IT security

NCSC, CISA publish new information on Russia’s Cozy Bear

New intelligence from UK and US cyber agencies suggests that APT29, or Cozy Bear, has been switching up its tactics Continue Reading

By

• Alex Scroxton, Security Editor

NCSC publishes smart city security guidelines

Guidance for local authorities, IT and cyber professionals aims to ensure the security of connected, smart city projects Continue Reading

By

• Alex Scroxton, Security Editor

Cyber accreditation to improve legal standing of security pros

Institute of Cyber Digital Investigations Professionals will help incident responders and cyber investigators get the professional recognition they deserve Continue Reading

By

• Alex Scroxton, Security Editor

Securing the UK's emerging smart cities

UK councils have a huge opportunity to improve services through the use of smart city technologies - but they must avoid the cyber security risks, says the government's digital minister Continue Reading

By

• Matt Warman, Digital minister

Reddit enlists HackerOne to run public bug bounty programme

Online community platform is opening up its HackerOne bug bounty programme to any ethical hacker who cares to have a look under the bonnet Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware, supply chain attacks show no sign of abating

Security experts at Black Hat Asia 2021 discuss the state of ransomware and supply chain attacks, two of the most common attack vectors that offer high returns for threat actors Continue Reading

By

• Aaron Tan, TechTarget

kill switch

A kill switch in an IT context is a mechanism used to shut down or disable a device or program. Continue Reading

By

• TechTarget Contributor

Government urged to add scam protections to Online Safety Bill

Group of organisations calls for the government to use the Online Safety Bill to protect people from cyber scams Continue Reading

By

• Alex Scroxton, Security Editor

Scammers accidentally reveal fake Amazon review data

More than 13 million records relating to an organised fake review scam have been found on an unsecured ElasticSearch database, implicating hundreds of thousands of people in unethical behaviour Continue Reading

By

• Alex Scroxton, Security Editor

Google to introduce mandatory MFA for users

In future, holders of Google accounts will have no option but to use multifactor authentication if they want to use the firm’s services Continue Reading

By

• Alex Scroxton, Security Editor

HSBC blocks £249m in UK fraud with voice biometrics

HSBC voice recognition technology has reduced telephone banking fraud as demand for the channel increases Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Why ITAM can aid IT-fuelled business recovery

As a sense of normality returns, we look at why IT asset management is the stealth tool for clearing a path towards greater digitisation Continue Reading

By

• Cliff Saran, Managing Editor

Dysfunctional cyber, network teams disrupt digital transformation

Despite shared goals, combative and dysfunctional relationships within specialist tech teams are putting digital transformation projects at risk, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Sophos: How timely intervention stopped a ProxyLogon attack

A recent incident at an undisclosed customer sheds new light on how malicious actors exploit unpatched Microsoft Exchange servers Continue Reading

By

• Alex Scroxton, Security Editor

How GCHQ proposes to implement and use ethical AI

The rise of cyber crime and the escalating threat vectors facing the UK have led GCHQ to invest in automated threat detection and response systems to meet this challenge, as well as liaising with the private sector for the first time Continue Reading

By

• Peter Ray Allison

Deploying productivity monitoring software ethically

While software that tracks the activities of staff can be helpful to companies with a remote workforce, managers must consider employees’ concerns and privacy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Half of organisations breached via a third party in 12 months

New report highlights the risks of outsourcing key business processes without paying due care and attention to your service provider’s security Continue Reading

By

• Alex Scroxton, Security Editor

The practical steps needed to accelerate a UK digital identity ecosystem

The draft digital identity framework published by the UK government highlights the importance of learning from the private sector and existing standards to accelerate deployment and citizen adoption Continue Reading

By

• Martin Wilson, Digital Identity Net

New standard to simplify IoT device onboarding

Fido Alliance’s device onboarding protocol will automate the process of connecting internet-of-things devices to device management platforms while improving security Continue Reading

By

• Aaron Tan, TechTarget

EncroChat: Top lawyer warned CPS of risk that phone hacking warrants could be unlawful

Lord David Anderson QC warned prosecutors that there were formidable arguments against the lawfulness of a police operation to infiltrate the encrypted phone network, EncroChat Continue Reading

By

• Bill Goodwin, Computer Weekly

MPs accuse government of unduly interfering in information commissioner appointment

Cross-party group of MPs says government is influencing the appointment of a new information commissioner by explicitly seeking a candidate who will support its policy agenda, rather than regulate independently Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

End of support for Build 1909 leaves some Windows open to attack

Biannual Windows updates free IT staff from major updates, but some people prefer older builds of Windows, which leaves a gaping security hole Continue Reading

By

• Cliff Saran, Managing Editor

The case for vaccine passports: the real world versus the digital world

What are the security issues challenges presented by vaccine passports, and how should they be designed and used with ethics and privacy in mind? Continue Reading

By

• Andy Jones and Alex Jordan

Gartner SASE 2021 Roadmap - You Know It Makes Sense...

As observed before in this blog, few of Gartner’s ‘inventions’ have caught on as quickly as SASE – Secure Access Service Edge. From traditional firewall vendors to declared SASE specialists, ... Continue Reading

By

• Steve Broadhead, Broadband Testing

G7 countries to cooperate on digital regulation

Digital and technology ministers outline their agenda for how technology can be used to facilitate the post-Covid recovery, signalling closer collaboration in key areas of the digital economy Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Northern Ireland pilots security training plan for 16-25s

Pilot scheme in Northern Ireland aims to widen access to cyber security careers Continue Reading

By

• Alex Scroxton, Security Editor

How to tackle intellectual property crime

Crimes against intellectual property are big business for organised crime groups, commercial competitors and foreign states alike. In the first of a series of legal columns, David Cowan offers a practical approach Continue Reading

By

• David Cowan, National University of Ireland, Maynooth

Covid-19 security challenges leave bank customers at risk

Challenges arising from the pandemic have left gaping holes in banking security, putting consumers at risk of fraud Continue Reading

By

• Alex Scroxton, Security Editor

Recruiters can’t afford to hold out for cyber ‘unicorns’

The perfect security candidate is hard to find, so hiring policy needs to be more pragmatic Continue Reading

By

• Alex Scroxton, Security Editor

Office 365 compromise likely led to Merseyrail ransomware attack

Compromise of Merseyrail employee data seems to have begun after a key email account was hacked Continue Reading

By

• Alex Scroxton, Security Editor

NHS App to serve as vaccine passport for foreign holidays

Existing NHS App will have vaccine passport functionality added to it, transport secretary confirms Continue Reading

By

• Alex Scroxton, Security Editor

Backup failure: Four key areas where backups go wrong

We look at the key ways that backups can fail – via software issues, hardware problems, trouble in the infrastructure and good old human error – and suggest ways to mitigate them Continue Reading

By

• Antony Adshead, Storage Editor

Applying web application reconnaissance to offensive hacking

Learn how to apply web application reconnaissance fundamentals to improve both offensive and defensive hacking skills in an excerpt of 'Web Application Security' by Andrew Hoffman. Continue Reading

By

• Katie Donegan, Social Media Manager

Collaboration is key to a secure web application architecture

Author Andrew Hoffman explains the importance of a secure web application architecture and how to achieve it through collaboration between software and security engineers. Continue Reading

By

• Katie Donegan, Social Media Manager

UK supermarkets to trial age estimation tech for alcohol purchases

Biometric age estimation technology developed by Yoti to be tested in UK supermarkets for alcohol purchases as part of government-led digital identities initiative Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Total cost of ransomware attack heading towards $2m

Sophos’ latest study finds that ransomware attacks are proving increasingly disruptive to their victims’ finances Continue Reading

By

• Alex Scroxton, Security Editor

Leaky Azure storage account puts software developer IP at risk

Source code for multiple products was left exposed in an unsecured Microsoft Azure cloud storage account, say researchers, but attributing responsibility for the error has proved difficult Continue Reading

By

• Alex Scroxton, Security Editor

Why we need to reset the debate on end-to-end encryption to protect children

Private messaging is the front line of abuse, yet E2EE in its current form risks engineering away the ability of firms to detect and disrupt it where it is most prevalent Continue Reading

By

• Andy Burrows, NSPCC

Apple OS updates patch multiple security holes

The much-heralded release of the privacy-centric iOS 14.5 also brings patches for multiple CVEs, and users of Apple smartphones, tablets and notebooks are best advised to update as soon as possible Continue Reading

By

• Alex Scroxton, Security Editor

Uber drivers’ resistance and the gig economy – Computer Weekly Downtime Upload podcast

In this episode of the Computer Weekly Downtime Upload podcast, Caroline Donnelly and Brian McKenna are joined by Sebastian Klovig Skelton to discuss the legal campaign by Uber drivers for the right to be recognised as workers Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor
• Caroline Donnelly, Senior Editor, UK
• Brian McKenna, Enterprise Applications Editor

North London school wins NCSC girls’ cyber challenge

Highgate School in North London is the winner of this year’s CyberFirst Girls security competition Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Making sense of outbound email security

Screening inbound emails is an accepted part of an organisation’s security posture, but the topic of securing outbound traffic is less often discussed. Zivver’s Rick Goud is on a mission to change this Continue Reading

By

• Alex Scroxton, Security Editor

Justice at last in Post Office IT scandal

In this week’s Computer Weekly, 12 years after we broke the story, victims of the Post Office IT scandal finally have their criminal convictions overturned. We take a virtual tour of a Microsoft datacentre and meet a server called ‘Mega-Godzilla Beast’. And we find out how technology is transforming Nationwide Building Society. Read the issue now. Continue Reading

UnitingCare Queensland hit by cyber attack

Healthcare service provider UnitingCare Queensland was reportedly hit by a ransomware attack that crippled several IT systems Continue Reading

By

• Aaron Tan, TechTarget

French legal challenge over EncroChat cryptophone hack could hit UK prosecutions

Lawyers are challenging the legality of a French police operation to harvest tens of thousands of messages from the EncroChat encrypted phone network in a move that could overturn criminal prosecutions in the UK Continue Reading

By

• Bill Goodwin, Computer Weekly

Tor browser

The Tor (the onion routing) browser is a web browser designed for anonymous web surfing and protection against traffic analysis. Continue Reading

By

• TechTarget Contributor

How Toffs is seizing Asia’s CDN market

Toffs Technologies is eyeing second- and third-tier cities in Asia as it bolsters its infrastructure and experiments with the use of home networks as content delivery networks Continue Reading

By

• Aaron Tan, TechTarget

‘Spy cops’ victims share ongoing data protection concerns

Under Cover Policing Inquiry will consider whether the extensive amount of personal data collected about left-wing activists by the Special Demonstration Squad was justified, as witnesses question whether information about them is still being collected Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

GCHQ: Cyber investment a guarantor of UK’s global status

GCHQ director Jeremy Fleming sets out a vision for the UK’s cyber security future Continue Reading

By

• Alex Scroxton, Security Editor

Researchers shed more light on APT29 activity during SolarWinds attack

RiskIQ’s Atlas threat intel team uncovers new patterns and threat infrastructure used in the SolarWind’s attacks Continue Reading

By

• Alex Scroxton, Security Editor

Automation, zero-trust, API-based security priorities for EMEA CISOs

Report by FireMon sheds light on buyer behaviour across the EMEA region Continue Reading

By

• Alex Scroxton, Security Editor

ToxicEye malware exploits Telegram messaging service

The Telegram instant messaging service is being used by malicious actors to manage a remote access trojan called ToxicEye Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Security culture must underpin vaccine passports

What are the security challenges presented by vaccine passports, and how should they be designed and used with ethics and privacy in mind? Continue Reading

By

• Mike Gillespie

NCSC offers teachers free cyber security training

The NCSC’s latest security training offer builds on a package of measures designed to protect schools from cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

EU lays out plans to regulate AI development

Proposal aims to encourage the development of ethical artificial intelligence systems that do not infringe the human rights of EU citizens Continue Reading

By

• Cliff Saran, Managing Editor

SonicWall Email Security zero-days need urgent patch

Users of SonicWall Email Security are advised to patch immediately, but the supplier is being criticised for the pace of its response Continue Reading

By

• Alex Scroxton, Security Editor

Time is running out to probe networks for Emotet

Security teams will lose an unprecedented opportunity to gain valuable intelligence to enhance their defences when Emotet is finally ‘executed’ in a few days’ time Continue Reading

By

• Alex Scroxton, Security Editor

Health app myGP adds Covid-19 vaccine passport function

The new feature is described as the UK’s first NHS-assured Covid-19 certification feature Continue Reading

By

• Alex Scroxton, Security Editor

UK’s proposed IoT cyber security law gathers momentum

New statistics appear to vindicate UK government proposals to force suppliers to be upfront about IoT security Continue Reading

By

• Alex Scroxton, Security Editor

Chinese APT exploits critical CVE in Pulse Secure VPN

A newly disclosed vulnerability in Pulse Secure’s VPN is being exploited by a Chinese advanced persistent threat group – assume compromise and mitigate today Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: ‘Legitimate interest’ crucial for vaccine passports

What are the security issues and challenges presented by vaccine passports, and how should they be designed and used with ethics and privacy in mind? Continue Reading

By

• Petra Wenham

Codecov supply chain attack has echoes of SolarWinds

Supply chain attack on code auditing service may have compromised the likes of HPE and IBM Continue Reading

By

• Alex Scroxton, Security Editor

Lack of leadership, confusion and frustration - the state of digital identity in the UK

To nobody’s surprise, efforts by a group of peers to force the government to accelerate progress on digital identity in the UK foundered in the House of Lords yesterday (20 April 2021). Baroness ... Continue Reading

By

• Bryan Glick, Editor in chief

Shop and go – will Amazon’s cashless ‘just walk out’ store work?

In this week’s Computer Weekly, Amazon has opened its first ‘just walk out’ grocery store in the UK, but is it the right time to hit the high street? We examine the human and technical issues around email security. And we analyse Microsoft’s $19bn purchase of voice recognition supplier Nuance. Read the issue now. Continue Reading

Does email security need a human solution or a tech solution?

People spend a lot of time using email systems, but many do not realise that this makes them attractive targets for cyber criminals. With education and technology, businesses can tackle this problem head-on. Continue Reading

Singapore’s ViewQwest debuts security service

ViewQwest’s SecureNet service uses Palo Alto Networks’ next-generation firewall with deep packet inspection capabilities to guard against cyber threats Continue Reading

By

• Aaron Tan, TechTarget

YouGov incentivises sharing of personally identifiable information

YouGov Safe is a new service to help organisations target consumers more precisely, where people can select how much personal data they wish to share Continue Reading

By

• Cliff Saran, Managing Editor

Government puts Facebook under pressure to stop end-to-end encryption over child abuse risks

Facebook faces growing government pressure to abandon its plans to offer users end-to-end encryption to secure the privacy of their messages as the NSPCC raises concerns about child protection Continue Reading

By

• Bill Goodwin, Computer Weekly

The Secret IR Insider’s Diary – from Sunburst to DarkSide

From dealing with SolarWinds fallout to ransomware attacks, it’s been a busy few weeks for the Secret IR Insider, but they've picked up some new tricks along the way Continue Reading

By

• The Secret IR Insider, Check Point

Finnish government strengthens country’s IT network security

Finland’s government has created a new national organisation to help public and private bodies improve network security Continue Reading

By

• Gerard O'Dwyer

Dutch accuse UK of ‘damaging confidence’ by disclosing details of EncroChat police collaboration

The Dutch Public Prosecution Service claims Britain has damaged confidence by disclosing details of an international investigation into the EncroChat encrypted phone network to the courts Continue Reading

By

• Bill Goodwin, Computer Weekly
• Sebastian Klovig Skelton, Data & ethics editor

Biden sanctions Russia over SolarWinds cyber attacks

US president imposes new sanctions on Russia following malicious cyber attacks against the US and allies Continue Reading

By

• Alex Scroxton, Security Editor

University of Hertfordshire is latest academic cyber attack victim

Multiple systems are offline at the University of Hertfordshire following a cyber attack Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft is most impersonated brand in phishing attempts

Technology companies continue to be frequently spoofed by cyber criminals in their phishing attempts Continue Reading

By

• Alex Scroxton, Security Editor

Ireland’s DPC launches probe into Facebook leak

The Irish Data Protection Commission has launched an ‘own volition’ inquiry into the leak of data from 500 million Facebook profiles Continue Reading

By

• Alex Scroxton, Security Editor

CW Middle East: Qatari regulator launches platform to help combat money laundering

The Qatar Financial Markets Authority is using a digital platform to enable financial services professionals to assess their knowledge of anti-money laundering and combating the financing of terrorism. Also in this issue, read how the Covid-19 pandemic has changed the IT spending patterns among enterprises in Saudi Arabia. Continue Reading

How Windows patching leaves security exposed

Four years on since it devastated IT systems across the NHS, WannaCry remains a threat to organisations around the world Continue Reading

By

• Cliff Saran, Managing Editor

FBI accesses ProxyLogon target servers to disrupt cyber criminals

US Justice Department reveals successful court-authorised effort to clamp down on ProxyLogon exploitation Continue Reading

By

• Alex Scroxton, Security Editor

NSA unearths more MS Exchange vulnerabilities

Microsoft patches more critical vulnerabilities in Exchange Server a month after the ProxyLogon incident, after being warned by the US National Security Agency Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Vaccine passports cannot be taken lightly

What are the security issues and challenges presented by vaccine passports, and how should they be designed and used with ethics and privacy in mind? Continue Reading

By

• Richard Hunt, Turnkey Consulting

Security Think Tank: Vaccine passports must be secure by design

What are the security issues and challenges presented by vaccine passports, and how should they be designed and used with ethics and privacy in mind? Continue Reading

By

• Paddy Francis

MP told to ditch official email over hacking fears

MP Tom Tugendhat claims the intelligence services advised him to switch to the Gmail service due to concerns his parliamentary email could be hacked Continue Reading

By

• Alex Scroxton, Security Editor

Covid-19 left people feeling vulnerable to cyber crime

Around 15 million people in the UK experienced cybercrime in the past 12 months, with a cumulative 64 million hours wasted dealing with the fallout Continue Reading

By

• Alex Scroxton, Security Editor

Millions of devices at risk from NAME:WRECK DNS bugs

Newly disclosed set of nine DNS vulnerabilities puts over 100 million consumer, enterprise and industrial IoT devices at risk Continue Reading

By

• Alex Scroxton, Security Editor

EncroChat lawyers raise questions over use of PII secrecy orders on UK decryption capabilities

Lawyers claim that public interest immunity certificates may have been used to withhold information on UK intelligence agencies’ ability to decrypt encrypted communications Continue Reading

By

• Bill Goodwin, Computer Weekly

Vaccine passports and travel plans race up Covid threat charts

With lockdown restrictions easing in the UK, cyber criminals are tailoring their phishing lures to new areas of interest Continue Reading

By

• Alex Scroxton, Security Editor

Why some jobseekers have turned to cyber crime during the pandemic

Research shows that many people have been seeking cyber crime-related work on the dark web, but why? Continue Reading

By

• Nicholas Fearn

What has a year of home working meant for the DPO?

Byron Shirley of The Compliance Space explores how the role of the data protection officer has changed in the past 12 months Continue Reading

By

• Byron Shirley, The Compliance Space

Executive interview: Unleashing blockchain’s potential

Labrys founder and CEO Lachlan Feeney offers his observations about blockchain adoption in Australia, and what his firm is doing to help organisations unleash the full potential of the technology Continue Reading

By

• Aaron Tan, TechTarget

How do YOU find and attract the Cybersecurity skills/talent YOU need?

Review the salaries you offer to Cybersecurity and Computer Science Graduates - unless your policy is to pay more for those implementing security by design. If you are worried about losing those ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Egypt, Italy and US most affected in Facebook leak

Researchers at VPN firm Surfshark have been analysing data on 533 million people leaked from Facebook Continue Reading

By

• Alex Scroxton, Security Editor

NCSC: Using your pet’s name as a password is very stupid

If your email password is still Rex, Rover or Mr Fluffles, it’s probably best to change it, the NCSC has said Continue Reading

By

• Alex Scroxton, Security Editor

Cring ransomware hits ICS through two-year-old bug

A long-disclosed vulnerability in Fortinet’s Fortigate VPN servers is being exploited to distribute Cring ransomware Continue Reading

By

• Alex Scroxton, Security Editor

Nation-state cyber attacks double in three years

Cyber attacks backed by nation states are becoming more frequent and varied, moving the world closer to a point of ‘advanced cyber-conflict’, according to a University of Surrey research project Continue Reading

By

• Alex Scroxton, Security Editor

Facebook ducks calls to apologise over huge data leak

Facebook gives its side of the story as data on millions of its users leaks, but is yet to apologise for security lapses that put half a billion people at risk of compromise Continue Reading

By

• Alex Scroxton, Security Editor

A billion extra contactless payments in year since limit increase

Visa said there was an extra one billion contactless payments made by its customers last year Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Unpatched SAP applications are target-rich ground for hackers

Report from SAP and cyber threat research company Onapsis warns that hackers are attacking mission-critical SAP business applications that contain unpatched vulnerabilities Continue Reading

By

• Brian McKenna, Enterprise Applications Editor

Facebook data leak could be outside scope of GDPR

Regulators may be unable to do much about leaked data on 533 million Facebook users, as it seems to have been stolen before GDPR came into force Continue Reading

By

• Alex Scroxton, Security Editor

API Daze

Earlier this week, the US Supreme Court ruled that Google did not infringe Oracle copyright on the Java SE API (application programming edition). The fact the US Supreme Court has digested a load ... Continue Reading

By

• Cliff Saran, Managing Editor

What Agenda is the new GDS Director, Identity Assurance Programme expected to deliver?

Experience in "Significant agile programme management and/or major change delivery" will not be enough. The appointee will need the skills of Machiavelli  and the luck of the Devil.    Continue Reading

By

• Philip Virgo, Winsafe Ltd