IT security

Mind the gap: public and private sector disparity in cybersecurity

Amidst increasingly sophisticated cyber attacks and a constantly shifting threat landscape, cyber security partnerships across the private and public sector are essential in tackling these threats. ... Continue Reading

By

• Louella Fernandes, Quocirca

GPDPR data scrape a ‘mistake’, says leading scientist

Giving evidence to the Science and Technology Committee, academic, physician and science writer Ben Goldacre has expressed serious misgivings about the on-hold GPDPR NHS data scrape Continue Reading

By

• Alex Scroxton, Security Editor

The limits and risks of backup as ransomware protection

Backups can provide a sound means of recovery from ransomware infection, but they are not 100% certain to foil attackers. We look at the limits and risks of depending on backups Continue Reading

By

• Stephen Pritchard

CW Benelux: Meta shelves hyperscale datacentre plan in Netherlands

Meta’s plan for a hyperscale datacentre in the Netherlands which was to serve the metaverse world has been halted following a campaign by environmentalists and the Dutch parliament’s call for the government to do everything in its power to stop the facility being built. Also read how the Dutch arm of customer services supplier Teleperformance has led the entire organisation to adopt robotic process automation software. Continue Reading

Security Think Tank: Your path to understanding attack paths

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Paddy Francis

APAC career guide: Becoming a cyber security pro

The region’s burgeoning cyber security industry has attracted more talent last year, but it takes more than just technical knowhow to succeed in the field Continue Reading

By

• Aaron Tan, TechTarget

Nerbian RAT enjoys using Covid-19 phishing lures

The world is slowly coming to terms with Covid-19, but fear of the coronavirus is no less useful to cyber criminals because of it, as Proofpoint researchers have discovered Continue Reading

By

• Alex Scroxton, Security Editor

Emotet has commanding lead on Check Point monthly threat chart

Emotet remains by some margin the most prevalent malware, according to Check Point’s latest monthly statistics Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: Five Eyes focuses on MSP security

The western intelligence community has set out practical steps IT service providers and their customers can take to protect themselves Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: Data-sharing service to protect public from scams

A new data-sharing service set up by the NCSC and industry partners will give ISPs access to real-time threat data that they can use to block fraudulent websites Continue Reading

By

• Alex Scroxton, Security Editor

Analysts confirm return of REvil ransomware gang

Secureworks CTU analysis has found that the REvil ransomware is undergoing active development, possibly heralding a new campaign of cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Cyber accreditation body Crest forges new training partnerships

Crest says partnerships with Hack The Box and Immersive Labs will enhance its members’ defensive and offensive security skills Continue Reading

By

• Alex Scroxton, Security Editor

Nationwide stops thousands more attempted frauds with Strong Customer Authentication

Nationwide Building Society is blocking an additional 2000 attempted online shopping frauds a month through extra checks Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Microsoft fixes three zero-days on May Patch Tuesday

It’s the second-to-last Patch Tuesday as we know it, and Microsoft has fixed a total of 75 bugs, including three zero-days Continue Reading

By

• Alex Scroxton, Security Editor

EU plans to police child abuse raise fresh fears over encryption and privacy rights

Draft regulation unveiled today will require internet and messaging firms to use algorithms to identify grooming and child abuse or face heavy fines Continue Reading

By

• Bill Goodwin, Computer Weekly

Top 10 spyware threats

The top 10 spyware list describes the 10 common spyware threats behind famous spyware attacks and is frequently identified by Webroot's Spy Audit, a free spyware scanner tool. Continue Reading

By

• Andrew Zola

‘Spy cops’ inquiry delves into police relationship with MI5

There was ‘no filter’ on the information that undercover police officers were collecting on activists throughout the 1970s, despite senior managers and officials involved in directing the surveillance questioning the appropriateness of the information gathering and sharing Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

CyberUK 22: Cyber leaders affirm UK’s whole-of-society strategy

On the opening day of CyberUK 2022, GCHQ director Jeremy Fleming and NCSC CEO Lindy Cameron have spoken of their commitment to the government’s ambition for a whole-of-society cyber strategy Continue Reading

By

• Alex Scroxton, Security Editor

NCSC pins Viasat cyber attack on Russia

UK authorities have attributed the 24 February cyber attack on the network of satellite comms company Viasat to Russia Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: NCSC refreshes cloud security guidance

The National Cyber Security Centre is revising its cloud guidance as increasing uptake of potentially vulnerable cloud services puts more organisations at risk of compromise Continue Reading

By

• Alex Scroxton, Security Editor

CyberUK 22: Wales splashes £9.5m on cyber innovation hub

A new innovation hub hopes to spur on cyber security innovation in Wales Continue Reading

By

• Alex Scroxton, Security Editor

NSO Group faces court action after Pegasus spyware used against targets in UK

Three human rights activists whose phones were targeted by spyware traced to Saudi Arabia and the United Arab Emirates have begun legal action against both countries and Israel’s NSO Group Technologies Continue Reading

The spies who hack you – the growing threat of spyware

In this week’s Computer Weekly, after 10 Downing Street was hit by a spyware attack, fears about targeted mobile phone hacks are increasing. Our salary survey highlights the diversity challenge in IT, with men’s support for women in IT declining. And we look at how datacentre heat reuse can help reduce carbon emissions. Read the issue now. Continue Reading

CyberUK 22: NCSC’s ACD programme blocks 2.7 million scams

On the opening day of its annual CyberUK event, the NCSC reveals how organisations around the country have used its Active Cyber Defence programme to their advantage Continue Reading

By

• Alex Scroxton, Security Editor

parameter tampering

Parameter tampering is a type of web-based cyber attack in which certain parameters in a URL are changed without a user's authorization. Continue Reading

By

• Rahul Awati

UK digital markets regulator to be given statutory powers

Digital Markets Unit will be put on statutory footing by UK government to ensure technology giants do not abuse market power, but announcement comes with no clear indication of when legislation will be introduced Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

IT infrastructure used to launch DDoS attack on Russian targets

Organisations could unwittingly be participating in hostile activity against the Russian government as compromised IT infrastructure is used without their knowledge to launch denial of service attacks Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How to retain cyber talent in the Great Resignation

The cyber security industry is experiencing alarming rates of resignations, leaving organisations vulnerable to cyber attacks. How can we better retain cyber talent? Continue Reading

By

• Nicholas Fearn

Disaster recovery is an essential service for EDF with Phenix-IT

EDF has built disaster recovery tracking, planning and testing software on a six-month upgrade cycle based on governance, risk and compliance functionality in Mega’s Hopex platform Continue Reading

By

• Alain Clapaud
• Antony Adshead, Storage Editor

Five companies join NCSC for Startups to deal with ransomware

The NCSC has invited five startups to join the NCSC for Startups programme to develop tech that can help deal with the threat of ransomware Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Security Think Tank: Identify, assess and monitor to understand attack paths

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to understand these attack pathways better in order to fight back Continue Reading

By

• Rob McElvanney

NHS email accounts hijacked for phishing campaign

Microsoft credentials targeted in phishing operation using hijacked NHSMail accounts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Intellectual property theft operation attributed to Winnti group

Winnti conducted a prolonged cyber espionage campaign that went undetected for years, allowing it to exfiltrate massive amounts of corporate data and intellectual property Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

UK government puts pressure on IT sector to clean up app security

Apps can be exploited to carry malicious payloads that steal personal information and cause financial loss – and not enough is being done to secure them Continue Reading

By

• Cliff Saran, Managing Editor

Security Think Tank: Defenders must get out ahead of complexity

The modern-day abundance of platforms, apps and IT tools presents malicious actors with a web of interconnection that is easily exploited to move rapidly through the network to compromise critical assets. Security teams need to better understand these attack pathways to fight back Continue Reading

By

• Jack Chapman

PeerGFS to add AI/ML anomaly detection to distributed file system product

Peer will add AI/ML-based anomaly detection as it ramps up security protection in its PeerGFS distributed file management software, with Linux server support also to come in 2022 Continue Reading

By

• Antony Adshead, Storage Editor

LDAP injection

LDAP (Lightweight Directory Access Protocol) injection is a type of security exploit that is used to compromise the authentication process used by some websites. Continue Reading

By

• Ben Lutkevich, Site Editor

Five TLS comms vulnerabilities hit Aruba, Avaya switching kit

Five new vulnerabilities in the implementation of transport layer security communications leave several popular switches vulnerable to remote code execution Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Security Think Tank: Solving for complexity in the network

The modern-day abundance of IT platforms, apps and tools gives the bad guys ample opportunity to move rapidly through the network to hit critical assets. Security teams must understand these attack pathways better in order to fight back Continue Reading

By

• Mike Lloyd, RedSeal

Information security in 2022 – managing constant change

It’s been an unprecedented couple of years for everyone – but a particularly frantic one for cyber security leaders. The pandemic led to a huge rise in remote working, with all the extra risks involved in putting users outside the corporate perimeter. The home environment then became a new attack vector, and as a result there was a huge increase in ransomware, affecting individuals and enterprises. And then, just as lockdowns started to ease, Russia’s invasion of Ukraine brought new nation-state threats that may yet become even more serious. For chief information security officers (CISOs), managing constant change and emerging threats is becoming the norm. In this essential guide to information security in 2022, we examine the key strategies, latest innovations and leadership insights – and highlight the importance of collaboration across the cyber community to keep everyone secure. Continue Reading

Podcast: War, geo-political risk, data storage and compliance

We talk to Mathieu Gorge, CEO of Vigitrust, about impacts on compliance and data storage from instability in geo-political events, such as the Russian invasion of Ukraine Continue Reading

By

• Antony Adshead, Storage Editor

Attackers enlist cloud providers in large HTTPS DDoS hit

A recent large-scale DDoS incident shows how cyber criminals are switching up their tactics to conduct more sophisticated attacks Continue Reading

By

• Alex Scroxton, Security Editor

Orange Business Services delivers global SD-WAN to Siemens

Digital services company and global enterprise division of the global telco teams with leading German technology firm to complete what is said to be one of the largest software-defined wide area network deployments in the world, covering 1,168 worldwide locations across 94 countries Continue Reading

By

• Joe O’Halloran, Computer Weekly

Totting up a decade of ones and zeros at the ODI

As the Open Data Institute turns 10, managing director Louise Burke reflects on its first decade and what comes next Continue Reading

By

• Louise Burke

Sender Policy Framework (SPF)

Sender Policy Framework (SPF) is a protocol designed to restrict who can use an organization's domain as the source of an email message. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

man-in-the-middle attack (MitM)

A man-in-the-middle (MitM) attack is a type of cyber attack in which the attacker secretly intercepts and relays messages between two parties who believe they are communicating directly with each other. Continue Reading

By

• Kinza Yasar, Technical Writer
• Michael Cobb

Ransomware recovery costs dwarf actual ransoms

The cost of recovering from a ransomware attack far outweighs the ransoms now being demanded by cyber criminals, according to recent data Continue Reading

By

• Alex Scroxton, Security Editor

SoftBank invests in Aryaka for international SD-WAN service, SD-core

With the objective of shoring up its international networking service, enabling a flexible and highly secure network that meets overseas customer needs, Japanese multinational upgrades software-defined wide area network and core Continue Reading

By

• Joe O’Halloran, Computer Weekly

Manufacturer sues JPMorgan after cyber criminals stole $272m

Manufacturer files lawsuit alleging that US bank failed to inform it of suspicious transaction activity Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Russia plumbs new depths in cyber war on Ukraine

Microsoft details cyber attacks on Ukrainian civilian communications, nuclear safety authorities, and the exploitation of the destruction of Mariupol in a phishing campaign Continue Reading

By

• Alex Scroxton, Security Editor

CIOs have the greatest impact on business

Chief information officers see their role as core in building out the IT and security infrastructure and talent pool that their organisations require to grow post-pandemic Continue Reading

By

• Cliff Saran, Managing Editor

Log4Shell, ProxyLogon, ProxyShell among most exploited bugs of 2021

These 15 CVEs were the most commonly exploited last year, and if you haven’t mitigated against them, now is the time Continue Reading

By

• Alex Scroxton, Security Editor

Russia-supporting cyber crime gang claims Coca-Cola as victim

Stormous cyber crime collective claims to have stolen 161GB of data from Coca-Cola, and says it plans to sell it off Continue Reading

By

• Alex Scroxton, Security Editor

Leeds Beckett’s ethical hacking platform wins Innovate UK backing

An ethical hacking and cyber education platform developed at Leeds Beckett University has received a major funding boost to help it launch commercially Continue Reading

By

• Alex Scroxton, Security Editor

BT, Toshiba team on first commercial trial of quantum secured network with EY

Revolutionary computer infrastructure to be used in trial of management consultancy’s aim to connect quantum secure data transmission between its major London offices Continue Reading

By

• Joe O’Halloran, Computer Weekly

Ransomware victims paying out when they don’t need to

Sophos’s annual State of Ransomware report shows dramatic increases in the impact of ransomware attacks, but also finds many organisations are paying ransoms when they don’t need to Continue Reading

By

• Alex Scroxton, Security Editor

Emotet tests new tricks to thwart enhanced security

The operators of the Emotet botnet seem to be trying to find a way to get around recent changes made by Microsoft to better protect its users Continue Reading

By

• Alex Scroxton, Security Editor

Did HMRC really 'lock taxpayers out' from their online accounts?

Did HM Revenue & Customs (HMRC) really “lock taxpayers out” from their online accounts, as The Guardian has claimed? It’s a situation that arose from a predictable and – according to HMRC – ... Continue Reading

By

• Bryan Glick, Editor in chief

Coralogix makes foray into cyber security with Snowbit

Observability platform supplier Coralogix has set up a cyber security venture and a global security resource centre in India to tap the growth opportunities in the subcontinent Continue Reading

By

• Pratima Harigunani

The latest salary trends for IT professionals

In this week’s Computer Weekly, the results of our annual salary survey show pay returning to pre-pandemic levels and work-life balance a growing consideration. As sustainability becomes a critical issue, we look at how datacentres can meet emissions targets. And we find out how IT leaders can help protect children online. Read the issue now. Continue Reading

It takes a village: Protecting kids online is everyone’s responsibility

The rapid uptake of smartphones among children has contributed to the increasing number of cases of cyber bullying and online grooming. Is this an educational issue or a cultural problem, and can modern enterprise help? Continue Reading

US mobile network emerges as latest Lapsus$ victim

Lapsus$ extortion gang hit T-Mobile and attempted to perform SIM-swapping attacks and code theft Continue Reading

By

• Alex Scroxton, Security Editor

Sophos soaks up SOC.OS

Sophos says acquisition of BAE spinout SOC.OS will enhance its managed threat and extended detection and response services Continue Reading

By

• Alex Scroxton, Security Editor

Mimecast makes deeper push into ASEAN

Mimecast opens regional office in Singapore and is looking at setting up a datacentre in Southeast Asia as it makes a deeper push into the region Continue Reading

By

• Aaron Tan, TechTarget

Top 7 metaverse tech strategy do's and don'ts

Technology and business leaders must be strategic when entering the new world of metaverse projects. Here are critical tips that help provide guidance. Continue Reading

By

• Mary K. Pratt

What’s up with Conti and REvil, and should we be worrying?

New intelligence on some of the world’s most prolific ransomware gangs suggests recent disruption to their activities was like water off a duck’s back Continue Reading

By

• Alex Scroxton, Security Editor

Singing the key management blues

We need cryptographic keys, but who is going to manage them? How do you make an obscure topic like cryptographic key management interesting? And can you then persuade people to move this security ... Continue Reading

By

• Bryan Betts, Freeform Dynamics

How Adnovum is leveraging its Swiss roots

Software company Adnovum is leveraging its strengths in identity and access management and its Swiss heritage as it expands into new markets and areas such as zero-trust security Continue Reading

By

• Aaron Tan, TechTarget

UAE bolsters cyber security

The United Arab Emirates has successfully improved its security posture amid mounting cyber threats Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Finance regulator identifies challenger bank financial crime weaknesses

Financial Conduct Authority review finds challenger banks need to do more to prevent their platforms being used to commit financial crime, such as money laundering Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Zoom adds new round of cyber security enhancements

Videoconferencing platform Zoom adds multiple third-party security certifications and service enhancements Continue Reading

By

• Alex Scroxton, Security Editor

Five Eyes in new Russia cyber warning

Latest cross-body alert warns of Russian threat to utilities and other core elements of national infrastructure Continue Reading

By

• Alex Scroxton, Security Editor

Impact of Lapsus$ attack on Okta less than feared

Okta’s investigation into Lapsus$ breach of its systems via a Sitel workstation has concluded that the impact was significantly less than the maximum potential Continue Reading

By

• Alex Scroxton, Security Editor

security information management (SIM)

Security information management (SIM) is the practice of collecting, monitoring and analyzing security-related data from computer logs and various other data sources. Continue Reading

By

• Rahul Awati

Check Point seeks to plug cyber security gap

The cyber security software provider is shoring up its sales force and partner ecosystem to address the security needs of small and mid-sized businesses in a region that is highly targeted by threat actors Continue Reading

India’s cyber security industry doubles in size during the Covid-19 pandemic

India’s revenues from cyber security products and services reached $9.85bn in 2021 thanks to rapid digitisation and regulatory attention on data and privacy Continue Reading

How to mitigate edge security threat

The move to the edge expands an organisation’s attack surface. Aaron Tan highlights some measures that organisations can take to minimise their edge security risks Continue Reading

CW APAC: Trend Watch: Cyber security

Protection from malicious actors has become a critical consideration for organisations in recent years. In this handbook, focused on cyber security in the Asia-Pacific region, Computer Weekly looks at how to minimise edge security risks, India’s rise in cyber security revenues, Check Point’s sales force and partner ecosystem processes, and Trellix’s decision to democratise XDR access Continue Reading

One-third of scams that hit TSB are impersonation fraud

TSB reports an increase in fraudsters impersonating trusted organisations to trick consumers into making payments to them Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

WLAN Authentication and Privacy Infrastructure (WAPI)

WLAN Authentication and Privacy Infrastructure (WAPI) is a wireless local area network security standard officially supported by the Chinese government. Continue Reading

By

• Rahul Awati

Home secretary Priti Patel to decide whether to extradite Assange

Home secretary will decide in four weeks whether to approve Julian Assange’s extradition to the US, where he faces espionage and hacking charges Continue Reading

By

• Bill Goodwin, Computer Weekly

AWS fixes vulnerabilities in Log4Shell hot patch

AWS issues fixes for a series of Log4Shell hot patches after they turned out to leave its services vulnerable to further exploitation Continue Reading

By

• Alex Scroxton, Security Editor

NSO Group faces court action after Pegasus spyware used against targets in UK

Three human rights activists whose phones were targeted by spyware traced to Saudi Arabia and the United Arab Emirates have begun legal action against both countries and Israel’s NSO Group Technologies Continue Reading

By

• Bill Goodwin, Computer Weekly

Median threat actor ‘dwell time’ dropped during 2021

Security teams appear to be getting better at detecting attackers within their networks, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Hammers sign Acronis as backup and security in one

West Ham United set to replace separate backup from Veeam and a variety of security products with Acronis Cyber Protect to have backup, data protection and file share on a single platform Continue Reading

By

• Antony Adshead, Storage Editor

Windows 7 and XP still more popular than Windows 11

Lansweeper audit of Windows devices finds more people are running unsupported Windows operating systems than the newest release Continue Reading

By

• Cliff Saran, Managing Editor

mail bomb

A mail bomb is a form of a denial-of-service (DoS) attack designed to overwhelm an inbox or inhibit a server by sending a massive number of emails to a specific person or system. Continue Reading

By

• Andrew Zola

Lack of expertise hurting UK government’s cyber preparedness

UK government bodies and critical infrastructure owners cite a lack of staff resources, and internal and external expertise, as hampering factors when it comes to cyber readiness, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Kyndryl kindles cyber incident recovery pact with Dell

IBM spin-out Kyndryl hops into bed with Dell Technologies in a joint cyber resilience proposition Continue Reading

By

• Alex Scroxton, Security Editor

Zhadnost DDoS botnet deployed against Finland

A coordinated DDoS attack hit two government ministries in Finland at the same time as Ukrainian president Volodymyr Zelensky delivered a virtual address to the Finnish parliament Continue Reading

By

• Alex Scroxton, Security Editor

Incontroller ICS malware has ‘rare, dangerous’ capabilities, says Mandiant

Mandiant joins a growing chorus of warnings over novel nation state threats to ICS systems Continue Reading

By

• Alex Scroxton, Security Editor

Government agrees bulk surveillance powers fail to protect journalists and sources

Campaign group Liberty to launch legal appeal that will call for journalists to receive stronger legal protections from state surveillance Continue Reading

By

• Bill Goodwin, Computer Weekly

WatchGuard firewall users urged to patch Cyclops Blink vulnerability

The US authorities have seen fit to add the WatchGuard vulnerability used by Sandworm to build the Cyclops Blink botnet to its list of must-patch vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches two zero-days, 10 critical bugs

Patch Tuesday is here once again. This month, security teams must fix two privilege escalation zero-days in the Windows Common Log File System Driver and the Windows User Profile Service Continue Reading

By

• Alex Scroxton, Security Editor

Criminals researched hacking TTPs post-breach in ‘messy’ cyber attack

Sophos shares details of a cyber attack that saw attackers hang out in their victim environment for five months while they prepared to sow further mischief Continue Reading

By

• Alex Scroxton, Security Editor

More ANZ organisations warm to DevSecOps

About four in 10 organisations in Australia and New Zealand are undertaking the transition to development, security and operations, while a further 36% plan to do so in 2022, study finds Continue Reading

By

• Aaron Tan, TechTarget

Universal IAM policy failings put cloud environments at risk

Almost all organisations lack appropriate IAM policy controls to effectively secure their data in the cloud, according to a damning study Continue Reading

By

• Alex Scroxton, Security Editor

Multiple arrests made in RaidForums takedown

A Portuguese national and a 21-year-old man from Croydon are among a number of individuals arrested ahead of the closure of RaidForums by police Continue Reading

By

• Alex Scroxton, Security Editor

Sandworm rolls out Industroyer2 malware against Ukraine

A second generation of the Sandworm-linked Industroyer malware has been identified by ESET researchers and Ukraine’s national CERT Continue Reading

By

• Alex Scroxton, Security Editor

AI researcher says police tech suppliers are hostile to transparency

Expert witness in Lords police tech inquiry welcomes committee’s findings but questions whether its recommendations on how to end the ‘Wild West’ of police artificial intelligence and algorithmic technologies in the UK would be implemented Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor