IT security

Home secretary Priti Patel to decide whether to extradite Assange

Home secretary will decide in four weeks whether to approve Julian Assange’s extradition to the US, where he faces espionage and hacking charges Continue Reading

By

• Bill Goodwin, Computer Weekly

AWS fixes vulnerabilities in Log4Shell hot patch

AWS issues fixes for a series of Log4Shell hot patches after they turned out to leave its services vulnerable to further exploitation Continue Reading

By

• Alex Scroxton, Security Editor

NSO Group faces court action after Pegasus spyware used against targets in UK

Three human rights activists whose phones were targeted by spyware traced to Saudi Arabia and the United Arab Emirates have begun legal action against both countries and Israel’s NSO Group Technologies Continue Reading

By

• Bill Goodwin, Computer Weekly

Median threat actor ‘dwell time’ dropped during 2021

Security teams appear to be getting better at detecting attackers within their networks, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Hammers sign Acronis as backup and security in one

West Ham United set to replace separate backup from Veeam and a variety of security products with Acronis Cyber Protect to have backup, data protection and file share on a single platform Continue Reading

By

• Antony Adshead, Storage Editor

Windows 7 and XP still more popular than Windows 11

Lansweeper audit of Windows devices finds more people are running unsupported Windows operating systems than the newest release Continue Reading

By

• Cliff Saran, Managing Editor

mail bomb

A mail bomb is a form of a denial-of-service (DoS) attack designed to overwhelm an inbox or inhibit a server by sending a massive number of emails to a specific person or system. Continue Reading

By

• Andrew Zola

Lack of expertise hurting UK government’s cyber preparedness

UK government bodies and critical infrastructure owners cite a lack of staff resources, and internal and external expertise, as hampering factors when it comes to cyber readiness, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Kyndryl kindles cyber incident recovery pact with Dell

IBM spin-out Kyndryl hops into bed with Dell Technologies in a joint cyber resilience proposition Continue Reading

By

• Alex Scroxton, Security Editor

Zhadnost DDoS botnet deployed against Finland

A coordinated DDoS attack hit two government ministries in Finland at the same time as Ukrainian president Volodymyr Zelensky delivered a virtual address to the Finnish parliament Continue Reading

By

• Alex Scroxton, Security Editor

Incontroller ICS malware has ‘rare, dangerous’ capabilities, says Mandiant

Mandiant joins a growing chorus of warnings over novel nation state threats to ICS systems Continue Reading

By

• Alex Scroxton, Security Editor

Government agrees bulk surveillance powers fail to protect journalists and sources

Campaign group Liberty to launch legal appeal that will call for journalists to receive stronger legal protections from state surveillance Continue Reading

By

• Bill Goodwin, Computer Weekly

WatchGuard firewall users urged to patch Cyclops Blink vulnerability

The US authorities have seen fit to add the WatchGuard vulnerability used by Sandworm to build the Cyclops Blink botnet to its list of must-patch vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches two zero-days, 10 critical bugs

Patch Tuesday is here once again. This month, security teams must fix two privilege escalation zero-days in the Windows Common Log File System Driver and the Windows User Profile Service Continue Reading

By

• Alex Scroxton, Security Editor

Criminals researched hacking TTPs post-breach in ‘messy’ cyber attack

Sophos shares details of a cyber attack that saw attackers hang out in their victim environment for five months while they prepared to sow further mischief Continue Reading

By

• Alex Scroxton, Security Editor

More ANZ organisations warm to DevSecOps

About four in 10 organisations in Australia and New Zealand are undertaking the transition to development, security and operations, while a further 36% plan to do so in 2022, study finds Continue Reading

By

• Aaron Tan, Informa TechTarget

Universal IAM policy failings put cloud environments at risk

Almost all organisations lack appropriate IAM policy controls to effectively secure their data in the cloud, according to a damning study Continue Reading

By

• Alex Scroxton, Security Editor

Multiple arrests made in RaidForums takedown

A Portuguese national and a 21-year-old man from Croydon are among a number of individuals arrested ahead of the closure of RaidForums by police Continue Reading

By

• Alex Scroxton, Security Editor

Sandworm rolls out Industroyer2 malware against Ukraine

A second generation of the Sandworm-linked Industroyer malware has been identified by ESET researchers and Ukraine’s national CERT Continue Reading

By

• Alex Scroxton, Security Editor

AI researcher says police tech suppliers are hostile to transparency

Expert witness in Lords police tech inquiry welcomes committee’s findings but questions whether its recommendations on how to end the ‘Wild West’ of police artificial intelligence and algorithmic technologies in the UK would be implemented Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Singapore to start licensing cyber security service providers

Those providing penetration testing and SOC services will need to apply for a licence under a new licensing regime that is expected to safeguard consumer interests and improve service standards Continue Reading

By

• Aaron Tan, Informa TechTarget

Border IT system fixed after 10-day outage

Post-Brexit border IT system failure fixed after going down at the start of April, allowing traders to once again file customs documents electronically rather than by hand Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Open source CMS platform Directus patches XSS bug

A stored cross-site scripting vulnerability in the Directus platform could have enabled malicious actors to gain access to valuable data Continue Reading

By

• Alex Scroxton, Security Editor

We must target a broad church to fill vacant cyber roles

The security industry focuses a lot on cyber-specific specialisms and technical skills, but it could really benefit from widening its search. Take it from a social anthropologist Continue Reading

By

• Alex Scroxton, Security Editor

Raspberry Pi Foundation ditches default username policy

Raspberry Pi owners will no longer be able to use the default ‘pi’ username, as the Raspberry Pi Foundation clamps down on insecure practices Continue Reading

By

• Alex Scroxton, Security Editor

Just How Secure Are You?

Back in the autumn of last year, I talked about a vendor – Bugcrowd – that doesn’t simply rely on AI and ML within a microchip, but actually uses real flesh and bone people (AKA ethical hackers) to ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Nordic countries discuss joint cyber defence capability

Nordic countries are in talks to increase their cyber defences in the face of the threat from Russia Continue Reading

By

• Gerard O'Dwyer

EncroChat: France says ‘defence secrecy’ in police surveillance operations is constitutional

Constitutional court finds that invoking ‘defence secrecy’ to withhold information about the state hacking of EncroChat cryptophones is constitutional. Defence lawyers now head for the supreme court Continue Reading

By

• Bill Goodwin, Computer Weekly

Ukrainian cyber criminal gets five years in jail

A US court has sentenced Denys Iarmak, who worked as a penetration tester for the FIN7 cyber crime group, to a five-year prison sentence Continue Reading

By

• Alex Scroxton, Security Editor

Was Spring4Shell a lot of hot air? No, but...

Find out why Spring4Shell was apparently not as impactful a security problem as many had at first feared, and why it’s on the cyber community as a whole to do better Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill: Collaborating to make the internet safer for all

The UK government's plan to regulate the internet and social media includes some positive and progressive measures – but by working with industry, a lot more could be achieved Continue Reading

By

• Martin Wilson

US shuts down Russia’s Cyclops Blink botnet operation

Operation by US authorities has taken the Russia-attributed Cyclops Blink botnet ‘off the board’ Continue Reading

By

• Alex Scroxton, Security Editor

MPs and editors sound alarm over threat to Freedom of Information

Government secrecy and trend for departments to block Freedom of Information requests pose a long-term risk to accountability Continue Reading

By

• Bill Goodwin, Computer Weekly

CW Middle East: UAE and UK researchers work on ‘trustworthy’ cloud OS for datacentres

Imperial College London is embarking on a three-year project with an Abu Dhabi-based group of researchers to find ways for datacentre operators and cloud providers to secure their infrastructure. Also read how Dubai is positioning itself to reap the benefits of a promising global market for drone technology. Continue Reading

The rise and rise of blockchain technology

The growing use of blockchain across Asia-Pacific is set to continue, with spending on the technology slated to hit $2.4bn this year, according to IDC Continue Reading

By

• Aaron Tan, Informa TechTarget

Apple criticised over unpatched CVEs in Catalina, Big Sur

Apple patched two zero-days in macOS Monterey last week, but did not address the same issue in Catalina or Big Sur, raising questions Continue Reading

By

• Alex Scroxton, Security Editor

Denonia malware may be first to target AWS Lambda

The newly discovered Denonia malware appears to be custom designed to target AWS Lambda environments, and may be the first of its kind Continue Reading

By

• Alex Scroxton, Security Editor

Hydra takedown merely shifts cyber criminal problem elsewhere

The seizure of the Hydra dark web marketplace is a positive development in the fight against cyber crime, but will only be a temporary setback for determined criminals Continue Reading

By

• Alex Scroxton, Security Editor

Scoop: Zero Trust Network Access Becomes Your Flexible Friend!

In my last blog, I highlighted the ongoing debate within IT security that is zero trust or, to use the full acronym, ZTNA (Zero Trust Network Access) and that – in theory, at least – it is kind of ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Does Anyone Trust Zero Trust?

