Identity and access management products

Five Eyes in new Russia cyber warning

Latest cross-body alert warns of Russian threat to utilities and other core elements of national infrastructure Continue Reading

By

• Alex Scroxton, Security Editor

Impact of Lapsus$ attack on Okta less than feared

Okta’s investigation into Lapsus$ breach of its systems via a Sitel workstation has concluded that the impact was significantly less than the maximum potential Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC: Trend Watch: Cyber security

Protection from malicious actors has become a critical consideration for organisations in recent years. In this handbook, focused on cyber security in the Asia-Pacific region, Computer Weekly looks at how to minimise edge security risks, India’s rise in cyber security revenues, Check Point’s sales force and partner ecosystem processes, and Trellix’s decision to democratise XDR access Continue Reading

One-third of scams that hit TSB are impersonation fraud

TSB reports an increase in fraudsters impersonating trusted organisations to trick consumers into making payments to them Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

WLAN Authentication and Privacy Infrastructure (WAPI)

WLAN Authentication and Privacy Infrastructure (WAPI) is a wireless local area network security standard officially supported by the Chinese government. Continue Reading

By

• Rahul Awati

Lack of expertise hurting UK government’s cyber preparedness

UK government bodies and critical infrastructure owners cite a lack of staff resources, and internal and external expertise, as hampering factors when it comes to cyber readiness, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Universal IAM policy failings put cloud environments at risk

Almost all organisations lack appropriate IAM policy controls to effectively secure their data in the cloud, according to a damning study Continue Reading

By

• Alex Scroxton, Security Editor

AI researcher says police tech suppliers are hostile to transparency

Expert witness in Lords police tech inquiry welcomes committee’s findings but questions whether its recommendations on how to end the ‘Wild West’ of police artificial intelligence and algorithmic technologies in the UK would be implemented Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Open source CMS platform Directus patches XSS bug

A stored cross-site scripting vulnerability in the Directus platform could have enabled malicious actors to gain access to valuable data Continue Reading

By

• Alex Scroxton, Security Editor

Raspberry Pi Foundation ditches default username policy

Raspberry Pi owners will no longer be able to use the default ‘pi’ username, as the Raspberry Pi Foundation clamps down on insecure practices Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill: Collaborating to make the internet safer for all

The UK government's plan to regulate the internet and social media includes some positive and progressive measures – but by working with industry, a lot more could be achieved Continue Reading

By

• Martin Wilson

Two teenagers charged with Lapsus$ cyber attacks

City of London Police have charged two teenagers in connection with the Lapsus$ cyber crime spree Continue Reading

By

• Alex Scroxton, Security Editor

Four moves to ‘checkmate’ critical assets thanks to lax cloud security

Malicious actors can compromise 94% of critical assets within four steps of the initial breach point, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Bank fraud prevention scheme blocked £60m in fraud last year

Scheme to catch fraudsters, including online scammers, before they commit their crimes has reported a significant increase in crimes prevented Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Lapsus$ cyber crime spree continues despite arrests

The arrests of seven people in connection with the Lapsus$ cyber crime group has not dented the gang’s enthusiasm for causing chaos Continue Reading

By

• Alex Scroxton, Security Editor

Recruitment risks: Avoiding the dangers of fraudulent candidates

Tech companies are seeing an increase in fraudulent job applications, with associated impacts on risk and cyber security. So how can organisations protect themselves from fraudulent applicants while ensuring they recruit the best talent? Continue Reading

By

• Peter Ray Allison

Overhaul of UK police tech needed to prevent abuse

Lords inquiry finds UK police are deploying artificial intelligence and algorithmic technologies without a thorough examination of their efficacy or outcomes, and are essentially ‘making it up as they go along’ Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

European Commission proposes new cyber security regulations

New cyber and information security regulations have been proposed by the European Commission to create a minimum set of standards in both areas Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

London police arrest seven in connection to Lapsus$

Seven people arrested by London police over cyber attacks carried out by Lapsus$ group, which is responsible for a number of recent, high profile attacks Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How Lapsus$ exploited the failings of multifactor authentication

Attacks on Nvidia and Okta highlight weak MFA and the risk of employees being bribed or falling victim to social engineering Continue Reading

By

• Cliff Saran, Managing Editor

Private equity house spins SSE company out of McAfee Enterprise

The launch of Skyhigh Security completes division of McAfee Enterprise into separate businesses by Symphony Technology Group, which acquired the long-standing cyber security firm for $4bn in March 2021 Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

NHS urgent care provider uses ID and access management to reduce complexity for clinicians

Provider of care through NHS 111 is using a cloud-based identity and access management system to remove the need for clinicians to remember multiple passwords Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Details of Conti ransomware affiliate released

Information about a new Conti affiliate has been released by eSentire and BreakPoint Lab after a joint investigation into the group’s indicators of compromise Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

mutual authentication

Mutual authentication, also called two-way authentication, is a process or technology in which both entities in a communications link authenticate each other. Continue Reading

By

• Paul Kirvan

The state of digital identity in the UK - such a great idea, you'll need a whole bunch of them

The promise of digital identity is a simple one: Prove once that you are who you say you are, and then forever more you have a single method to log in to any online service you choose. No more ... Continue Reading

By

• Bryan Glick, Editor in chief

Ukrainian cyber defences prove resilient

Thanks to a combination of prior experience and global support, Ukraine’s defences against cyber incidents are holding strong in the face of Russian attacks Continue Reading

By

• Alex Scroxton, Security Editor

NCSC catches 10 million phishes

Nation Cyber Security Centre’s scam email reporting service enjoys great success as government embarks on new cyber awareness campaign Continue Reading

By

• Alex Scroxton, Security Editor

Online Safety Bill introduced in Parliament

The government has introduced its long-awaited Online Safety Bill in Parliament, alongside new criminal offences and sanctions for tech company execs Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Value of contactless transactions doubles in two years

Almost £166bn was spent in the UK last year using contactless technology, compared with £80.5bn in 2019 Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

SentinelOne adds Attivo Networks to identity portfolio

SentinelOne adds identity threat detection and response technology to its cyber portfolio, saying it will benefit zero-trust adoption among its customers Continue Reading

By

• Alex Scroxton, Security Editor

Paid-for advertising measures included in Online Safety Bill

New measures to deal with fraudulent paid-for advertising have been included in the government’s draft Online Safety Bill, marking the fourth extension in two months Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How APAC organisations can mitigate edge security threats

The move to the edge expands an organisation’s attack surface. Here are some measures that organisations can take to minimise their edge security risks Continue Reading

By

• Aaron Tan, TechTarget

Online Safety Bill updated to deal with anonymous abuse

Social media companies will be forced to deal with anonymous abuse online by the introduction of new measures in the Online Safety Bill Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Shared Key Authentication (SKA)

Shared Key Authentication (SKA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. Continue Reading

By

• Andrew Zola

The UK’s cyber security sector is thriving, but our work has only just begun

The government’s Annual Cyber Sector Report painted a positive picture of the UK security industry. CIISec’s Amanda Finch thinks we can go further in developing cyber talent and opening up the sector Continue Reading

By

• Amanda Finch, Institute of Information Security Professionals

KnowBe4 cyber drama tackles Colonial Pipeline in fourth season

KnowBe4’s ongoing cyber security training drama, The Inside Man, reaches its fourth season with a plot drawing inspiration from one of the most impactful cyber attacks of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

New cyber guidelines to safeguard construction sector

NCSC launches sector-specific security guidance for organisations in the construction industry, with input from the Chartered Institute of Building Continue Reading

By

• Alex Scroxton, Security Editor

Backups ‘no longer effective’ for stopping ransomware attacks

Traditional methods of mitigating ransomware are less efficacious thanks to the rise in double and triple extortion techniques Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft extends Defender umbrella to Google Cloud Platform

Redmond says extending Defender for Cloud native capabilities to the Google Cloud Platform will help simplify security for organisations pursuing multicloud strategies by eliminating the gaps where the bad guys can get in Continue Reading

By

• Alex Scroxton, Security Editor

UK organisations swift to chide phishing victims

While UK organisations are doing better at security training, many are quick to punish employees who fall victim to phishing attacks, whether real or simulated Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Good training is all about context

In-house or outsourced? What makes a good security training programme, and what questions should buyers ask when procuring training as a service? Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

