IT security

Picking the right focus for web application security testing

Deciding which web applications on which to focus application security testing is a challenging task. Read this list of considerations to ensure you're addressing the right areas. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Security Think Tank: Monitoring key to outcomes-based security

What is the first step towards moving from a tick-box approach to security to one that is outcomes-based, and how can an organisation test if its security defences are delivering the desired outcome? Continue Reading

By

• Ramsés Gallego, Isaca

Cooperation vital in cyber security, says former Estonian minister

States acting alone cannot be efficient in cyber security and need to cooperate with others to build trust, says a former foreign minister of Estonia Continue Reading

By

• Warwick Ashford, Senior analyst

Consumer Google+ dumped in favour of enterprise focus

Google+ will no longer be offered to consumers, following a security audit. Instead, the company plans to flesh out an enterprise social media strategy Continue Reading

By

• Cliff Saran, Managing Editor

High Court blocks Google iPhone privacy lawsuit

The UK High Court has thrown out a group action lawsuit against Google for tracking iPhone browsing data, but campaign group Google You Owe Us, which brought the litigation, will appeal the decision Continue Reading

By

• Lis Evenstad

NCSC head calls for technocratic partnership to fix cyber risks

The UK’s National Cyber Security Centre is appealing for collaboration with the technology industry to remedy key vulnerabilities in current IT Continue Reading

By

• Warwick Ashford, Senior analyst

Airbus secures European institutions against cyber threat

Airbus CyberSecurity has partnered with Atos to help protect 17 European government institutes from cyber attacks Continue Reading

By

• Cliff Saran, Managing Editor

ICO hits Heathrow Airport with £120,000 data breach fine over lost USB stick

Information Commissioner’s Office fines airport after a member of the public came across a USB stick containing sensitive personal information about airport staff Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Customers need to be at the centre of GDPR plans

Responding to a breach is not just about data, it is about taking care of, and protecting, customers Continue Reading

By

• Dominic Cockram, Deloitte

Security Think Tank: Enable outcomes-based security in software development

What is the first step towards moving from a tick box approach to security to one that is outcomes based, and how can an organisation test if its security defences are delivering the desired outcome? Continue Reading

By

• Bruce Beam , (ISC)²

Google Safety Center goes live in the UK

Google says its commitment to transparency is as strong as ever as its new Safety Center goes live in the UK to help keep businesses and consumers safe online Continue Reading

By

• Warwick Ashford, Senior analyst

Amazon and Apple deny claims Chinese government bugged their servers

Amazon and Apple have publicly refuted a Bloomberg report that claims their servers were tampered with and bugged during the manufacturing process Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

GDPR case work swamps Denmark’s data protection agency

The agency investigating alleged breaches of GDPR in Denmark is recruiting additional resources to cope with the increase in work Continue Reading

By

• Gerard O'Dwyer

Security Think Tank: C-suite needs to drive outcomes-based security

What is the first step towards moving from a tick-box approach to security to one that is outcomes-based and how can an organisation test whether its security defences are delivering the desired outcome? Continue Reading

By

• Mike Gillespie

Russian cyber crime sends us crackers

The UK government has condemned Russia’s military intelligence service for a variety of cyber attacks in its routinely stern way, but at this point, we might as well be told about this kind of ... Continue Reading

By

• Ryan Priest

Security Serious Unsung Heroes announced

Awards celebrate the people of the cyber security industry on the front lines of organisations battling cyber threats Continue Reading

By

• Warwick Ashford, Senior analyst

How does stegware malware exploit steganography techniques?

Researchers at the 2018 RSA Conference discussed the increasing availability of malware that uses steganography, dubbed stegware. Discover how this works with expert Nick Lewis. Continue Reading

By

• Nick Lewis

How is Android Accessibility Service affected by a banking Trojan?

ThreatFabric researchers uncovered MysteryBot, Android malware that uses overlay attacks to avoid detection. Learn how this malware affects Google's Android Accessibility Service. Continue Reading

By

• Nick Lewis

Security Think Tank: Use Cyber Essentials to kick-start outcomes-based security

What is the first step towards moving from a tick-box approach to security to one that is outcomes-based and how can an organisation test whether its security defences are delivering the desired outcome? Continue Reading

By

• Petra Wenham

Business email compromise made easy for cyber criminals

Poor security practices and access to hacking services are making it easy for cyber criminals to compromise business email, research reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Apps are gateway to business data for cyber attackers

Application security is becoming increasingly important because apps are often the main way cyber attackers are getting into corporate networks, a threat researcher warns Continue Reading

By

• Warwick Ashford, Senior analyst

UK and allies accuse Russia of cyber attack campaign

The UK National Cyber Security Centre has identified a campaign by the Russian military intelligence service of “indiscriminate and reckless” cyber attacks Continue Reading

By

• Warwick Ashford, Senior analyst

How Starbucks is using Splunk to automate mundane security tasks

Coffee giant Starbucks is using Splunk to automate some of its more tedious security tasks to reduce the workload for its cyber staff Continue Reading

By

• Clare McDonald, Business Editor

Companies failing to recognise the internal cyber threat

The focus at many companies is on external cyber threats, and internal threats are being overlooked as a consequence, a researcher warns Continue Reading

By

• Warwick Ashford, Senior analyst

Majority of businesses believe they are open to cyber attack

More than two-thirds of businesses believe their network is open to attack, a report on the state of web application security reveals Continue Reading

By

• Warwick Ashford, Senior analyst

Rise in data-stealing Betabot malware

Researchers are warning about an increase in Betabot malware after detecting multiple infections in recent weeks, underlining the importance of software patching Continue Reading

By

• Warwick Ashford, Senior analyst

AI full of possibilities with the right tools and understanding

Artificial intelligence has the potential to assist in the analysis of data in a range of topics, but businesses need to understand its limitations and have the right tools to get the most benefit, says a Swiss entrepreneur Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Shift to outcomes-based security by focusing on business needs

What is the first step towards moving from a tick-box approach to security to one that is outcomes-based and how can an organisation test whether its security defences are delivering the desired outcome? Continue Reading

By

• Simon Persin, Turnkey Consulting

How Bank of England is using Splunk for proactive security

Head of the Bank of England’s security operations centre talks about how Splunk is helping it to take a more proactive approach to preventing cyber attacks Continue Reading

By

• Clare McDonald, Business Editor

Everyone, everywhere is responsible for IIoT cyber security

Cyber security in the industrial internet of things is not limited to a single company, industry or region – it is an international threat to public safety, and can only be addressed through collaboration that extends beyond borders and competitive interests Continue Reading

By

• Andrew Kling, The Open Group

Security Think Tank: Start outcomes-based security with asset identification

What is the first step towards moving from a tick-box approach to security to one that is outcomes-based and how can an organisation test whether its security defences are delivering the desired outcome? Continue Reading

By

• Paddy Francis

UK firms’ password security score ‘average’

While businesses are making strides in strengthening password security, there is more work to be done, with the UK password score lagging behind the frontrunners, a survey shows Continue Reading

By

• Warwick Ashford, Senior analyst

SamSam ransomware: How is this version different from others?

Sophos recently discovered a SamSam extortion code that performs company-wide attacks using a range of vulnerability exploits. Discover how this version differs from past variants. Continue Reading

By

• Nick Lewis

Tesco Bank gets first cyber-related FCA fine

UK’s financial watchdog issues its first cyber-related fine to Tesco Bank in connection with a multimillion-pound cyber fraud in 2016 Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Security governance key to outcomes-based approach

What is the first step towards moving from a tick-box approach to security to one that is outcomes based, and how can an organisation test if its security defences are delivering the desired outcome? Continue Reading

By

• Maxine Holt, Omdia

Facebook could face up to $1.6bn fine for data breach

Facebook is under increased pressure to demonstrate that users’ personal data is protected as it faces a potential fine of more than a billion dollars for a data breach affecting millions of users Continue Reading

By

• Warwick Ashford, Senior analyst

Keeping Commvault on its toes in ASEAN

Backup and data protection software supplier is going after mid-sized companies and renewing its focus on partners to make deeper inroads in Southeast Asia Continue Reading

By

• Aaron Tan, TechTarget

EU sees eIDAS regulation come into full force

A regulation aimed at cutting red tape to enable a digital single market in Europe will soon be in full force, but it could present some challenges to the UK after Brexit Continue Reading

By

• Warwick Ashford, Senior analyst

Data analytics cuts queues and flight delays at Rome’s Fiumicino Airport

Aeroporti di Roma’s CIO, Emiliano Sorrenti, describes how the city’s main airport is using data analytics technology to reduce delays and queue times, securing it an industry award for customer service Continue Reading

By

• Bill Goodwin, Computer Weekly

How can live chat widgets leak personal employee data?

Project Insecurity researchers found live chat software leaking personal employee data. Learn how attackers can use this leaked information and data to hurt organizations. Continue Reading

By

• Nick Lewis

Cyber attackers are increasingly exploiting RDP, warns FBI

Businesses should to act to reduce the likelihood of compromise from cyber attackers exploiting the remote desktop protocol, warns the FBI Continue Reading

By

• Warwick Ashford, Senior analyst

It’s time to redefine shadow IT

Among the findings of the Committee of Inquiry (COI) that looked into the massive SingHealth data breach was the startling fact that a non-IT staff was tasked with managing the server which was ... Continue Reading

By

• Aaron Tan, TechTarget

Blockchain is no ‘magic wand’ for cyber security

The decentralised nature of blockchain networks may deter some cyber crooks, but ASEAN organisations still need to pay heed to the security of their blockchain infrastructure Continue Reading

By

• Aaron Tan, TechTarget

Network growth brings management challenges

As enterprise networks grow, so do the challenges of managing them effectively, says a report compiled by Oracle’s communications unit Continue Reading

By

• Alex Scroxton, Security Editor

Business is at inflection point for proactive cyber security

The time is ripe for proactive cyber security, but many organisations must first overcome four key obstacles to achieve effective protection, according to a research report Continue Reading

By

• Warwick Ashford, Senior analyst

Explosion in fake data-stealing shopping sites

Cyber attackers are ramping up efforts to steal personal data by setting up look-alike domains that pose a phishing risk to online shoppers, researchers warn Continue Reading

By

• Warwick Ashford, Senior analyst

Norwegian state discusses vulnerabilities with IT sector

Government is collaborating with the country’s IT industry to improve the availability of security expertise Continue Reading

By

• Gerard O'Dwyer

Replication won’t protect VMs against ransomware

Seamless replication is among the benefits of virtualisation, but many organisations fail to back up virtual machines properly Continue Reading

By

• Cliff Saran, Managing Editor

Prepare now for quantum computers, QKD and post-quantum encryption

The predicted processing power of quantum computers is likely to make existing encryption algorithms obsolete. Quantum key distribution (QKD) is a possible solution - we investigate whether QKD is viable Continue Reading

By

• Peter Ray Allison

Uber fined $148m for data breach cover-up

US court hits Uber with heavy fine which security industry commentators hope will encourage firms to take cyber security more seriously and resist the urge to cover up data breaches Continue Reading

By

• Warwick Ashford, Senior analyst

Australian teen Apple hacker avoids jail time

“Fan” who broke into Apple’s mainframe from his home in Melbourne has avoided prison because the information he gathered was recovered Continue Reading

By

• Warwick Ashford, Senior analyst

ICO threatens fines for outstanding fees

The UK’s privacy watchdog has issued warning letters to organisations, including some NHS trusts and government organisations, for failing to pay a new data protection fee Continue Reading

By

• Warwick Ashford, Senior analyst

Financial services firms face potential security bombshell

UK financial services are facing a security crisis over outdated services and applications, a survey shows Continue Reading

By

• Warwick Ashford, Senior analyst

Why the government should rethink the UK’s surveillance laws

The European Court of Human Rights has made clear that the Snoopers’ Charter is an unlawful violation of people’s rights and freedoms Continue Reading

By

• Megan Goulding

Fujitsu teams up with UTCs on cyber security training

Fujitsu, University Technical Colleges across England and other private sector partners have joined forces to help address the cyber security skills gap Continue Reading

By

• Warwick Ashford, Senior analyst

PCI DSS compliance falls despite security benefit

Despite the benefits of the payment card industry security standard, there is a concerning downward trend in compliance, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

MI5 admits to ‘unlawful’ spying on Privacy International

The UK's intelligence agencies acted unlawfully by intercepting communications data on NGO, Privacy International, the UK's most secret court ruled. Continue Reading

By

• Bill Goodwin, Computer Weekly

WannaCry and NotPetya inspiring new attacks

Designs and techniques used in 2017’s global cyber attacks have inspired a new breed of malware that exploits software vulnerabilities, according to a McAfee report Continue Reading

By

• Warwick Ashford, Senior analyst

Mac OS Mojave zero-day warning

The latest version of Apple’s Mac operating system contains a vulnerability that could be exploited by attackers to access protected files, a researcher warns Continue Reading

By

• Warwick Ashford, Senior analyst

NHS Digital hires chief information security officer

Robert Coles will lead the health and care sector’s response to cyber attacks and help local organisations meet the government’s cyber security standards Continue Reading

By

• Lis Evenstad

Business leaders expect suppliers to ensure they are cyber secure

Most UK business leaders expect suppliers to be cyber secure and nearly a third of businesses would terminate contracts because of suppliers’ security failings, a survey has revealed Continue Reading

By

• Warwick Ashford, Security Editor

Foreshadow mitigation obscures licensing impact

Performance of virtual machines could be severely affected by the workaround for Intel’s latest processor flaw. To compensate, more processors will be needed Continue Reading

By

• Cliff Saran, Managing Editor

DCMS plan aims to open up digital identity market - and might kill off Gov.uk Verify

The Department for Digital, Culture, Media and Sport (DCMS) has been conducting a review of digital identity since taking over policy responsibility from the Government Digital Service (GDS) in ... Continue Reading

By

• Bryan Glick, Editor in chief

Equifax fined by ICO for security failings

The Information Commissioners Office has fined Equifax UK in relation to a data breach at its UK parent last year Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Europol cyber crime report highlights emerging threats to enterprise security

Research highlights increase in sophistication of ransomware attacks, while revealing details of new and emerging threats to enterprises Continue Reading

By

• Tasmin Lockwood

IT sector advises Swedish government on elections and voting system

Swedish IT secure is helping the government make election systems more secure and reduce external influence Continue Reading

By

• Gerard O'Dwyer

Employers turn to wearable technology to help staff manage work-life balance

Companies are realising that there are sound business reasons for ensuring their employees get enough sleep and exercise, so they are turning to wearable technology to help their staff stay healthy, despite the pressures of work Continue Reading

By

• Christian Annesley

AI is crucial element of security strategy in the IoT era

Machine learning and network visibility for users and internet of things devices are essential to battle threats inside the enterprise, according to a new report Continue Reading

By

• Alex Scroxton, Security Editor

Disaster recovery as a service: what you need to know

Technological advances make disaster recovery as a service possible, but Computer Weekly investigates whether it is practical option for all businesses. Continue Reading

Singapore government to start bug bounty programme

Singapore’s bug bounty programme will help the authorities identify cyber blind spots and benchmark its defences against skilled hackers Continue Reading

By

• Aaron Tan, TechTarget

Danske Bank invests in anti-money laundering systems following Estonian problems

Danske bank improves its anti money laundering software, utilising artificial intelligence and machine learning Continue Reading

By

• Gerard O'Dwyer

Lib Dems want ‘Geneva Convention’ for use of tech in modern warfare

Deputy leader of the Liberal Democrats, Jo Swinson, wants an international treaty on use of technology in modern warfare, and warns of the dangers of new technology leaving people behind Continue Reading

By

• Lis Evenstad

Cutting through the blockchain hype

Blockchain adoption is still in its infancy, with security challenges standing in the way of more widespread deployment, according to a blockchain expert Continue Reading

By

• Aaron Tan, TechTarget

Printing, document capture and compliance risk in the GDPR era

Printers, scanners and mobile devices that capture data from documents all store data in some way or other. How can you be sure to be compliant with GDPR with regard to that data? Continue Reading

By

• Antony Adshead, Storage Editor

Security Think Tank: Supplement security with an MSSP to raise the bar

What is the most practical and cost-effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Greg Temm

No Deal Brexit may hinder free flow of personal data from EU to UK

The government’s No Deal Brexit planning document on data protection warns free flow of personal data from EU isn’t guaranteed, and organisations must take action to ensure they will still be able receive data from Europe Continue Reading

By

• Lis Evenstad

GCHQ mass surveillance regime was in breach of human rights law, European court rules

The European Court of Human Rights in Strasbourg has ruled that the UK’s collection of bulk interception of communications data lacked adequate oversight and safeguards and was in breach of human rights law Continue Reading

By

• Bill Goodwin, Computer Weekly

Outcomes-based security is the way forward

Every security technology is effective for a limited time, but understanding data assets and their value to attackers is key to effective cyber defence, according to an industry veteran of 20 years’ experience Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: Adopt a proactive approach to software vulnerabilities

What is the most practical and cost-effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Richard Hunt, Turnkey Consulting

NCSC issues core questions to help boards assess cyber risk

The National Cyber Security Centre has published its first in a series of guidance for board members which highlights what businesses should be asking security teams Continue Reading

By

• Clare McDonald, Business Editor

FCA warns it cannot manage financial crime risks without sharing data with EU

FCA admits it will be unable to manage financial crime effectively if it cannot share data with EU authorities. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Two-thirds of emails not clean, says research

Two-thirds of emails don't make it to the inbox because security systems consider them unsafe, according to research Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security Think Tank: Four key steps to managing software vulnerabilities

What is the most practical and cost-effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Bruce Beam , (ISC)²

Higher education sector's poor response to cyber threats laid bare in EfficientIP report

The 2018 EfficientIP Global DNS Report shines a light on how ill-prepared the higher education sector is for handling cyber threats Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Security Think Tank: Four steps to managing software vulnerabilities

What is the most practical and cost-effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Chris Hodson

British Airways data breach: Security researchers name suspects and query attack timeline

Security researchers claim to have pinpointed the cause and perpetrators of the British Airways data breach, and also claim the attackers may have had access to its customer data for far longer than previously thought Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

UK security vetting IT system failing, says NAO

The National Audit Office is critical of the government’s project to centralise its security vetting process, as the IT system has been plagued by failures from the start and has led to serious delays Continue Reading

By

• Lis Evenstad

Public cloud use surges among DDoS attackers, research shows

According to data accrued by DDoS mitigation firm, Link11, the number of attackers that rely on public cloud services soared during the 12 months to June 2018 Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Cyber criminals outspend businesses in cyber security battle

Cybercriminals are flexing their financial might and UK organisations are facing more attacks as a result Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Security Think Tank: Balancing cost and risk in software vulnerability management

What is the most practical and cost-effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Alexander Drabek, 2|SEC

Security Think Tank: No shortcuts to addressing software vulnerabilities

What is the most practical and cost effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Maxine Holt, Omdia

North Korean programmer charged for WannaCry attacks

The US has charged a member of a group of North Korean hackers linked to the WannaCry, Sony Pictures and other cyber attacks around the world Continue Reading

By

• Warwick Ashford, Senior analyst

Who is The Cloud Daddy?

Had a great couple of online sessions recently with Joe Merces of the splendidly named CloudDaddy. The aim of CloudDaddy is to simplify one of the great pain points of IT (no, not repairing ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Verify on the verge – what does it mean for GDS?

The government’s flagship digital identity system Gov.uk Verify has become a car crash in motion, accelerating towards its demise. The Cabinet Office’s project watchdog has condemned Verify by ... Continue Reading

By

• Bryan Glick, Editor in chief

Ransomware down, but not out, report reveals

Cryptojacking has taken over from ransomware as the top money spinner for cyber criminals, but the threat is not over and spam is also seeing a resurgence as an attack method, a report reveals Continue Reading

By

• Warwick Ashford, Senior analyst

BA praised for swift GDPR-aligned action on data breach

British Airways has been praised for its swift response to a customer data breach, which could be the first test case under the EU’s GDPR and new UK GDPR-aligned data protection laws Continue Reading

By

• Warwick Ashford, Senior analyst

Chrome 69 security improvements welcomed

The cyber security community has welcomed the improvements in the latest version of the Chrome browser, especially when it comes to generating strong, unique passwords Continue Reading

By

• Warwick Ashford, Senior analyst

Security Think Tank: How to manage software vulnerabilities

What is the most practical and cost effective way for organisations to identify and remediate high-risk software vulnerabilities? Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

Government projects watchdog recommends terminating Gov.uk Verify identity project

Infrastructure & Projects Authority says Whitehall departments are unwilling to fund flagship GDS identity programme – cancellation would mean writing off at least £130m spent so far Continue Reading

By

• Bryan Glick, Editor in chief

Half a million UK firms hit by CEO fraud, Lloyds Bank estimates

Nearly 500,000 UK businesses are being hit by impersonation fraud, according to estimations by Lloyds Bank, with the legal sector most at risk Continue Reading

By

• Warwick Ashford, Senior analyst