IT security

Microsoft Office 365 has ability to ‘spy’ on workers

Microsoft faces calls for ‘transparency’ over tools in Office 365 that allow employers to read staff emails and monitor their computer use at work Continue Reading

By

• Bill Goodwin, Computer Weekly

Supply chain security goes deep – forget this at your peril

It may have hit the headlines as an IT issue, but supply chain security goes far deeper into an organisation than just technology Continue Reading

By

• Mike Gillespie

Dreams come true – how data and communication saved a failing company

In this week’s Computer Weekly, the former CEO of bed retailer Dreams explains how digital, data and communication helped turn round a failing company. The UK government has a new digital strategy – but it all seems rather familiar. And we talk to the tech firms trialling a four-day working week. Read the issue now. Continue Reading

Lords move to protect cyber researchers from prosecution

A cross-party group in the House of Lords has proposed an amendment to the Product Security and Telecommunications Infrastructure Bill that would address concerns about security researchers or ethical hackers being prosecuted in the course of their work Continue Reading

By

• Alex Scroxton, Security Editor

Complex Russian cyber threat requires we go back to basics

The situation in Russia is anything but simple, but it is the fundamentals of cyber security hygiene that pose the best defence against the country’s digital threat, as Mandiant’s Jamie Collier explains Continue Reading

By

• Matthew Staff

Challenges of securing a software supply chain

The US president has issued an executive order to improve cyber security, which has ramifications across the software development supply chain Continue Reading

By

• Cliff Saran, Managing Editor

Aussie mobile users most vulnerable to security threats

Australia has the highest percentage of mobile app threats detected on a per-device basis, with iPhone users more likely to download a risky app than an Android user, study finds Continue Reading

By

• Aaron Tan, TechTarget

What the EU’s content-filtering rules could mean for UK tech

EU proposals to clamp down on child sexual abuse material will have a material impact on the UK’s technology sector Continue Reading

By

• Peter Ray Allison

Government responds to Data Reform Bill consultation

Westminster claims its new data laws will boost British benefits, protect consumers, and seize the ‘benefits’ of Brexit Continue Reading

By

• Alex Scroxton, Security Editor

Consider governance, coordination and risk to secure supply chain

A recent ISACA study found myriad factors that give good reason to be concerned about supply chain security. Cyber adviser Brian Fletcher recommends three areas to zero in on Continue Reading

By

• Brian Fletcher

MoD sets out strategy to develop military AI with private sector

The UK Ministry of Defence has outlined its intention to work closely with the private sector to develop and deploy a range of artificial intelligence-powered technologies, committing to ‘lawful and ethical AI use’ Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

TalkTalk hacker Daniel Kelley gives up his black hat for good

After serving a four-year prison sentence for his role in the 2015 TalkTalk hack and other cyber offences, Daniel Kelley now wants to pursue a legitimate cyber security career Continue Reading

By

• Nicholas Fearn

Privacy-enhancing technologies – myths and misconceptions

As the UK and US prepare to open a joint privacy-enhancing technology (PET) prize challenge, expert Ellison Anne Williams busts some myths and misconceptions around this emerging area Continue Reading

By

• Ellison Anne Williams

Dundee security research centre opens with support from SBRC

An £18m hub at Abertay University in Dundee forms the centrepiece of Scotland’s first security research cluster Continue Reading

By

• Alex Scroxton, Security Editor

Office 365 loophole may give ransomware an easy shot at your files

Researchers at Proofpoint have discovered potentially dangerous Microsoft Office 365 functionality that they believe may give ransomware a clear shot at files stored on SharePoint and OneDrive Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Best practices for boosting supply chain security

In a highly connected world, managing the supply chain landscape requires an adaptation of the ‘traditional’ approach to managing cyber risk Continue Reading

By

• Carl Nightingale

Interpol arrests thousands in global cyber fraud crackdown

A two-month operation saw law enforcement agencies in 76 countries crack down on organised cyber fraud Continue Reading

By

• Alex Scroxton, Security Editor

Is digital ID still the missing link for the UK’s digital economy?

While progress has been made, the government’s proposed digital ID trust framework needs more work – and the tech industry wants to have more input Continue Reading

By

• Julian David, TechUK

$2k to access your organisation on the dark web

Dark web brokers will sell access to company networks and systems for an average of $2,000 to $4,000 Continue Reading

By

• Alex Scroxton, Security Editor

directory traversal

Directory traversal is a type of HTTP exploit in which a hacker uses the software on a web server to access data in a directory other than the server's root directory. Continue Reading

By

• Ben Lutkevich, Site Editor

Patch Tuesday dogged by concerns over Microsoft vulnerability response

The last Patch Tuesday in its current form is overshadowed by persistent concerns about how Microsoft deals with vulnerability disclosure Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Basic steps to secure your supply chain

When it comes to supply chain security, there are some core things you should be doing – but remember, the devil is in the detail Continue Reading

By

• Petra Wenham

MS Azure Synapse vulnerability fixed after six-month slog

Microsoft patched a critical Azure Synapse vulnerability twice, but each time the researcher who discovered it was able to bypass it with ease, leading to a lengthy saga Continue Reading

By

• Alex Scroxton, Security Editor

Managing Apple Macs in the enterprise

In this week’s Computer Weekly, with more people working remotely, the use of Apple Macs in the enterprise is growing – we look at how to manage them securely. Our latest buyer’s guide examines security in the supply chain. And 10 years on from the London Olympics, we find out how data innovation is revitalising its legacy. Read the issue now. Continue Reading

UK, US prepare to launch PET project

A transatlantic prize challenge to accelerate development of privacy-enhancing technologies is set to begin Continue Reading

By

• Alex Scroxton, Security Editor

Government recommits to UK’s cyber future in Digital Strategy

New strategy leans heavily on cyber security but stops short of announcing any initiatives that have not already been launched or heavily trailed Continue Reading

By

• Alex Scroxton, Security Editor

New UK digital strategy aims to secure future growth for £150bn digital economy

Government publishes plan that brings together existing and new initiatives intended to expand the digital sector and help to establish the UK as a ‘superpower’ in science and tech Continue Reading

By

• Bryan Glick, Editor in chief

New warning over tech suppliers in thrall to hostile governments

Ukraine war could lead to shakeup of dual-use tech exports, says former UK intelligence officer Continue Reading

By

• Joe Fay

Health data strategy to exorcise ghosts of GPDPR

Government publishes a revised data in health strategy, with an emphasis firmly on preserving the integrity and privacy of patients’ confidential information Continue Reading

By

• Alex Scroxton, Security Editor

Qatar bolsters cyber security in preparation for World Cup

With hackers honing their cyber weapons to target the upcoming football World Cup, Qatar is busy developing countermeasures and raising awareness Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

ICO fails to disclose majority of reprimands issued under GDPR

London law firm Mishcon de Reya forces disclosure of reprimands issued to organisations by the Information Commissioner’s Office for contraventions of UK data protection law Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Security Think Tank: Don’t trust the weakest link? Don’t trust any link

Your security model shouldn’t fall apart just because a part of your business, or a partner, has weak security. This is why information-centric security is a must Continue Reading

By

• Tim Holman, 2-sec

Snake Keylogger climbing malware charts, says Check Point

Cyber criminals behind Snake Keylogger campaigns have been switching up their tactics in the past few weeks, say researchers Continue Reading

By

• Alex Scroxton, Security Editor

Researchers find eight CVEs in single building access system

A series of eight vulnerabilities in Carrier LenelS2 building access panels could enable malicious actors to obtain physical access to their targets Continue Reading

By

• Alex Scroxton, Security Editor

Commercialising open source

Most software developed today takes advantage of open source, but there are still gaps in understanding what open source means in business Continue Reading

SolarWinds CEO offers to commit staffers to government cyber agencies

A new proposal from SolarWinds’ outspoken CEO, Sudhakar Ramakrishna, could see software companies commit key staff to work with government cyber agencies to improve cooperation and incident response Continue Reading

By

• Alex Scroxton, Security Editor

Trade body calls for public-private sector collab on digital ID

TechUK has published a report outlining 10 key recommendations it believes are urgently needed to enable the rapid creation of an effectively regulated digital identity marketplace Continue Reading

By

• Alex Scroxton, Security Editor

Cyber researchers step in to fill Patch Tuesday’s shoes

Afraid you’ll miss Patch Tuesday when it’s gone? You’re not alone, but security analysts at Recorded Future are taking action to help the community come to terms with its loss Continue Reading

By

• Alex Scroxton, Security Editor

CW Europe: Russia escalates cyber war on Ukraine

Microsoft has given details of cyber attacks on Ukrainian civilian communications, nuclear safety authorities, and the exploitation of the destruction of Mariupol in a phishing campaign. Also read about a report on the European Artificial Intelligence Act that suggests a limited ban on predictive policing systems. Continue Reading

Russia plumbs new depths in cyber war on Ukraine

 Continue Reading

China using top consumer routers to hack Western comms networks

An advisory from US cyber authorities shares details of multiple vulnerabilities exploited by Chinese state actors to hack into Western telecoms networks Continue Reading

By

• Alex Scroxton, Security Editor

Using A SASE Platform approach: What Are The Real Cost Benefits?

Following on from my previous blog - where I talked about the real costs of going down the DIY/product portfolio integration route, rather than opting for a “here’s one they made earlier” solution ... Continue Reading

By

• Steve Broadhead, Broadband Testing

ProxyLogon, ProxyShell may have driven increase in dwell times

The median network intruder dwell time was up 36% to 15 days last year, thanks to massive exploitation of the ProxyLogon and ProxyShell vulnerabilities by IABs, according to new Sophos data Continue Reading

By

• Alex Scroxton, Security Editor

Weak IT and SecOps collaboration in ANZ opens doors to cyber attacks

The weak collaboration between IT and security teams in Australia and New Zealand is exposing their organisations to data loss, business disruption and other potential consequences of cyber attacks Continue Reading

By

• Aaron Tan, TechTarget

Contemporary IT: Off the Shelf Vs Bolt-On Approach? It's a No Brainer!

We’ve talked before in this ‘ere blog about the options available nowadays in terms of buying into a platform-based approach, versus integrating a portfolio of specialist products and services – or ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Software house Mega achieves holistic SaaS security with Synopsys

Mega International, a supplier of IT management software, turned to Synopsys’s Coverity and Black Duck products to reassure both itself and its customers that its software-as-a-service offerings were built to the best possible security standards Continue Reading

By

• Alex Scroxton, Security Editor

APAC buyer’s guide to backup and recovery software

In this buyer’s guide, learn more about the market for backup and recovery software and key data protection capabilities to look for Continue Reading

By

• Aaron Tan, TechTarget

How has the UK response to ransomware worked?

Ransomware gangs begin with their own due diligence - to calculate how much the victim (or insurer) will pay before reporting. They are likely to move on and find a victim who will not report, ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Time to act on the DCMS Select Committee 2016 Recommendations

Prepare for when losses from impersonation replace whiplash and PPI as the target income stream of ambulance-chasing lawyers, so that you can rapidly sort the genuine claims from the rest. Continue Reading

By

• Philip Virgo, Winsafe Ltd

IT departments need holistic circular economies to fight climate change

With sustainability moving up the boardroom agenda, IT managers should revamp procurement strategies to align with the principles of the circular economy, but what does this mean for managing the IT lifecycle? Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

EU must stand ground on cyber security, says Finland’s WithSecure

Russian threat is serving to focus minds on cyber security across Europe, say executives at enterprise security company’s inaugural conference Continue Reading

By

• Joe Fay

Executive interview: Jeetu Patel, general manager of collaboration and security, Cisco

Anyone with an idea can help solve a problem if geography and distance don’t matter when bringing in talent, says Cisco’s collaboration and security chief Continue Reading

By

• Melisa Osores, Managing Editor para América Latina

Security leaders call for more observability for cloud native apps

New research highlights the challenges CISOs face securing modern, cloud native applications Continue Reading

By

• Cliff Saran, Managing Editor

What does the EU’s NIS 2 cyber directive cover?

We run the rule over the European Union’s updated NIS2 security directive Continue Reading

By

• Will Dixon

The importance of making information security more accessible

Robin Smith, CSO of Aston Martin Lagonda, talks about how an accessible approach to cyber is helping him to keep the organisation secure Continue Reading

By

• Robin Smith, chief security officer, Aston Martin Lagonda

Researchers discover zero-day Microsoft vulnerability in Office

Malicious Word documents have been used to invoke a previously undisclosed vulnerability in Microsoft Office without user interaction through Windows utility functions Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Attack of the clones: the rise of identity theft on social media

The proliferation of social media has resulted in the rise of identity theft on these platforms, with accounts copied for fraudulent or malicious purposes. What can be done to mitigate it? Continue Reading

By

• Peter Ray Allison

Industrial systems not safe for the future, say Dutch ethical hackers

Ethical hackers in the Netherlands say operational technology and IT networks need to be integrated to prevent cyber attacks penetrating their operations Continue Reading

By

• Kim Loohuis

Singapore doubles down on quantum technology

The city-state is shoring up its quantum talent and quantum device manufacturing capabilities in a bid to advance its knowhow in the emerging technology Continue Reading

By

• Aaron Tan, TechTarget

Mobile digital transformation – from fast to deep

The first half of 2022 has been a busy time, with much happening in the mobile industry. We consider what the rest of year might hold Continue Reading

By

• Dario Betti, Mobile Ecosystem Forum

Trial and error – why the law on computer evidence must change

In this week’s Computer Weekly, the Post Office IT scandal highlighted the problem with computer evidence – we examine the need for legal reform. We assess the nuclear option for sustainable datacentre power. And we find out how IT experts can improve their soft skills and boost their career prospects as a result. Read the issue now. Continue Reading

ICO calls for police to end ‘excessive collection’ of personal data from rape and assault victims

The UK’s information commissioner, John Edwards, has called for prosecutors and police to end the excessive collection of personal data from victims of rape and serious sexual assault Continue Reading

By

• Bill Goodwin, Computer Weekly

Log4Shell: How friendly hackers rose to the challenge

HackerOne CISO Chris Evans looks back at how the security community successfully rose to the challenge of Log4Shell, and saved end-user organisations millions Continue Reading

By

• Chris Evans, CISO and chief hacking officer, HackerOne

Strong internal foundations are key to withstanding external threats

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Steve Forbes

Consistency is key to mitigate outsourcing risk

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Martin Smith, SASIG

Consultation launched on datacentre, cloud security

The government is seeking views on how to boost the security and resilience of the UK’s datacentres and online cloud platforms Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Core security processes must adapt in a complex landscape

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Andrew Morris, Turnkey Consulting

Two-thirds of UK organisations defrauded since start of pandemic

Nearly two out of three UK companies say they have experienced some form of fraud or economic crime in the past two years, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Most CFOs being left out of ransomware conversations

Barely a tenth of CFOs are actively involved in planning for cyber attacks, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

New inquiry looks at the state of UK chips

Foreign Affairs Committee is fishing for evidence in a new inquiry assessing skills, security and end-to-end semiconductor supply chain concerns Continue Reading

By

• Cliff Saran, Managing Editor

Rubrik charts data security path

Backup and recovery software provider Rubrik now sees itself as a cyber security company that helps organisations recover from ransomware and other data security threats Continue Reading

By

• Aaron Tan, TechTarget

Building a pathway to commercial quantum computing

The shortage of expertise in quantum technologies will drive up salaries. A new report from TechUK assesses the route to commercialisation Continue Reading

By

• Cliff Saran, Managing Editor

ICO orders facial recognition firm Clearview AI to delete all data about UK residents

UK data watchdog fines facial recognition company Clearview AI £7.5m for multiple privacy breaches. The firm, which offers services to law enforcement, faces growing pressure from regulators and legal action around the world Continue Reading

By

• Bill Goodwin, Computer Weekly

Ransomware volumes grew faster than ever in 2021

Verizon’s annual DBIR assessment of the security landscape highlights an unprecedented boom in ransomware volumes, to the surprise of nobody Continue Reading

By

• Alex Scroxton, Security Editor

Bad bots make up a quarter of APAC’s web traffic

Bots that run automated tasks have been responsible for stealing personal information among other malicious activities in the Asia-Pacific region, study finds Continue Reading

By

• Aaron Tan, TechTarget

Need a CISO? No need to look for that tech boffin

This is a guest post by Yvette Lejins, resident CISO at Proofpoint Asia-Pacific and Japan The role of the CISO (chief information security officer) has become increasingly important as more ... Continue Reading

By

• Aaron Tan, TechTarget

business resilience

Business resilience is the ability an organization has to quickly adapt to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Continue Reading

By

• Paul Kirvan

Did the Conti ransomware crew orchestrate its own demise?

Analysts examining the shutdown of the Conti ransomware syndicate suggest the cyber crime collective orchestrated its own demise Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Understanding attack paths is a question of training

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Mike Gillespie

How Ivanti views patch management with a security lens

Bringing development, operations and security teams together will help organisations to improve their visibility of IT assets and vulnerabilities while keeping threat actors at bay Continue Reading

By

• Aaron Tan, TechTarget

Applying international law to cyber will be a tall order

Many in the security community have voiced their support for the UK government’s ambitions to work towards agreement with other countries on the application of international law to cyber space, but not without some reservations Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft drops emergency patch after Patch Tuesday screw up

Microsoft fixed a certificate mapping issue that caused server authentication failures on domain controllers for users that had installed the most recent Patch Tuesday updates Continue Reading

By

• Alex Scroxton, Security Editor

Former Welsh steelworks becomes ‘living’ cyber lab

ResilientWorks security centre in Ebbw Vale provides an education hub for students and a testbed for industry Continue Reading

By

• Alex Scroxton, Security Editor

Chinese cyber spooks exploit western sanctions on Russia

The actor behind an ongoing Chinese espionage campaign targeting Russian defence research bodies is taking advantage of the Ukraine war in their phishing lures Continue Reading

Defensive cyber attacks may be justified, says attorney general

Speaking ahead of a speech at the Chatham House think tank, the UK’s attorney general has suggested defensive cyber attacks against hostile countries may be legally justifiable Continue Reading

By

• Alex Scroxton, Security Editor

Top cyber criminal earnings outpace those of business leaders

Cyber crime can pay significantly better than leading a FTSE 100 organisation, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Nature of cyber war evolving in real time, says Microsoft president

The past three months have seen the rapid evolution of the very nature warfare to incorporate cyber attacks, Microsoft’s Brad Smith tells the audience at its Envision conference in London Continue Reading

By

• Alex Scroxton, Security Editor

Deliveroo accused of ‘soft union busting’ with GMB deal

Smaller grassroots unions have criticised Deliveroo and GMB for making a “hollow” deal that will ultimately undermine workers’ self-organising efforts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Red teaming will be standard in Dutch governmental organisations by 2025

The Dutch government wants to include the testing of the digital security of systems, processes and people – also known as red teaming – in all of its governmental organisations’ test planning and budgeting by 2025 at the latest Continue Reading

By

• Kim Loohuis

Security Think Tank: Yes, zero trust can help you understand attack paths

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Paul Holland, Information Security Forum

Singapore opens security testing centre

Joint centre set up by the Cyber Security Agency of Singapore and a local university will facilitate security testing and train security evaluation talent Continue Reading

By

• Aaron Tan, TechTarget

Security Think Tank: To follow a path, you need a good map

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Petra Wenham

Mastercard biometric programme will allow payment authentication by smile

Mastercard is inviting banks and merchants to join a programme to set standards for biometric payments technology Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Veeam outlines data protection vision

Veeam is looking to achieve an “outsized market leading position” by tapping its strengths in data protection and doubling down on innovation to help enterprises secure emerging workloads Continue Reading

By

• Aaron Tan, TechTarget

(ISC)² to train 100,000 cyber pros in UK

Security association (ISC)² unveils ambitious UK training programme Continue Reading

By

• Alex Scroxton, Security Editor

Australian CISOs least prepared for cyber attacks

Australian CISOs are under pressure and feel the least prepared globally to deal with the consequences of a cyber attack, study finds Continue Reading

By

• Aaron Tan, TechTarget

Digitally transforming UK power networks for renewable energy

In this week’s Computer Weekly, we find out how the UK’s power networks need to be digital transformed to be ready for renewable energy – and the role of open source. Wi-Fi 6 was meant to give a boost to wireless connectivity – we examine why adoption has stalled. And we look at what a quantum datacentre might be like. Read the issue now. Continue Reading

Europol gears up to collect big data on European citizens after MEPs vote to expand policing power

The European Parliament has voted to expand Europol’s role, legalising its processing of bulk datasets containing personal information and endorsing research into predictive policing technologies Continue Reading

By

• Bill Goodwin, Computer Weekly

Keeping Singapore’s critical systems secure

Tracy Thng offers a glimpse into her work in strengthening the cyber resilience of 11 essential service sectors in Singapore Continue Reading

By

• Aaron Tan, TechTarget

Open source community sets out path to secure software

A 10-point plan to improve the security and resilience of open source software was presented this week at a summit in the US Continue Reading

By

• Alex Scroxton, Security Editor