Lawyers say ‘unprecedented’ secrecy deprived EncroChat defendants of fair trials

Lawyers from seven countries say it is impossible for their clients to challenge the accuracy, authenticity, reliability and legality of the evidence against them Continue Reading

By

• Bill Goodwin, Computer Weekly

2021 another record year for UK cyber investment

Total revenue generated by the UK’s cyber sector was up 14% last year, and UK-registered security firms raised over £1bn in investment Continue Reading

By

• Alex Scroxton, Security Editor

Levelling Up Access to Jobs

Over 400 employers attended a briefing with officials from Home Office and DCMS on 27th January when we learned that, welcome though the new processes are, those without a current UK passport will ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Lack of knowledge disastrous for effective security strategy within Dutch companies

Most Dutch companies still haven’t realised that security is an integral part of their IT and company strategy Continue Reading

By

• Kim Loohuis

UK second in money laundering hall of shame

Banks need to step up their anti-money laundering processes if billions of pounds’ worth of criminal activity is to be prevented Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

The Security Interviews: Building the UK’s future cyber ecosystem

As the government lays out the next iteration of its Cyber Security Strategy, we speak to Plexal and Lorca’s Saj Huq about his work building a cyber ecosystem to support the UK’s future ambitions Continue Reading

By

• Alex Scroxton, Security Editor

Parasol data breach: Contractors rage as fallout from umbrella cyber attack continues

Contractors working for the Parasol umbrella company are querying why it has taken so long for news of the firm's data breach, which is linked to a cyber attack on its systems five weeks ago, to come to light Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

Porn sites will be legally required to verify users’ ages

Porn sites could be legally obliged to verify that their users are 18 or over under proposed online safety rules, in UK government’s second attempt to prevent children from accessing pornography online Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

EC proposes new directive to improve gig economy work conditions

Gig economy workers in Europe could be entitled to more rights and better workplace protections under a directive proposed by the European Commission Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Active Directory tree

An Active Directory (AD) tree is a collection of domains within a Microsoft Active Directory network. Continue Reading

By

• Rahul Awati

Zero-trust to soar in 2022, but dogged by implementation challenges

IT leaders are keen to invest in zero-trust, but face issues around a lack of expertise, and selling the concept into the C-suite Continue Reading

By

• Alex Scroxton, Security Editor

Nationwide Building Society streamlines digital onboarding through API

Building society is improving its digital onboarding process through application programming interface-based technology from a US startup Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

MPs call on government to ‘push harder’ and ‘act faster’ amid online fraud epidemic

MPs on the Treasury Committee want the government to act quickly to reduce the amount of money being stolen through online fraud Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

What neurodivergent people really think of working in cyber security

Many firms are filling cyber security skills gaps by hiring neurodivergent talent – but more support is needed for neurodivergent cyber security professionals, writes autistic tech journalist Nicholas Fearn Continue Reading

By

• Nicholas Fearn

Novel phishing campaign highlights need for MFA, says Microsoft

Microsoft details a new multi-stage phishing campaign that only affects victims without multifactor authentication in place Continue Reading

By

• Alex Scroxton, Security Editor

Cyber Essentials programme gets biggest update since launch

NCSC implements a thorough revision of its Cyber Essentials scheme to reflect the changing security landscape Continue Reading

By

• Alex Scroxton, Security Editor

Government funds charity campaign to warn big tech over the risks of encryption to children

Barnardo’s and other charities begin a government-backed PR campaign to warn of the dangers end-to-end encryption poses to child safety, which has been criticised as being ‘one-sided’ Continue Reading

By

• Bill Goodwin, Computer Weekly

Test police algorithms in court rather than legislate, Lords told

Police algorithms and their impacts should be tested and challenged in court, rather than controlled by new laws, says policing minister Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Nordic companies targeted in wave of cyber attacks

After a slew of cyber attacks hit major companies in the Nordics at the end of last year, we look at how they were affected and how they have recovered Continue Reading

By

• Gerard O'Dwyer

UK government bodies challenged on secure identity

Public sector bodies in the UK recognise secure identity and access management as critical to the roll-out of digital services, but face challenges in addressing this Continue Reading

By

• Alex Scroxton, Security Editor

Banks accused of neglecting customer security measures

Which? singles out Metro Bank, Virgin Money and TSB over insecure online banking processes Continue Reading

By

• Alex Scroxton, Security Editor

Companies propose scanning content pre-encryption to fight CSAM

Firms working on the UK government’s Safety Tech Challenge have suggested that scanning content before encryption will help prevent the spread of child sexual abuse material – but privacy concerns remain Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

How APAC firms can stay ahead of cyber threats

Organisations will need to develop behavioural detection, machine learning and threat hunting capabilities to keep pace with the onslaught of cyber attacks Continue Reading

By

• Aaron Tan, TechTarget

smart card

A smart card is a physical card that has an embedded integrated chip that acts as a security token. Continue Reading

By

• Ben Lutkevich, Site Editor
• Linda Rosencrance
• Michael Cobb

SPML (Services Provisioning Markup Language)

Services Provisioning Markup Language (SPML) is an open source XML-based standard that facilitates the exchange of account provisioning information among applications, services and organizations. Continue Reading

By

• Gavin Wright

Top 10 cyber security stories of 2021

Cyber security dominated the headlines in 2021, making it hard to gain a clear picture of what to pay attention to. What is an IT buyer to do? Continue Reading

By

• Alex Scroxton, Security Editor

Is the IT sector beset by fear-mongering?

The arms race between hackers and security teams has led to a plethora of new technologies, but it can be hard to differentiate between sensible cyber purchases and those that are promoted by exaggerating risk Continue Reading

By

• Peter Ray Allison

HSBC fined £64m for automated transaction monitoring failures

Bank hit by multimillion-pound fine for failures related to its transaction monitoring, which failed to spot potential money-laundering activity Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

UK and US to collaborate on privacy innovation contest

Joint UK-US innovation challenge contest centring on privacy-enhancing technology announced at Summit for Democracy in Washington DC Continue Reading

By

• Alex Scroxton, Security Editor

Most consumers expect banks to cover losses to scams

Consumers expect banks to cover losses to cyber crime, as the number of attacks grows Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

biometric payment

Biometric payment is a point-of-sale (POS) technology that uses biometric authentication physical characteristics to identify the user and authorize the deduction of funds from a bank account. Continue Reading

By

• Katie Terrell Hanna

IT Priorities 2022: Pandemic’s long tail for cyber buyers

Pandemic response has been top of mind for cyber leaders these past 18 months, and as Covid-19 turns two, the TechTarget/Computer Weekly IT Priorities 2022 study shows buyers are still focused on how Covid has upended the workplace Continue Reading

By

• Alex Scroxton, Security Editor

Surge in Nobelium-linked supply chain attacks

Mandiant’s researchers share new intel on two distinct clusters of Russian APT activity, linked to the Nobelium SolarWinds attackers Continue Reading

By

• Alex Scroxton, Security Editor

Millions of credit card details for sale on dark web for as little as 75p

The credit card details of millions of people from across the world can be bought by criminals using the dark web for as little as $1 Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Kaspersky introduces cyber policy for bionic devices

Cyber firm Kaspersky has become one of the first organisations in the world to develop and implement a security policy covering the use of bionic devices and other forms of human augmentation Continue Reading

By

• Alex Scroxton, Security Editor

The way we talk and think about tech is crucial to helping solve the skills shortage crisis

Companies are looking to short-term fixes to find IT specialists, but there is still a need for long-term solutions Continue Reading

By

• Andy Heyes, Harvey Nash

UK consumers warned of increase in credit card application fraud

There has been a sharp rise in fraudsters using stolen personal details to open credit card accounts Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Police tech introduced with little scrutiny or training

A Lords inquiry into the adoption of advanced algorithmic technologies by police in England and Wales has been told that new tools are being introduced without proper training and with little scrutiny of their impacts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Can the tech community show us how to save the world?

In this week’s Computer Weekly, we report from the COP26 conference on how the tech world’s collaborative open source model could help tackle climate change. Gartner has urged IT leaders to rethink their role as business come to rely on digital technologies. And we ask if your office security is at risk as staff return. Read the issue now. Continue Reading

Black Friday cyber warning for 4,000 card-skimming victims

NCSC warns thousands of small retailers that their websites are being exploited to steal customer data Continue Reading

By

• Alex Scroxton, Security Editor

Back to the past with government identity

The UK government plans to spend up to £400m developing yet another digital identity system – why is taxpayer money going into a time warp when there is surely a better and cheaper way? Continue Reading

By

• Jerry Fishenden

Why is Emotet back, and should we be worried about it?

The sudden reappearance of Emotet this week has security teams on high alert, but do we need to be worried about its return, and what should we be doing about it? Continue Reading

By

• Alex Scroxton, Security Editor

Security startups line up on Cyber Runway

Some 108 cyber security startups representing the UK’s most cutting-edge innovators are to join Plexal’s Cyber Runway accelerator Continue Reading

By

• Alex Scroxton, Security Editor

How cosmetics retailer Lush made over its approach to authentication

Evolving approaches to IT at cosmetics retailer Lush meant the organisation’s previous approach to authentication was no longer up to scratch. Find out how it overcame this hurdle Continue Reading

How cosmetics retailer Lush authenticates with ease

In this week’s Computer Weekly, we find out how Lush has modernised user authentication, governed by a desire to care for customer data. We also talk to the chief data officer at Nasa about data as a strategic asset, and the ground of better decision-making. And we foreground a call for the government and the Post Office to compensate victims of the Horizon computer system without delay. Read the issue now. Continue Reading

UK government proposes new rules for digital supply chain security

Proposals could see IT service providers legally required to adhere to the NCSC’s Cyber Assessment Framework, among other things Continue Reading

By

• Alex Scroxton, Security Editor

New law needed to rein in AI-powered workplace surveillance

MPs and peers call for new legislation to regulate the growing use of artificial intelligence in the workplace, which is being used to surveil workers’ performance and behaviour Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Oversight of biometrics and surveillance should not go to ICO

Biometrics and surveillance camera commissioner Fraser Sampson has panned the UK government’s proposed plan to absorb the functions of those roles under the remit of the information commissioner Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

HPE’s Aruba networking unit hit by cyber attack

Undisclosed threat actor compromised data buckets used to run the Aruba Central cloud environment using a stolen access key Continue Reading

By

• Alex Scroxton, Security Editor

Finance ombudsman overturns more than three-quarters of bank decisions on APP fraud

The financial services ombudsman is siding with customers in over 75% of complaints against banks that refuse to repay losses to authorised push payment fraud Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Bank of England loses 161 computing devices in three years

Bank cannot account for phones, laptops and tablets that have gone missing over the past three years Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Yoti develops age estimation algorithm for under-13s

Age estimation technology developed by Yoti is being pitched as a way of helping social media platforms and other online businesses protect younger internet users from harm Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Watching me, watching you – challenging the rise of digital surveillance at work

Unprecedented levels of digital monitoring at work is embedding a culture of surveillance, despite workers’ opposition to the practices, says Prospect Union Continue Reading

By

• Andrew Pakes, Prospect Union

How cosmetics retailer Lush made over its approach to authentication

Evolving approaches to IT at cosmetics retailer Lush meant the organisation’s previous approach to authentication was no longer up to scratch. Find out how it overcame this hurdle Continue Reading

By

• Alex Scroxton, Security Editor

The Netherlands works on resilience with large-scale national cyber exercise

For the Netherlands, the biggest challenge in a large-scale cyber crisis is to maintain speed while exercising due care Continue Reading

By

• Kim Loohuis

Facebook self-imposes facial recognition moratorium

Facebook and Meta have committed to halting their use of facial recognition technology and deleting the biometric data of more than a billion people by the end of 2021, but will retain the underlying algorithms and software for potential use in future products Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

GDS secures up to £400m funding for One Login digital identity project

HM Treasury agrees to spending review bid from Cabinet Office to create the new single sign-on system for government over the next three years Continue Reading

By

• Bryan Glick, Editor in chief

Government commits millions to security investment

Spending Review adds more than £750m of funding to improve cyber security resilience across government Continue Reading

By

• Alex Scroxton, Security Editor

Cyber experts on how to nobble a Nobelium attack

A recent spate of attempted Nobelium cyber attacks were mostly unsuccessful, but serve as a reminder to pay attention to some more fundamental aspects of security Continue Reading

By

• Alex Scroxton, Security Editor