cradlepoint unveils networking architecture addressing 5G, SD-WAN, zero-trust intersection

Cloud-delivered LTE and 5G wireless network services provider launches software-based offering to manage remote connections and provide flow-level visibility Continue Reading

By

• Joe O’Halloran, Computer Weekly

Google employees demand end to collection of abortion data

In the wake of the US Supreme Court rolling back abortion rights, Google employees are calling on the company to stop collecting abortion-related data, so that it can never be shared with police Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Cozy Bear targets MS 365 environments with new tactics

Cozy Bear, or APT29, is trying out new tricks as it seeks access to its targets’ Microsoft 365 environments Continue Reading

By

• Alex Scroxton, Security Editor

Apple patches two zero-days in macOs, iOS

Mac users should urgently apply new patches addressing vulnerabilities in its desktop and mobile operating systems Continue Reading

By

• Alex Scroxton, Security Editor

Data sharing: How can we make sure the UK is a world leader?

The UK government risks missing out on the benefits and opportunities laid out in its National Data Strategy – and could lose international competitiveness as a result Continue Reading

By

• Julian David, TechUK

Inside Singapore’s national digital identity journey

Singapore’s national digital identity system has evolved from providing single sign-on to e-government services to pandemic-related and digital document capabilities in recent years Continue Reading

By

• Aaron Tan, TechTarget

Growing MFA use spurs ‘pass-the-cookie’ attacks

The exploitation of stolen session cookies by cyber criminals is once again back on the agenda, thanks to the growing popularity of multifactor authentication tools Continue Reading

By

• Alex Scroxton, Security Editor

Amazon Ring vulnerability could have been used to spy on users

A now-patched vulnerability in the Amazon Ring mobile app could have been exploited to expose users’ video recordings, but was complex to exploit, according to the researchers who stumbled upon it Continue Reading

By

• Alex Scroxton, Security Editor

It takes a breach to force boards to take notice of cyber, says UK government

Too often, it takes a major incident for business leadership to pay attention to cyber issues, according to a government-commissioned study of victims Continue Reading

By

• Alex Scroxton, Security Editor

Ukraine war drives DDoS attack volumes ever higher

There has been a boom in distributed denial-of-service attacks in the first six months of 2022, according to a report, with Russia’s war on Ukraine helping to drive activity Continue Reading

By

• Alex Scroxton, Security Editor

GPS tagging of migrants breaches UK data protection law, says Privacy International complaint

Privacy group files complaints with Information Commissioner’s Office and Forensic Science Regulator over Home Office’s GPS monitoring of migrants Continue Reading

By

• Bill Goodwin, Computer Weekly

Why you should start your post-quantum encryption migration now

Some say we have the best part of a decade to prepare for the security risks that quantum computing presents to current encryption tech, but PA Consulting experts believe that timeframe is shrinking dramatically Continue Reading

By

• Richard Watson-Bruhn and Mark Chang

Cyber security accelerator launches in Greater Manchester

Accelerator will add to Manchester’s growing cyber security ecosystem, which already includes several tech unicorns, arms companies and the offices of GCHQ Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

South Staffs Water is victim of botched Clop attack

South Staffordshire Water moves to reassure customers that their supplies remain safe after its attackers screw up their initial assault Continue Reading

By

• Alex Scroxton, Security Editor

Why organisations need to harmonise their CIO and CISO roles

Unless properly managed, conflicting responsibilities between the chief information officer and the chief information security officer can cause project delays and budget overruns, says Netskope’s Mike Anderson Continue Reading

By

• Peter Ray Allison

Broadband reaches for the stars – the new space race

In this week’s Computer Weekly, we look at the latest space race, as satellite firms compete to provide high-speed connectivity. Is the datacentre sector hindering house building in the UK? We find out what’s really going on. And we talk to the IT director of the Mercedes Formula One team about how data helps to win races. Read the issue now. Continue Reading

Lawyers and journalists sue CIA and Mike Pompeo over Assange surveillance claims

CIA and its former director sued over allegations that they authorised unlawful spying on US citizens when they visited WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London Continue Reading

Report reveals consensus around Computer Misuse Act reform

A study produced by the CyberUp campaign reveals broad alignment among security professionals on questions around the Computer Misuse Act, which it hopes will give confidence to policymakers as they explore its reform Continue Reading

By

• Alex Scroxton, Security Editor

Cyber criminal forum targets only Russia

The Digital Shadows Photon Research Team has been investigating a pro-Ukraine cyber criminal forum called Dumps, which appears to be one of a kind Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft doles out $13.7m in bug bounties

Microsoft’s Bug Bounty programme has paid a total of $13.7m to more than 300 researchers in almost 50 countries Continue Reading

By

• Alex Scroxton, Security Editor

How critical infrastructure operators can secure OT data

Cohesity’s CISO discusses the challenges of securing data in operational technology systems and what can be done to mitigate security threats Continue Reading

By

• Aaron Tan, TechTarget

segregation of duties (SoD)

Segregation of duties (SoD) is an internal control designed to prevent error and fraud by ensuring that at least two individuals are responsible for the separate parts of any task. Continue Reading

By

• Rahul Awati

Researcher finds 10 vulnerabilities in Cisco firewalls

At Black Hat USA, Rapid7 researchers report on 10 security issues in popular Cisco firewall products, many of which do not yet have patches Continue Reading

By

• Alex Scroxton, Security Editor

Cisco averts cyber disaster after successful phishing attack

A potentially serious cyber attack on Cisco’s systems that began after a threat actor successfully exploited an employee’s carelessly secured credentials was thwarted without major damage Continue Reading

By

• Alex Scroxton, Security Editor

Seacom teams up with BT to deliver enterprise communications services across Africa

Deal with leading UK telco intended for customers of Africa’s first broadband submarine cable system to benefit from what is claimed to be world-class portfolio of network services Continue Reading

By

• Joe O’Halloran, Computer Weekly

NHS may take a month to recover from supply chain attack

Ransomware attack victim Advanced warns its NHS customers they could be waiting until early September to fully recover their operations Continue Reading

By

• Alex Scroxton, Security Editor

GitHub targets vulnerable open source components

There are thousands of vulnerabilities in open source code – GitHub aims to help developers see if their projects are impacted Continue Reading

By

• Cliff Saran, Managing Editor

Microsoft fixes two-year-old MSDT vulnerability in August update

August’s Patch Tuesday drop fixes more than 120 CVEs, including another MSDT RCE zero-day that is being actively exploited. Continue Reading

By

• Alex Scroxton, Security Editor

SASE vs SSE – Is SASE One “A” Better?

One of the problems with acronym-defined industry “go to’s” in IT, is that they can easily be misconstrued and/or a myriad variations on a theme emerge from the original – thereby confusing the ... Continue Reading

By

• Steve Broadhead, Broadband Testing

‘Coopetition’ a growing trend among ransomware gangs

Sophos shares data from its new X-Ops unit at Black Hat in Las Vegas, revealing a growing number of ransomware victims being attacked by multiple gangs at the same time Continue Reading

By

• Alex Scroxton, Security Editor

UK to surveil convicted migrants with facial recognition

A Home Office scheme to biometrically scan the faces of convicted migrants who have already carried out punishments has come under fire from privacy and human rights groups for being discriminatory Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Cyber insurance getting harder to obtain

Organisations looking to shore up their security postures face more and more barriers to obtaining cyber insurance Continue Reading

By

• Alex Scroxton, Security Editor

NHS recovering key services after attack on supplier

Incident at software provider Advanced took out multiple NHS services before the weekend, including the 111 advice service Continue Reading

By

• Alex Scroxton, Security Editor

Reliance on PSN may have exacerbated cyber attack impact

As it seeks a new supplier to reinvigorate the migration away from the Public Services Network, the Cabinet Office says relying on the legacy network may be putting public sector bodies at heightened risk in cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

The dangers of the UK’s illogical war on encryption

The unintended consequences of the Online Safety Bill will have a dramatic effect on our ability to communicate securely, including in Ukraine, where it is needed most Continue Reading

By

• Robin Wilton

UK has biggest card fraud problem in Europe

Social Market Foundation calls on the UK to get a grip on its huge problem with bank card fraud in Europe Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

SBRC to administer NCSC training across Scotland

The Scottish Business Resilience Centre has been awarded a £500,000 contract to extend cyber resilience training across more than 250 at-risk organisations Continue Reading

By

• Alex Scroxton, Security Editor

Financial services regulator opens digital delivery centre in Leeds

The Financial Conduct Authority is increasing the number of tech experts in its workforce through a new digital delivery centre in Leeds Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Spyware activity particularly impactful in July

After a quiet June, vulnerability exploitation ramped up in July, with intrusions linked to spyware seeing unusually high volumes of activity, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Reimagining ethical digital technology

With ever-increasing digitisation leading to greater dependence on a range of digital technologies, enterprises need to urgently look at how they can incorporate ethical and social considerations into the tech they develop Continue Reading

By

• Simon Rogerson

New EU due diligence law needs amending to stop tech sector abuse

European corporate due diligence directive seeking to transform how companies approach their human rights and environmental risk is welcome, but without further changes, it will fail to effectively curb tech firms’ harmful practices, claims international non-profit Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Shift to remote work sees major rise in cyber crime

Survey finds almost four in five cyber security teams agree that recent changes to working practices have adversely affected their organisation’s cyber security, with one-fifth banning the use of public Wi-Fi by policy Continue Reading

By

• Joe O’Halloran, Computer Weekly

DrayTek patches SOHO router bug that left thousands exposed

Network hardware supplier has fixed an unauthenticated RCE vulnerability in multiple routers in its Vigor line, after being alerted by Trellix researchers Continue Reading

By

• Alex Scroxton, Security Editor

UK safety tech sector sees strong revenue and employment growth

Safety tech is now one of the fastest-growing sectors in the UK tech industry, with jumps in revenue, investment and employment Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Use recovery level objective to fine-tune BCDR response

Recovery level objective is not a widely used metric, but it has value to business continuity and disaster recovery teams. Learn how it fits in the BCDR timeline here. Continue Reading

By

• Paul Kirvan

Austrian data firm accused of selling malware, conducting cyber attacks

Microsoft has accused DSIRF, an Austrian data services firm, of involvement in a string of cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Ex-youth footballers kick-start cyber careers

New programme aims to find fresh careers for former youth footballers in cyber security Continue Reading

By

• Alex Scroxton, Security Editor

H0lyGh0st ransomware gang faces challenges, but still a threat

Digital Shadows reports on the recently identified H0lyGh0st ransomware outfit, a new threat actor operating out of North Korea that faces some clear challenges, but is nevertheless still a live threat Continue Reading

By

• Alex Scroxton, Security Editor

NCSC startups scheme turns focus to operational technology, SME security

NCSC for Startups initiative turns its focus to supporting innovation around securing operational technology and addressing the challenges facing small businesses Continue Reading

By

• Alex Scroxton, Security Editor

Cyber criminals pivot away from macros as Microsoft changes bite

As Microsoft resumes blocking macros by default in its Office application suite, reversing a temporary reversal, analysis from Proofpoint suggests the action has had a remarkable effect Continue Reading

By

• Alex Scroxton, Security Editor

Consumers left out of pocket as security costs soar

As the average cost of a security incident reaches an all-time high of nearly $4.5m, an IBM Security study reveals how these costs are being passed on to ordinary people Continue Reading

By

• Alex Scroxton, Security Editor

data breach

A data breach is a cyber attack in which sensitive, confidential or otherwise protected data has been accessed or disclosed in an unauthorized fashion. Continue Reading

By

• Andrew Froehlich, West Gate Networks
• Katie Terrell Hanna
• Kevin Ferguson

US doubles bounty on Lazarus cyber crime group to $10m

US State Department doubles a previously announced reward for information on North Korean cyber criminals, including the notorious Lazarus group Continue Reading

By

• Alex Scroxton, Security Editor

Retail software firm PrestaShop warns users about SQL injection attacks

Open source e-commerce platform PrestaShop warns thousands of small retailers that their customers’ credit card details may be at risk of compromise Continue Reading

By

• Alex Scroxton, Security Editor

Cyber security training ‘boring’ and largely ignored

Two-thirds of employees don’t bother to pay attention to cyber security training – and the fault does not lie with them Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Don’t rely on insurance alone

Cyber insurance is a useful addition to the cyber protection toolbox. However, it cannot be regarded as a replacement for the controls that should be in operation, says Turnkey Consulting’s Tom Venables Continue Reading

By

• Tom Venables, Turnkey Consulting

Secret court asked to quash a decade of MI5 surveillance warrants following ‘systemic breaches’

The culture at MI5 was to ‘prioritise’ missions ‘over everything else’, including compliance with safeguards designed to protect the public, the UK’s most secret court heard yesterday Continue Reading

By

• Bill Goodwin and Tommy Greene

No More Ransom initiative helps 1.5 million people in six years

One and a half million people have now taken advantage of free ransomware decryption tools offered by a joint European project Continue Reading

By

• Alex Scroxton, Security Editor

Visibility and proactive stance needed to secure OT systems

Critical infrastructure operators need to have more visibility into their IT and operational technology environment, and take a more active stance to fend off sophisticated adversaries, expert says Continue Reading

By

• Aaron Tan, TechTarget

Ducktail infostealer targets Facebook Business users

Newly uncovered Ducktail operation targets individuals with access to Facebook Business service and tries to steal their accounts Continue Reading

By

• Alex Scroxton, Security Editor

Inside Russia’s Ukraine information operations

In this week’s Computer Weekly, we get the inside track on Russia’s disinformation operations attempting to spread propaganda and cyber threats about the invasion of Ukraine. Our new buyer’s guide looks at customer and employee experience management. And we assess 10 top Kubernetes backup suppliers. Read the issue now. Continue Reading

Inside Russia’s Ukraine information ops

We speak to Craig Terron of Recorded Future about delving deep inside the Russian disinformation machine’s operations, and how the Kremlin’s strategy is likely to evolve as the Ukraine war drags on. Continue Reading

Home Office ‘unlawfully’ approved MI5 bulk surveillance warrants

MI5 provided ‘false information’ to the Home Office to secure bulk surveillance warrants, the Investigatory Powers Tribunal heard Continue Reading

By

• Bill Goodwin and Tommy Greene

NCSC seeks community input for Cyber Advisor service

The NCSC is proposing to establish a new Cyber Advisor service to train up experts in security guidance, and is inviting interested parties to come forward Continue Reading

Latest Atlassian Confluence vulnerability raises concerns

CVE-2022-26138 is the second major vulnerability disclosure made for Atlassian’s Confluence collaboration platform in recent months Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Why you need to protect abandoned digital assets

The war in Ukraine and subsequent boycott of Russia resulted in a swathe of digital infrastructure being abandoned, becoming a potential vulnerability for many organisations, says Cyberpion’s Ran Nahmias Continue Reading

By

• Peter Ray Allison

TMT firms among top targets for cyber attacks in Singapore

Organisations in the technology, media and telecoms sector were among the most lucrative targets for malicious actors as their services penetrate almost every aspect of society Continue Reading

By

• Aaron Tan, TechTarget

insider threat

An insider threat is a category of risk posed by those who have access to an organization's physical or digital assets. Continue Reading

By

• Andrew Froehlich, West Gate Networks
• Katie Terrell Hanna
• Brien Posey

LinkedIn most impersonated brand in phishing attacks

Social network LinkedIn, along with Microsoft and DHL, are just some of the brands that are most frequently imitated by cyber criminals conducting phishing attacks Continue Reading

By

• Alex Scroxton, Security Editor

GCHQ experts back scanning of encrypted phone messages to fight child abuse

Ian Levy, technical director of the NCSC, and Crispin Robinson, technical director of GCHQ, back client-side scanning software on mobile phones to detect child abuse Continue Reading

By

• Bill Goodwin, Computer Weekly

Buy ‘plug-n-play’ malware for the price of a pint of beer

Three-quarters of malwares and almost 90% of exploits retail on the dark web for about £8.40 or less, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Russia-linked APTs targeted fleeing Ukrainian civilians

Mandiant and the US authorities have shared details of a phishing campaign that spoofed humanitarian information on evacuation procedures to target Ukrainians fleeing Russian bombardment Continue Reading

By

• Alex Scroxton, Security Editor

UK government introduces data reforms legislation to Parliament

Proposed changes to UK’s data protection regime include new grounds for data processing, significant powers for the secretary of state to direct the regime’s application, and fewer restrictions on law enforcement’s use of data Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor