IT security

China poses genuine and increasing cyber security risk to UK, says GCHQ director

GCHQ director Anne Keast-Butler uses her first major public speech to warn that China poses a significant cyber security threat to the UK Continue Reading

By

• Bill Goodwin, Computer Weekly

CyberUK 24: UK insurance industry gets tough on ransomware

Three of the UK’s largest insurance associations have signed on to a new initiative spearheaded by the NCSC to try to bring down the number of ransomware payments being made Continue Reading

By

• Alex Scroxton, Security Editor

bug bounty program

A bug bounty program, also called a vulnerability rewards program (VRP), is a crowdsourcing initiative that rewards individuals like ethical hackers and security researchers for discovering and reporting vulnerabilities and bugs in software. Continue Reading

By

• Rahul Awati

NHS trust dismisses governors who questioned allegations of email tampering

Two NHS trust governors who raised questions in a dispute over allegations of email tampering concerning whistleblower Peter Duffy have been dismissed after an investigation that followed their suspension Continue Reading

By

• Tommy Greene

Complying With Automation

Thinking back to the early 2000s (I refuse to call them “the noughties”) it seemed that whatever technology you were talking about, the word “security” always came into the equation. Fast forward ... Continue Reading

By

• Steve Broadhead, Broadband Testing

The UK may not have a choice on a ransomware payment ban

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Ian Thornton-Trump

How to create a cloud security policy, step by step

What are the necessary components of a cloud security policy, and why should an organization go to the trouble to create one? Download a template to get the process started. Continue Reading

By

• Paul Kirvan

Major breach of customer information developing at Dell

Almost 50 million data records relating to Dell customers appear to have been compromised in a major cyber breach Continue Reading

By

• Alex Scroxton, Security Editor

Pegasus malware

Pegasus malware is spyware that can hack any iOS or Android device and steal a variety of data from the infected device, including text messages, emails, key logs, audio and information from installed applications, such as Facebook or Instagram. Continue Reading

By

• Andrew Zola
• Linda Rosencrance

Over 5.3 billion data records exposed in April 2024

The number of data records breached in April 2024 hit over five billion, a staggering year-on-year increase Continue Reading

By

• Alex Scroxton, Security Editor

Cyber attack victims need to speak up, says ICO

The Information Commissioner’s Office is urging organisations to be transparent and learn from each other’s mistakes as it reveals most of the cyber attacks it responds to stem from the same core errors Continue Reading

By

• Alex Scroxton, Security Editor

Wales gets UK’s first national SOC

The first national security operations centre of its kind in the UK has opened in the south of Wales to safeguard public sector bodies across the country Continue Reading

By

• Alex Scroxton, Security Editor

Zero Trust: Unravelling the enigma and charting the future

A special interest group aims to start a long-overdue discourse on the merits, dangers, costs, and development of Zero Trust and IAM in information security Continue Reading

By

• David Lacey

threat actor

A threat actor, also called a malicious actor or bad actor, is an entity that is partially or wholly responsible for an incident that affects -- or has the potential to affect -- an organization's security. Continue Reading

By

• Rahul Awati
• Ivy Wigmore

Enhance identity controls before banning ransomware payments

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Stephen McDermid

Ofcom publishes draft online child safety rules for tech firms

In the draft codes, Ofcom calls on technology firms to use ‘robust’ age-checking and content moderation systems to keep harmful material away from children online Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Police accessed phone records of ‘trouble-making journalists’

The Police Service of Northern Ireland ran a rolling programme to monitor phone records of journalists to identify the source of police leaks, it was claimed today Continue Reading

By

• Bill Goodwin, Computer Weekly

Cyber attack ruled out as source of UK Border Force outage

An IT outage that caused automated passport control e-gates to crash across the UK has been resolved, with a cyber attack ruled out as the cause Continue Reading

By

• Alex Scroxton, Security Editor

Germany: European Court of Justice ruling on EncroChat could lead to new legal challenges

A ruling by the European Court of Justice could prompt legal challenges in EncroChat prosecutions in Germany and other EU states Continue Reading

By

• Bill Goodwin, Computer Weekly

Government plans to scan bank accounts of disabled people will lead to another scandal

The government is sleepwalking into another scandal as it pushes plans for ‘bank scanning’ algorithms to monitor bank accounts of disabled people Continue Reading

By

• Mikey Erhardt, campaigner at Disability Rights UK

Chinese APT suspected of Ministry of Defence hack

A cyber attack on the Ministry of Defence is suspected to be the work of threat actors working on behalf of Chinese intelligence Continue Reading

By

• Alex Scroxton, Security Editor

NCA unmasks LockBitSupp cyber gangster who toyed with pursuers

The NCA and its partners have named the administrator of the LockBit ransomware gang, LockBitSupp, as Dmitry Khoroshev, who now faces sanctions and criminal charges Continue Reading

By

• Alex Scroxton, Security Editor

What does the Data Protection and Digital Information Bill mean for UK industry?

The Data Protection and Digital Information Bill is the first shift in the UK’s data protection regime since leaving the EU, but what could it mean for UK industry? Continue Reading

By

• Peter Ray Allison

Versa Networks adds AI capabilities to SASE platform

Artificial intelligence and machine learning-based secure access service edge provider enhances core solution to include GenAI firewall for threat detection and data protection Continue Reading

By

• Joe O’Halloran, Computer Weekly

Casting a critical eye on HMRC’s IR35 checker tool

In this week’s Computer Weekly, we investigate what has been going on with HMRC’s Check Employment Status for Tax (CEST) tool. We also speak to the CIO of Danfoss about making datacentres greener and explore the issue of restoring data and system backups after a ransomware or cyber attack. Read the issue now. Continue Reading

Embrace alternative education pathways for cyber success

Shifting focus toward passion, adaptability, and a willingness to learn can revolutionise talent acquisition, fostering a more diverse and effective cyber security force. Continue Reading

By

• Ricardo Villadiego

social engineering penetration testing

Social engineering penetration testing is the practice of deliberately conducting typical social engineering scams on employees to ascertain the organization's level of vulnerability to this type of exploit. Continue Reading

By

• Rahul Awati

Microsoft beefs up cyber initiative after hard-hitting US report

Microsoft is expanding its recently launched Secure Future Initiative in the wake of a hard-hitting US government report on recent nation state intrusions into its systems Continue Reading

By

• Alex Scroxton, Security Editor

Adobe expands bug bounty programme to account for GenAI

Adobe has expanded the scope of its HackerOne-driven bug bounty scheme to incorporate flaws and risks arising from the development of generative artificial intelligence Continue Reading

By

• Alex Scroxton, Security Editor

Patch GitLab vuln without delay, users warned

The addition of a serious vulnerability in the GitLab open source platform to CISA’s KEV catalogue prompts a flurry of concern Continue Reading

By

• Alex Scroxton, Security Editor

EU calls out Fancy Bear over attacks on Czech, German governments

The European Union, alongside member states Czechia and Germany, have accused Russian government APT Fancy Bear of being behind a series of attacks on political parties and government bodies Continue Reading

By

• Alex Scroxton, Security Editor

Optimising application connections, improving security posture top SD-WAN priorities

Research looking into key drivers behind global SD-WAN investments find deployments are mainly driven by need to optimise network connections to cloud-based applications and improve overall security posture Continue Reading

By

• Joe O’Halloran, Computer Weekly

Why IAM is central to cyber security

BeyondTrust’s chief security strategist talks up the importance of identity and access management, and the role of cyber insurance in driving security improvements Continue Reading

By

• Stephen Withers

document sanitization

Document sanitization is the process of cleaning a document to ensure that only the intended information can be accessed from it. Continue Reading

By

• Rahul Awati

What is the dark web (darknet)?

The dark web is an encrypted portion of the internet not visible to the general public via a traditional search engine such as Google. Continue Reading

By

• Rahul Awati
• Katie Terrell Hanna

Palo Alto Networks claims to raise bar on SASE

Palo Alto Networks releases version 3.0 of SASE tech designed to extend zero trust to unmanaged devices, secure data with artificial intelligence and boosts application performance for partners and customers Continue Reading

By

• Joe O’Halloran, Computer Weekly

NCSC updates warning over hacktivist threat to CNI

The NCSC and CISA have warned about the evolving threat from Russia-backed hacktivist threat actors targeting critical national infrastructure, after a number of American utilities were attacked Continue Reading

By

• Alex Scroxton, Security Editor

Ukrainian national sentenced over REvil ransomware spree

A 24-year-old Ukrainian man has been sentenced to more than 13 years in prison after being convicted of his role in the REvil ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Dropbox Sign user information accessed in data breach

Account data belonging to Dropbox Sign users was accessed by an unknown threat actor after they hacked into the organisation’s backend infrastructure Continue Reading

By

• Alex Scroxton, Security Editor

What is PCI DSS (Payment Card Industry Data Security Standard)?

The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. Continue Reading

By

• Nick Barney, Technology Writer

BBC instructs lawyers over allegations of police surveillance of journalist

Lawyers for the BBC have written to the Investigatory Powers Tribunal over allegations that the Police Service of Northern Ireland spied on investigative journalist Vincent Kearney Continue Reading

By

• Bill Goodwin, Computer Weekly

How Okta is fending off identity-based attacks

Okta has been bolstering the security of its own infrastructure and building new tools to scan customer environments for vulnerable identities, among other efforts to fend off identity-based attacks Continue Reading

By

• Aaron Tan, TechTarget

EMEA CISOs must address human factors behind cyber incidents

The 17th annual Verizon report on data breaches makes for sobering reading for security pros, urging them to do more to address the human factors involved in cyber incidents, and highlighting ongoing issues with zero-day patching Continue Reading

By

• Alex Scroxton, Security Editor

Better hygiene may mitigate the need to ban ransomware payments

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Becky Gelder, Turnkey Consulting

Australia’s Qantas apologises for mobile app data breach

Australian flag carrier Qantas has apologised after a glitch in its mobile application temporarily enabled some customers to view the flights and booking details of other frequent fliers on two separate occasions Continue Reading

By

• Alex Scroxton, Security Editor

Secure coding benchmark to increase standards among developers

Developer security advocate Secure Code Warrior has launched what it claims is the industry’s first benchmark designed to quantify the security competence of its customers’ software developer teams Continue Reading

By

• Alex Scroxton, Security Editor

remote access

Remote access is the ability for an authorized person to access a computer or network from a geographical distance through a network connection. Continue Reading

By

• Paul Kirvan
• TechTarget Contributor

DWP anti-fraud measures will allow monitoring of bank accounts of landlords, carers and parents

Parliamentarians raise concerns that a proposed law to require banks to monitor the accounts of millions of people receiving state benefits could lead to those on welfare being denied accommodation or bank accounts Continue Reading

By

• Bill Goodwin, Computer Weekly

Are we ready for the era of the ‘sentient’ document?

This year is set to be the automation of documents since the invention of the printing press. Content control is key Continue Reading

By

• John Bates

Autonomous weapons reduce moral agency and devalue human life

Military technology experts gathered in Vienna have warned about the detrimental psychological effects of AI-powered weapons, arguing that implementing systems of algorithmic-enabled killing dehumanises both the user and the target Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Federal Information Security Modernization Act (FISMA)

): The Federal Information Security Modernization Act (FISMA) is United States legislation that defines a framework of guidelines and security standards to protect government information technology operations from cyberthreats. Continue Reading

By

• Paul Kirvan
• Alexander S. Gillis, Technical Writer and Editor

Persistent data breaches deny people with HIV dignity and privacy

The ICO has urged charities and healthcare organisations that work with people living with HIV to do better when it comes to protecting their personal data, after the HIV status of more than 100 people was accidentally disclosed by London’s Central YMCA Continue Reading

By

• Alex Scroxton, Security Editor

Keeper to help Williams F1 keep up with cyber challenges

Keeper Security signs up to support F1 team Williams Racing with credential management ahead of the 2024 Miami Grand Prix Continue Reading

By

• Alex Scroxton, Security Editor

Global majority united on multilateral regulation of AI weapons

Foreign ministers and civil society representatives say that multilateralism is key to controlling the proliferation and use of AI-powered autonomous weapons, but that a small number of powerful countries are holding back progress Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Bad bot traffic in Australia grew 23% in 2023

Traffic from bad bots that perform malicious tasks accounted for 30.2% of Australia’s internet traffic in 2023 Continue Reading

By

• Aaron Tan, TechTarget

digital identity

A digital identity is the body of information about an individual, organization or electronic device that exists online. Continue Reading

By

• Katie Terrell Hanna

Ransomware payment bans need universal buy-in

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Jack Chapman

UK’s long-awaited device security law kicks in

The Product Security and Telecommunications Infrastructure Act has become law across the UK, enforcing basic cyber security standards across connected products sold to the public Continue Reading

By

• Alex Scroxton, Security Editor

Top 11 cloud security challenges and how to combat them

Before jumping feet first into the cloud, understand the new and continuing top cloud security challenges your organization is likely to face -- and how to mitigate them. Continue Reading

By

• Sharon Shea, Executive Editor

Cradlepoint unveils 5G-optimised SASE to deliver agile enterprises

Ericsson division unveils SASE solution said to enable lean IT teams to establish zero-trust networks in as little as six minutes securing environments such as roaming vehicles, IoT devices and pop-up locations Continue Reading

By

• Joe O’Halloran, Computer Weekly

Security Think Tank: Maybe let's negotiate with terrorists

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Mark Cunningham Dickie

Post Office ‘lied’ to subpostmasters when forced to meet them, says former federation representative

Post Office executives were forced to meet subpostmasters to discuss an unexplained error in their branch, then misled the branch managers over remote access Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Progress being made on gender diversity in cyber

Women make up a higher percentage of new entrants to the cyber security profession, particularly among younger age groups, and are increasingly taking up leadership positions and hiring roles, but challenges still persist Continue Reading

By

• Alex Scroxton, Security Editor

Zero trust is a strategy, not a technology

Zero-trust security should be seen as a strategy to protect high-value assets and is not tied to a specific technology or product, says the model’s creator John Kindervag Continue Reading

By

• Aaron Tan, TechTarget

Mandatory MFA pays off for GitHub and OSS community

Mandating multifactor authentication for select developers has been a huge success for GitHub, the platform reports, and now it wants to go further Continue Reading

By

• Alex Scroxton, Security Editor

Cyber training leader KnowBe4 to buy email security firm Egress

Security awareness training and phishing simulation specialist KnowBe4 is to buy email security expert Egress Continue Reading

By

• Alex Scroxton, Security Editor

TikTok ban sails through US Senate

A law that will ban TikTok in the US unless its owner sells up pronto passed the US Senate by a landslide majority after being included in a package of military aid Continue Reading

By

• Alex Scroxton, Security Editor

Education will be key to good AI regulation: A view from the USA

Computer Weekly sat down with Salesforce’s vice-president of federal government affairs, Hugh Gamble, to find out how the US is forging a path towards AI regulation, and how things look from Capitol Hill Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Cyber sector, you have failed this community

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Allan Liska

GooseEgg proves golden for Fancy Bear, says Microsoft

Microsoft’s threat researchers have uncovered GooseEgg, a never-before-seen tool being used by Forest Blizzard, or Fancy Bear, in conjunction with vulnerabilities in Windows Print Spooler Continue Reading

By

• Alex Scroxton, Security Editor

business impact analysis (BIA)

A business impact analysis (BIA) is a systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident or emergency. Continue Reading

By

• Robert Sheldon
• Paul Kirvan
• Carol Sliwa

Questions for IT and cyber leaders from the CSRB Microsoft report

The US government's CSRB report on last year's state sponsored cyber attacks on Microsoft raises significant concerns for Redmond and its customers. Expert Owen Sayers outlines five key questions IT and cyber security leaders should now consider Continue Reading

By

• Owen Sayers, Secon Solutions

Lords split over UK government approach to autonomous weapons

During a debate on autonomous weapons systems, Lords expressed mixed opinions towards the UK government’s current position, including its reluctance to adopt a working definition and commit to international legal instruments controlling their use Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Securing the edge: A new battleground in mobile network security

Edge computing is transforming approaches to mobile network infrastructure, but failure to secure it can expose networks and data to cyber threats. Learn more about the dangers and potential solutions Continue Reading

By

• Isla Sibanda

Former Sellafield consultant claims the nuclear complex tampered with evidence

Whistleblower Alison McDermott claims former employer Sellafield tampered with metadata in letters used in evidence during an employment tribunal Continue Reading

By

• Tommy Greene
• Bill Goodwin, Computer Weekly

Fujifilm plans to ‘make tape easy’ with Kangaroo SME appliance

Fujifilm to add 100TB SME-focused Kangaroo tape infrastructure in a box to existing 1PB offer, as energy efficiency and security of tape make it alluring to customers Continue Reading

By

• Antony Adshead, Storage Editor

NCSC announces PwC’s Richard Horne as CEO

Former PwC and Barclays cyber chief Richard Horne set to join UK’s National Cyber Security Centre as CEO Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Digital Edge punching above its weight in Asia datacentre market

Fast-growing datacentre provider Digital Edge is eyeing business from hyperscalers and counting on its strengths in datacentre operations and local partnerships to stand out from rivals Continue Reading

By

• Aaron Tan, TechTarget

IT leaders hiring CISOs aplenty, but don’t fully understand the role

Most businesses now have a CISO, but perceptions of what CISOs are supposed to do, and confusion over the value they offer, may be holding back harmonious relations, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Crime agency criticises Meta as European police chiefs call for curbs on end-to-end encryption

Law enforcement agencies step up demands for ‘lawful access’ to encrypted communications Continue Reading

By

• Bill Goodwin, Computer Weekly

Report reveals Northern Ireland police put up to 18 journalists and lawyers under surveillance

Disclosures that the Police Service of Northern Ireland obtained phone communications data from journalists and lawyers leads to renewed calls for inquiry Continue Reading

By

• Bill Goodwin, Computer Weekly

Tech companies operating with opacity in Israel-Palestine

Tech firms operating in Occupied Palestinian Territories and Israel are falling “woefully short” of their human rights responsibilities amid escalating devastation in Gaza, says Business & Human Rights Resource Centre Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

International police operation infiltrates LabHost phishing website used by thousands of criminals

The Metropolitan Police working with international police forces have shut down LabHost, a phishing-as-a-service website that has claimed 70,000 victims in the UK Continue Reading

By

• Bill Goodwin, Computer Weekly

CSA warns of emerging security risks with cloud and AI

Few users appreciate the security risks of cloud and have the expertise to implement the complex security controls, says CSA chief executive David Koh Continue Reading

By

• Aaron Tan, TechTarget

Security Think Tank: Approaches to ransomware need a course correction

In the wake of renewed calls for lawmakers to consider enacting legal bans on ransomware payments, the Computer Weekly Security Think Tank weighs in to share their thoughts on how to tackle the scourge for good. Continue Reading

By

• Mike Gillespie

TUC publishes legislative proposal to protect workers from AI

Proposed bill for regulating artificial intelligence in the UK seeks to translate well-meaning principles and values into concrete rights and obligations that protect workers from systems that make ‘high-risk’ decisions about them Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Gov.uk One Login accounts on the rise

Since August 2023, more than 1.8 million people verified their identity using the Gov.uk One Login app, while face-to-face verifications have also increased Continue Reading

By

• Lis Evenstad

Mandiant formally pins Sandworm cyber attacks on APT44 group

Mandiant has formally attributed a long-running campaign of cyber attacks by a Russian state actor known as Sandworm to a newly designated advanced persistent threat group to be called APT44 Continue Reading

By

• Alex Scroxton, Security Editor

US provides assurances over extradition of WikiLeaks founder Julian Assange

Extradition of the WikiLeaks founder moves a step closer after the US government gives diplomatic assurances over his treatment in the US. Assange supporters accuse the US of ‘weasel words’ Continue Reading

By

• Bill Goodwin, Computer Weekly

CISOs not yet convinced to invest in AI

CISOs say their eyes are fixed firmly on threats like ransomware and supply chain attacks, and while AI is becoming a threat that needs to be dealt with, it’s not yet an immediate spending priority Continue Reading

By

• Alex Scroxton, Security Editor

CW Innovation Awards: Balancing security and user experience

The National University of Singapore’s Safe initiative has strengthened the security of IT systems and end-user devices while prioritising user experience through passwordless access Continue Reading

By

• Edwin Yapp

2024 election security: Confronting disinformation and deepfakes

Although disinformation and deepfakes are a threat to electoral integrity, we already have ways to counter emerging threats and there is an opportunity is to adapt and scale these approaches to counter the challenge to democracy, writes Saj Huq. Continue Reading

By

• Saj Huq, Plexal

Recognising APAC’s trailblazers in digital transformation

DBS Bank and NUS were among the top industry innovators that were lauded for various transformational initiatives at the Computer Weekly Innovation Awards APAC 2024 Continue Reading

By

• Aaron Tan, TechTarget

More social engineering attacks on open source projects observed

In the wake of the recent XZ Utils scare, maintainers of another open source project have come forward to say they may have experienced similar social engineering attacks Continue Reading

By

• Alex Scroxton, Security Editor

Threat actors look to stolen credentials

In 2023, threat actors wrought havoc on corporate networks by logging in through valid accounts, and as bad actors begin investing in AI to help them identify priority targets, this problem is only expected to worsen in the future Continue Reading

By

• Martin Borrett

EU’s AI Act fails to protect the rule of law and civic space

Analysis reveals that the AI Act is ‘riddled with far-reaching exceptions’ and its measures to protect fundamental rights are insufficient Continue Reading

By

• Josh Osman, Computer Weekly

AI tapped for citizen outreach as India goes to the polls

Political parties in this year’s high-stakes elections are leveraging AI for the first time, but measures to curtail misuse must continue to evolve with the rapid developments of the technology Continue Reading

By

• Kavitha Srinivasa

OAuth (Open Authorization)

OAuth (Open Authorization) is an open standard authorization framework for token-based authorization on the internet. Continue Reading

By

• Gavin Wright
• Michael Cobb
• Stephanie Mann

Apple iPhone security alert renews spyware concerns

An Apple security alert received by users in 92 countries raises fresh fears over ongoing campaigns by users of mercenary spyware products Continue Reading

By

• Alex Scroxton, Security Editor

5G networks and biometric breakthroughs: Navigating opportunities and risks

Businesses are quickly adopting 5G to introduce advanced security features such as facial recognition, but while these technologies improve safety and ease of use, they also raise concerns about how sensitive biometric information is gathered and may be misused Continue Reading

By

• Isla Sibanda