Has there been a more over-used term within IT security over the past few years than “zero trust”? Answers in the virtual black box at the back of the virtual room (in the virtual universe). I ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Secrecy over police EncroChat hacking is unconstitutional, defence lawyers tell top French court

France’s constitutional court, the Conseil Constitutionnel, has heard arguments that the use of ‘defence secrecy’ to withhold information about police surveillance operations breaches the French constitution Continue Reading

By

• Bill Goodwin, Computer Weekly

Discount retailer The Works hit by cyber attack

A small number of The Works’ bricks-and-mortar stores were forced to close amid a cyber attack of an undisclosed nature Continue Reading

By

• Alex Scroxton, Security Editor

SOC 1 (System and Organization Controls 1)

System and Organization Controls 1, or SOC 1 (pronounced "sock one"), aims to control objectives within a SOC 1 process area and documents internal controls relevant to an audit of a user entity's financial statements. Continue Reading

By

• Andrew Zola
• Alex DelVecchio, Content Development Strategist

content filtering

Content filtering is a process involving the use of software or hardware to screen and/or restrict access to objectionable email, webpages, executables and other suspicious items. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor
• Andrew Zola

Triple-threat Borat malware no joke for victims

Unlike its namesake, the newly discovered Borat malware won’t raise a smile for IT security pros Continue Reading

By

• Alex Scroxton, Security Editor

IBM z16 tackles financial fraud and quantum hacks

New addition to Z series mainframe family uses IBM Telum processor to accelerate AI for real-time credit card fraud detection Continue Reading

By

• Cliff Saran, Managing Editor

US offers concessions on surveillance and privacy as EU and US agree successor to Privacy Shield

 Continue Reading

How remote browser isolation can mitigate cyber threats

Remote browser isolation can help to mitigate browser-based attacks by separating a user’s browsing activity from the device Continue Reading

By

• Aaron Tan, Informa TechTarget

Two teenagers charged with Lapsus$ cyber attacks

City of London Police have charged two teenagers in connection with the Lapsus$ cyber crime spree Continue Reading

By

• Alex Scroxton, Security Editor

Four moves to ‘checkmate’ critical assets thanks to lax cloud security

Malicious actors can compromise 94% of critical assets within four steps of the initial breach point, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Apple drops emergency patches for two zero-days

Apple has fixed two zero-day vulnerabilities that appear to have been actively exploited in the wild Continue Reading

By

• Alex Scroxton, Security Editor

TechUK calls on government to seize post-Brexit data opportunities

Ahead of the government’s reply to its late 2021 consultation about proposed post-Brexit reforms to the data protection regime, TechUK has published a paper declaring six data governance principles Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Global upheaval shows cyber security isn’t good enough, says GCHQ director

Generational global upheaval has laid bare significant gaps in national cyber strategies, GCHQ chief Jeremy Fleming has said in a speech Continue Reading

By

• Alex Scroxton, Security Editor

Bank fraud prevention scheme blocked £60m in fraud last year

Scheme to catch fraudsters, including online scammers, before they commit their crimes has reported a significant increase in crimes prevented Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Lapsus$ cyber crime spree continues despite arrests

The arrests of seven people in connection with the Lapsus$ cyber crime group has not dented the gang’s enthusiasm for causing chaos Continue Reading

By

• Alex Scroxton, Security Editor

Spring4Shell zero-day sprung on security teams

Some are describing a newly disclosed Spring Java framework vulnerability as the next Log4Shell, but what is Spring4Shell, and what can we do about it? Continue Reading

By

• Alex Scroxton, Security Editor

One-third of UK firms suffer a cyber attack every week

New statistics from the annual DCMS Cyber security breaches survey reveal the extent and frequency with which UK organisations are being attacked by malicious actors Continue Reading

By

• Alex Scroxton, Security Editor

Recruitment risks: Avoiding the dangers of fraudulent candidates

Tech companies are seeing an increase in fraudulent job applications, with associated impacts on risk and cyber security. So how can organisations protect themselves from fraudulent applicants while ensuring they recruit the best talent? Continue Reading

By

• Peter Ray Allison

Australia to spend A$9.9bn on intelligence and cyber capabilities

The Morrison government is investing in a landmark package of measures to shore up the intelligence and cyber security capabilities of the Australian Signals Directorate Continue Reading

By

• Stephen Withers

Overhaul of UK police tech needed to prevent abuse

Lords inquiry finds UK police are deploying artificial intelligence and algorithmic technologies without a thorough examination of their efficacy or outcomes, and are essentially ‘making it up as they go along’ Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

NCSC: Not necessarily wise to ditch Kaspersky

UK’s National Cyber Security Centre issues refreshed guidance on organisations’ usage of technology and services of Russian origin, but stops short of advising users to expunge all Russian products from their IT estates Continue Reading

By

• Alex Scroxton, Security Editor

Wave of Log4j-linked attacks targeting VMware Horizon

Sophos issues a new warning to organisations that have so far failed to patch their VMware Horizon servers against Log4Shell Continue Reading

By

• Alex Scroxton, Security Editor

FCA reports 52% jump in security incidents

The Financial Conduct Authority received 116 cyber incident reports in 2021, a fifth of them involving ransomware Continue Reading

By

• Alex Scroxton, Security Editor

Ten years of the Raspberry Pi

In this week’s Computer Weekly, as the Raspberry Pi reaches its 10th anniversary, we look back on how the low-cost computing device went from schools to supercomputers and even into space. Gartner offers tips on how to motivate IT staff in a hybrid working environment. And we meet the Dutch hackers helping to secure the internet. Read the issue now. Continue Reading

Singapore rolls out cyber security certification scheme

Two new cyber security marks are expected to provide an edge for Singapore businesses with good cyber security practices Continue Reading

By

• Aaron Tan, Informa TechTarget

IT professionals wary of government campaign to limit end-to-end encryption

Members of the Chartered Institute of IT, the professional body for technology professionals in the UK, warn against limiting end-to-end encryption Continue Reading

By

• Bill Goodwin, Computer Weekly

US offers concessions on surveillance and privacy as EU and US agree successor to Privacy Shield

EU and US agree data privacy framework allowing trans-Atlantic data transfers after US offers concessions on surveillance and new rights of redress for EU citizens Continue Reading

By

• Bill Goodwin, Computer Weekly

How Dutch hackers are working to make the internet safe

We hear how the personal mission of a Dutch hacker grew into a serious organisation with international ambitions Continue Reading

European Commission proposes new cyber security regulations

New cyber and information security regulations have been proposed by the European Commission to create a minimum set of standards in both areas Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

London police arrest seven in connection to Lapsus$

Seven people arrested by London police over cyber attacks carried out by Lapsus$ group, which is responsible for a number of recent, high profile attacks Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How Lapsus$ exploited the failings of multifactor authentication

Attacks on Nvidia and Okta highlight weak MFA and the risk of employees being bribed or falling victim to social engineering Continue Reading

By

• Cliff Saran, Managing Editor

Striking a balance between risk and innovation: Lessons from an autonomous ship

I wasn’t sure what to expect when I turned up for an event at the Historic Dockyards in Portsmouth, UK. The planned star of the show - an unmanned ship called Mayflower 400 - couldn’t actually be ... Continue Reading

By

• Dale Vile, Freeform Dynamics

Anonymous claims it has hacked the Central Bank of Russia

Hackers operating under the Anonymous banner claim to have stolen more than 35,000 sensitive files from the Central Bank of Russia as part of its cyber war against the Russian state Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Ransomware demands and payments increase with use of leak sites

Ransomware demands and payments continue to climb as gangs increasingly turn to Dark Web leak sites to add pressure on victims Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

The Security Interviews: Red gets automated

We speak to Jack Stockdale, CTO of Darktrace, about Cambridge’s strong data analytics and artificial intelligence links and the role of AI in cyber security Continue Reading

By

• Cliff Saran, Managing Editor

The Importance of CASB And Its Limitations

It’s been over two years since I introduced the Gartner-defined SASE (“sassy”) to my CW readers – in that time the world has changed somewhat, but the requirement for an intensified, integrated ... Continue Reading

By

• Steve Broadhead, Broadband Testing

How India organisations can mitigate cyber threats

Organisations in India will need to invest more in cloud security, gain more visibility into their systems and improve security awareness among employees to fend off cyber attacks Continue Reading

By

• Pratima Harigunani

Hiring and retention challenges in cyber security persist

Latest ISACA report shows that enterprises are struggling to find and retain cyber security talent Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Private equity house spins SSE company out of McAfee Enterprise

The launch of Skyhigh Security completes division of McAfee Enterprise into separate businesses by Symphony Technology Group, which acquired the long-standing cyber security firm for $4bn in March 2021 Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

NHS urgent care provider uses ID and access management to reduce complexity for clinicians

Provider of care through NHS 111 is using a cloud-based identity and access management system to remove the need for clinicians to remember multiple passwords Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Biden issues warning about Russian cyber attacks

President Biden has said that US companies running critical infrastructure should immediately harden their defences in anticipation of potential cyber attacks from Russia Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Details of Conti ransomware affiliate released

Information about a new Conti affiliate has been released by eSentire and BreakPoint Lab after a joint investigation into the group’s indicators of compromise Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Revised scope of UK security strategy reflects digitised society

The omission of the word ‘security’ from the title of the UK government’s new National Cyber Strategy is a telling one, reflecting our increasingly digitised society, say Maximillian Brook and Arunoshi Singh of the ISF Continue Reading

By

• Maximillian Brook & Arunoshi Singh

One year on from IR35 reforms – why IT skills are harder to find

In this week’s Computer Weekly, a year after IR35 tax reforms were introduced, we assess the impact on the UK’s IT talent pool – and it’s not looking good. We examine the rise of industry clouds, and how they are changing the market. And we find out how London councils plan to work together on data and innovation. Read the issue now. Continue Reading

Siloed data holding back coordinated health responses

Digital health experts discuss the role of data in coordinating the NHS’s pandemic response and how managing privacy and governance issues are key to further success Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Sarbanes-Oxley Act (SOX) Section 404

Sarbanes-Oxley Act (SOX) Section 404 mandates that all publicly traded companies must establish internal controls and procedures for financial reporting and must document, test, and maintain those controls and procedures to ensure their effectiveness. Continue Reading

By

• Katie Terrell Hanna

mutual authentication

Mutual authentication, also called two-way authentication, is a process or technology in which both entities in a communications link authenticate each other. Continue Reading

By

• Paul Kirvan

How 2022’s most significant data privacy trends affect your organisation

Data privacy and protection are now core responsibilities for most, but as we all know by now, compliance is a moving target. Here, expert Alan Calder looks ahead at what to expect in the coming months Continue Reading

By

• Alan Calder, IT Governance

UK Cyber Strategy a welcome injection of progress

The National Cyber Strategy should be seen as a welcome injection of both focus and investment in bettering cyber defence for everyone, says Turnkey Consulting senior consultant Louise Barber Continue Reading

By

• Louise Barber, Turnkey Consulting

COPPA (Children's Online Privacy Protection Act )

The Children's Online Privacy Protection Act of 1998 (COPPA) is a federal law that imposes specific requirements on operators of websites and online services to protect the privacy of children under 13. Continue Reading

By

• Katie Terrell Hanna

Russia-Ukraine war has tech buyers reassessing spending

The Russia-Ukraine war, which affects everything from inflation to chip availability, has left half of enterprise tech leaders reassessing IT and communication spending, IDC said. Continue Reading

By

• Madelaine Millar, TechTarget

The state of digital identity in the UK - such a great idea, you'll need a whole bunch of them

The promise of digital identity is a simple one: Prove once that you are who you say you are, and then forever more you have a single method to log in to any online service you choose. No more ... Continue Reading

By

• Bryan Glick, Editor in chief

Dark web littered with Ukraine crypto scammers

Cryptocurrency scammers are actively targeting people trying to donate funds to support Ukraine Continue Reading

By

• Alex Scroxton, Security Editor

Ukrainian cyber defences prove resilient

Thanks to a combination of prior experience and global support, Ukraine’s defences against cyber incidents are holding strong in the face of Russian attacks Continue Reading

By

• Alex Scroxton, Security Editor

National Cyber Strategy will enhance UK’s cyber power status

The UK punches above its weight when it comes to wielding cyber power around the world, but challenges to this status are clear. The National Cyber Strategy has a clear role to play in maintaining and enhancing this status, writes Paddy Francis of Airbus Cybersecurity Continue Reading

By

• Paddy Francis

NCSC catches 10 million phishes

Nation Cyber Security Centre’s scam email reporting service enjoys great success as government embarks on new cyber awareness campaign Continue Reading

By

• Alex Scroxton, Security Editor

Kaspersky CEO: Ukraine war must end through diplomacy

Eugene Kaspersky speaks out on the war in Ukraine, and rebuffs Germany’s BSI, branding its warnings over his company’s trustworthiness as insulting Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill introduced in Parliament

The government has introduced its long-awaited Online Safety Bill in Parliament, alongside new criminal offences and sanctions for tech company execs Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Alarm raised over ‘trickster’ LokiLocker ransomware

The new LokiLocker ransomware is, like its namesake, adept at tricks and misdirection, say BlackBerry researchers Continue Reading

By

• Alex Scroxton, Security Editor

Value of contactless transactions doubles in two years

Almost £166bn was spent in the UK last year using contactless technology, compared with £80.5bn in 2019 Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA