Regulatory compliance and standard requirements

US Cyber Board to probe cloud security after latest Exchange hack

CSRB review of cloud security comes in the wake of a major Chinese cyber attack on US government bodies orchestrated through Microsoft’s cloud services Continue Reading

By

• Alex Scroxton, Security Editor

Northern Irish police expose staff data in botched FoI response

Human error is being blamed for the leak of personally identifiable information on all serving officers and civilian staff at the Police Service of Northern Ireland Continue Reading

By

• Alex Scroxton, Security Editor

UK voter data hacked in cyber attack on election watchdog

An unknown threat actor who attacked the UK’s Electoral Commission had access to data on millions of UK voters for over a year, the watchdog has revealed Continue Reading

By

• Alex Scroxton, Security Editor

Biden’s SBOM mandate a ‘shot heard around the world’, report says

Two years and three months after Joe Biden mandated new standards in supply chain security, over 40% of UK respondents to a survey say they have implemented new SBOM policies in direct response Continue Reading

By

• Alex Scroxton, Security Editor

SOC 2 (System and Organization Controls 2)

SOC 2 (System and Organization Controls 2), pronounced "sock two," is a voluntary compliance standard for ensuring that service providers properly manage and protect the sensitive data in their care. Continue Reading

By

• Robert Sheldon
• Alex DelVecchio, Content Development Strategist

Microsoft attacked over ‘grossly irresponsible’ security practice

The CEO of Tenable has launched a scathing attack on Microsoft, asserting that the organisation is deliberately keeping its Azure cloud customers in the dark about dangerous vulnerabilities and accusing it of a culture of ‘toxic obfuscation’ Continue Reading

By

• Alex Scroxton, Security Editor

Vigilance advised if using AI to make cyber decisions

The AI arms race is heating up, and the battle lines are being redrawn. Still, organisations should proceed cautiously and remain vigilant in scrutinising AI’s ability to ensure accurate, safe, and informed decision-making. Continue Reading

By

• Peter Gregory, GCI Communications
• Ejona Preci, Lindal Group

compliance audit

A compliance audit is a comprehensive review of an organization's adherence to regulatory guidelines. Continue Reading

By

• Kassidy Kelley

Does AI have a future in cyber security? Yes, but only if it works with humans

Do AI and ML hold the promise of helping cyber pros achieving the holy grail of operating quicker, cheaper, and with higher efficiency? We shouldn’t hold our breath, says Nominet’s Paul Lewis Continue Reading

By

• Paul Lewis, Nominet

How Indian organisations are keeping pace with cyber security

Indian organisations are shoring up their defences to improve their cyber resilience amid intensifying cyber threats targeted at key sectors such as healthcare and logistics Continue Reading

By

• Pratima Harigunani

US cyber breach reporting rules to have global impact

Organisations that operate as Foreign Private Issuers in the US will have to get to grips with strict new cyber breach reporting regulations handed down by the SEC in Washington Continue Reading

By

• Alex Scroxton, Security Editor

Meta results show impact of data fines and datacentre upgrade strategy

The owner of Facebook is battling with regulators over transferring EU data to the US. It is also seeing less improvements on CPUs Continue Reading

By

• Cliff Saran, Managing Editor

Ant Group teams with NTU to advance privacy-preserving technologies

The Chinese fintech giant is partnering with Singapore’s Nanyang Technological University on a cryptographic protocol that ensures the privacy of transacting parties Continue Reading

By

• Aaron Tan, TechTarget

UK organisations lack confidence to carry out basic cyber tasks

Amid a shortfall of more than 10,000 cyber pros, UK businesses are still finding it difficult to fill their cyber security skills gaps, with even those in charge of security saying they lack confidence in themselves Continue Reading

By

• Alex Scroxton, Security Editor

Cisco, BT and others launch network security coalition

Network Resilience Coalition focuses on bringing together global expertise to improve data and network security Continue Reading

By

• Alex Scroxton, Security Editor

Tetra radio users’ comms may have been exposed for years

A number of flaws in the encryption algorithms used in the secure Tetra radio communications standard have potentially left users exposed to snooping Continue Reading

By

• Alex Scroxton, Security Editor

Tribunal investigates complaint that journalists’ phones were unlawfully monitored

The Investigatory Powers Tribunal has agreed to investigate complaints by Northern Ireland investigative journalists Trevor Birney and Barry McCaffrey that they were unlawfully placed under surveillance Continue Reading

By

• Bill Goodwin, Computer Weekly

802.11

802.11 is a family of evolving specifications for wireless local area networks (WLANs) developed and maintained by a working group of IEEE. Continue Reading

By

• Garry Kranz

Security AI and automation may reduce cost of data breaches

Organisations that go all in on security AI and automation tend to incur lower financial costs when they experience a data breach incident, according to an IBM report Continue Reading

By

• Alex Scroxton, Security Editor

Why cyber security should be part of your ESG strategy

The impact of data breaches and cyber threats on businesses, societies and the environment makes cyber security a key consideration in an environment, social and governance strategy Continue Reading

By

• Aaron Tan, TechTarget

Handbook helps Dutch organisations migrate to quantum-safe communication

Organisations must start implementing new cryptography standards – as migration is a lengthy process Continue Reading

By

• Kim Loohuis

The problem with ‘secure’ messaging

Secure instant messaging is becoming a norm for business communications but it raises three important security and compliance questions   Continue Reading

By

• Andersen Cheng, Executive Chairman, Post-Quantum  

invitation to tender (ITT)

An invitation to tender (ITT) is a formal document that is issued by a company or an organization inviting suppliers or contractors to submit a bid for a project or service. Continue Reading

By

• Katie Terrell Hanna

What the Product Security and Telecommunications Infrastructure Act means for UK industry

For years, many network-connected devices have lacked adequate security, putting their users and others at risk of cyber attacks. The UK’s PSTI Act aims to prevent this by mandating minimum security requirements, but what impact will this have on industry? Continue Reading

By

• Peter Ray Allison

Government boosts protection for encryption in Online Safety Bill but civil society groups concerned

House of Lords adopts amendment to require Ofcom to commission a report before requiring technology companies to scan encrypted messages, but drops proposals for judicial oversight Continue Reading

By

• Bill Goodwin, Computer Weekly

How the DSMA balances security and privacy with press freedom

In a world of information sharing and 24-hour news cycles, the Defence and Security Media Advisory committee have to balance national security and data privacy with freedom of the press Continue Reading

By

• Peter Ray Allison

At the gates – How to survive the era of cyber insecurity

Businesses face more legal risks, a mine field of regulation, and individual liability for failures. Getting the basis right is more important than ever. Continue Reading

By

• Alex Cravero, senior associate and Andrew Moir, partner, Herbert Smith Freehills

Half of cyber pros engage in risky behaviour at work, report claims

Approximately 55% of security professionals say they have engaged in behaviours they would more usually advise against in the workplace, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Cyber criminal AI tool WormGPT produces ‘unsettling’ results

A newly discovered generative AI tool dubbed WormGPT is being sold to the cyber criminal underground via the dark web, and poses a significant danger, researchers warn Continue Reading

By

• Alex Scroxton, Security Editor

Prepare for quantum to fundamentally change PKI effectiveness

Encryption has always been a fundamental aspect of Public Key Infrastructure but the rise of quantum computing poses a significant threat to this. Thales' John Cullen says post-quantum cryptography may hold the key to safeguarding the future. Continue Reading

By

• John Cullen

NATO membership to drive Nordic cyber security sector growth

The Nordic cyber security sector will see increasing demand as Finland and Sweden joint NATO Continue Reading

By

• Gerard O'Dwyer

The essential role of PETs in unlocking the trillion dollar SaaS market

Ahead of the Eyes-Off Data Summit in Dublin, Jack Fitzsimons of Oblivious AI explains why so-called Privacy Enhancing Technologies or PETs may hold the key to unlocking the full potential of SaaS in the enterprise Continue Reading

By

• Jack Fitzsimons, Oblivious AI

Police Scotland use cloud for biometric data despite clear risks

Police Scotland confirms it has stored significant volumes of biometric data on a cloud-based digital evidence sharing system despite major ongoing data protection concerns, bringing into question the effectiveness of the current regulatory approach and the overall legality of using hyperscale public cloud technologies in a policing context Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Improve business outcomes by managing data and analytics risk

An effective data and analytics risk and control environment requires a full understanding of data, analytics and AI risks, related risk decisions and their impact on business outcomes Continue Reading

By

• Saul Judah

MPs launch inquiry into government use of data

The Public Administration and Constitutional Affairs Committee is to investigate the possibility of reforming the way government collects and analyses data, and whether the UK census could be scrapped Continue Reading

By

• Lis Evenstad

Forensic Institute provides Hansken viewing method for Dutch lawyers

Dutch lawyers can now view crypto communication in criminal cases from their own workplace via digital search engine Hansken. Previously, this had to be done at an external location Continue Reading

By

• Kim Loohuis

Ofcom’s online safety preparedness efforts hobbled by government

Despite Ofcom’s progress so far, UK government changes to the scope and timetable of the Online Safety Bill are hobbling the ability of the regulator to successfully prepare for the new regime Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Whistleblower contacts NatWest customers affected by a decade-old data breach

Former worker says contacting the people affected by the data breach is her last resort after the bank and regulators appear satisfied that the sensitive data file is safe stored under her bed Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

EU formally grants data adequacy to US

The European Commission has formally granted the US data adequacy, allowing companies and organisations to freely transfer personal data across the Atlantic via the EU-US Data Privacy Framework. But privacy activist Max Schrems has already committed to legally challenging the decision Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Malicious URL volumes soar as cyber criminals pull on Threads

Malicious actors have been quick to exploit the buzz around Meta’s newly launched Threads platform, with thousands of new suspicious domains registered exploiting its branding Continue Reading

By

• Alex Scroxton, Security Editor

Norwegian data privacy experts sound alarm over generative AI

Hundreds of millions of people embrace generative artificial intelligence, blissfully ignorant of what it’s doing to data privacy. Continue Reading

By

• Pat Brans, Pat Brans Associates/Grenoble Ecole de Management

Suspicious email reported every five seconds in UK

National Cyber Security Centre report reveals a suspicious email was reported by UK citizens and organisations every five seconds last year Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

VMware ramps up on sovereign cloud in APAC

VMware is working with local partners to deliver sovereign cloud services in the region, amid growing sovereignty interests among governments and the need maintain business continuity Continue Reading

By

• Aaron Tan, TechTarget

Biometrics watchdog calls for public space surveillance review

The biometrics and surveillance camera commissioner is calling for a review of public space surveillance to gain a clearer picture about the proliferation of Chinese surveillance technology across the public sector, but warns against applying double standards on companies just because they are from China Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Meta’s Threads hits app stores, but no EU launch in sight

Meta’s Twitter competitor makes its debut and signs up millions of users in just 12 hours, but concerns over compliance with the EU’s Digital Markets Act have sunk a pan-European launch for now Continue Reading

By

• Alex Scroxton, Security Editor

Germany: European Court of Justice hears arguments on lawfulness of EncroChat cryptophone evidence

The European Court of Justice will decide whether the collection and sharing of data intercepted by law enforcement from EncroChat crypto phone network is compatible with European law Continue Reading

By

• Bill Goodwin, Computer Weekly

UK public increasingly concerned over NHS data sovereignty

Amid security concerns and AI advances, a majority of the British public still trusts the NHS to store and analyse their health data, but would prefer it remains domiciled in the UK Continue Reading

By

• Alex Scroxton, Security Editor

EU judgment sinks Meta’s argument for targeted ads

The EU Court of Justice has issued a significant judgment against Meta, ruling that national anti-trust bodies can investigate GDPR breaches, disrupting the platform’s entire basis for carrying out targeted advertising Continue Reading

By

• Alex Scroxton, Security Editor

AI can never be given control over combat decisions, Lords told

Artificial intelligence is technically incapable of distinguishing between the complex contextual factors of combat situations, and will likely never be able to, according to legal and software experts Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

The time to implement an internal AI usage policy is now

As with any emerging technology, AI’s growth in popularity establishes a new attack surface for malicious actors to exploit, thereby introducing new risks and vulnerabilities to an increasingly complex computing landscape. Continue Reading

By

• Shailendra Parihar, Turnkey Consulting

Charity demands transparency in digital universal credit system

The digital universal credit system needs overhauling to ensure greater transparency over benefit claims and more effective means of redress when things go wrong, says child poverty charity Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

GDPR tax reclaim scheme preys on fears of SMEs

IT suppliers are a target of companies offering a tax reclaim scheme that preys on small businesses’ fears around General Data Protection Regulation compliance Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

3,600 potential cyber security experts apply to government scheme

The UK government’s Upskill in Cyber programme is reporting great success just a month after launch, with almost half of applicants women Continue Reading

By

• Alex Scroxton, Security Editor

ChatGPT’s phishing ‘problem’ may not be overstated

Some data now suggests that threat actors are indeed using ChatGPT to craft malicious phishing emails, but the industry is doing its best to get out in front of this trend, according to the threat intelligence team at Egress Continue Reading

By

• Jack Chapman

ICO under fire for taking limited action over serious data breaches

The ICO has come under fire from lawyers and data protection specialists for just issuing written warnings to two public bodies over serious data breaches that placed people’s lives at risk Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Generative AI: Data privacy, backup and compliance

We look at generative AI and the risks it poses to data privacy for the enterprise, implications for backup, and potentially dangerous impacts on compliance Continue Reading

By

• Stephen Pritchard

Phishing and ransomware dominate Singapore’s cyber threat landscape

Phishing and ransomware attacks continued apace in Singapore last year amid signs of improving cyber hygiene Continue Reading

By

• Aaron Tan, TechTarget

Nearly quarter of a million malicious websites reported and removed through NCSC service

A suspicious email and text message reporting service in the UK has directly led to a quarter of a million malicious websites being removed Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Podcast: Cloud security, compliance and data classification

The rise of cloud has led to a proliferation of enterprise data and a rise in risk. We talk to Vigitrust CEO Mathieu Gorge about how to ensure compliance in a multicloud world Continue Reading

By

• Antony Adshead, Storage Editor

ChatGPT is creating a legal and compliance headache for business

ChatGPT’s increased use in the workplace has led many to question its legal and compliance implications for businesses. Experts warn that the software poses major security and copyright risks Continue Reading

By

• Nicholas Fearn

PCI compliance

PCI compliance is adherence to the set of policies and procedures developed to protect credit, debit and cash card transactions and prevent the misuse of cardholders' personal information. Continue Reading

By

• Nick Barney, Technology Writer
• Ben Cole, Executive Editor

NCSC warns over ‘enduring’ LockBit threat

Although its activity volumes have been lower of late, LockBit is still a highly dangerous ransomware gang and is now the subject of a new international cyber advisory Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware-stricken Capita to run Action Fraud successor

A £50m deal to replace the Action Fraud service has been handed to PwC and Capita, which is facing investigations over its handling of customer data in a ransomware incident Continue Reading

By

• Alex Scroxton, Security Editor

Podcast: Containers, Kubernetes, data protection and compliance

Containers offer benefits to application deployment, but they proliferate, so tracking them for compliance purposes can be a challenge. We talk to Mathieu Gorge, CEO of Vigitrust Continue Reading

By

• Antony Adshead, Storage Editor

TSB calls on Meta to intervene and protect users from fraud losses of £250m this year

TSB is the latest bank to demand more action from social media sector in helping to reduce online fraud Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Arnold Clark data leak victims prepare legal action

More than 10,000 people who had their data stolen and leaked in a ransomware attack on the Arnold Clark car dealer network have signed up to a group legal action after facing elevated amounts of fraud Continue Reading

By

• Alex Scroxton, Security Editor

(ISC)² and CIISec set out to make cyber language more inclusive

Newly published guide on appropriate use of language in cyber security aims to help make the profession more inclusive for all Continue Reading

By

• Alex Scroxton, Security Editor

UK and US move closer to transatlantic data bridge deal

The British and American governments have committed, in principle, to a new data bridge agreement that will ease the free flow of personal data across the Atlantic Continue Reading

By

• Alex Scroxton, Security Editor

UK gets new rules to regulate crypto sector

The Financial Conduct Authority is introducing new rules to regulate the cryptoasset sector, after being handed a government remit to oversee crypto promotions Continue Reading

By

• Alex Scroxton, Security Editor

Regulatory ‘lacuna’ around facial recognition threatens rights

The UK is heading for a “legal quagmire” around live facial recognition if the government and regulators do not take action to rein in use of the technology before it becomes ubiquitous Continue Reading

By

• Kingsley Hayes, Keller Postman UK

Bishop Fox’s Vinnie Liu talks offensive security skills

There is growing demand for offensive security testing, but it needs a multi-layered skillset that can be hard to quantify. Bishop Fox’s CEO and co-founder explains why and some potential mitigation strategies Continue Reading

By

• Peter Ray Allison

Podcast: Storage, backup, AI and data classification at RSA 2023

Much discussion at RSA 2023 about artificial intelligence, the risks to data protection, storage and compliance, plus risk and data classification, especially its impacts on access and data management Continue Reading

By

• Antony Adshead, Storage Editor

UKtech50 2023 winner: Michelle Donelan/Chloe Smith, secretary of state, DSIT

Computer Weekly looks at the achievements and successes of the Department for Science, Innovation and Technology, as its secretary of state is recognised as the most influential person in UK technology for 2023 Continue Reading

By

• Lis Evenstad

Clop cyber gang claims MOVEit attack and starts harassing victims

The Clop cyber extortion and ransomware operation is demanding organisations pay a ransom to avoid data stolen via an exploited vulnerability in a file transfer product being leaked Continue Reading

By

• Alex Scroxton, Security Editor

Google launches hacker-backed SME security training scheme

Citing research that shows almost half of SMEs are struggling to recruit cyber security specialists, Google is launching a programme designed to upskill more people to fill thousands of vacant roles Continue Reading

By

• Alex Scroxton, Security Editor

Bank of International Settlement sets up channel secure from quantum breach

The Bank of International Settlement has worked with two of Europe's central banks to explore preventing the security risks posed by quantum computers Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Discovering the Diversity Process Flow in cyber

The UK Cyber Security Council's Simon Hepburn explains the Council's new Diversity Process Flow framework, and outlines its potential implications for ethnic minorities in the cyber sector Continue Reading

By

• Simon Hepburn, UK Cyber Security Council

Met Police director of intelligence defends facial recognition

The Met Police’s director of intelligence has appeared before MPs to make the case for its continuing use of facial-recognition technology, following announcements from the force and the Home Office that they intend to press on with its adoption Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Generative AI – the next biggest cyber security threat?

Following the launch of ChatGPT in November 2022, several reports have emerged that seek to determine the impact of generative AI in cyber security. Undeniably, generative AI in cyber security is a double-edged sword, but will the paradigm shift in favour of opportunity or risk? Continue Reading

By

• Luke Witts

Security Think Tank: A brief history of (secure) coding

From controlling who was allowed to work with IBM mainframes to present-day DevSecOps techniques, the concept of secure coding has a longer history than you might think Continue Reading

By

• Michael Healey, Turnkey Consulting

Downstream breaches of Capita customers spreading

As many as 90 organisations that used Capita services have now reported data breaches arising from various security incidents at the outsourcer Continue Reading

By

• Alex Scroxton, Security Editor

Cisco joins growing Manchester cyber security hub

Networking kingpin signs up to Greater Manchester Digital Security Hub to support centre’s work on security resilience and skills Continue Reading

By

• Alex Scroxton, Security Editor

Five key steps where there is a risk of fraud investigation

When fraud investigators come knocking, there are some important ways in which management and senior IT professionals can make sure their company is best protected. Continue Reading

By

• Caroline Day and Phil Taylor

Cabinet Office publishes response to data sharing for digital ID consultation

The majority of respondents to government’s consultation on data sharing for digital identity are critical to the plans and concerned about data privacy, but Whitehall’s response says many of the responses ‘were driven by anti-digital commentaries’ Continue Reading

By

• Lis Evenstad

Almost all ransomware attacks target backups, says Veeam

Some 93% of ransomware attacks go for backups and most succeed, with 60% of those attacked paying the ransom, according to a Veeam survey Continue Reading

By

• Antony Adshead, Storage Editor

Kuwait bank introduces biometric payments card

Middle East bank launches payment cards with fingerprint sensor technology embedded Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Cohesity Turing aims AI tools at backup and ransomware

Backup supplier continues to enrich its ecosystem with more artificial intelligence for backup and ransomware, with chat-like reporting functions and new security partners in its alliance Continue Reading

By

• Antony Adshead, Storage Editor

Facebook owner Meta fined record €1.2 billion over EU-US data transfers

Decision could have implications for other companies using Standard Contractual Clauses to share data between Europe and the US Continue Reading

By

• Bill Goodwin, Computer Weekly

How AI ethics is coming to the fore with generative AI

The hype around ChatGPT and other large language models is driving more interest in AI and putting ethical considerations surrounding their use to the fore Continue Reading

By

• Aaron Tan, TechTarget

Let’s put an end to secrecy and cover-ups in ransomware attacks

The NCSC and the ICO are calling for organisations to bite the bullet and be more open about cyber security and ransomware incidents, and the community is firmly behind them Continue Reading

By

• Alex Scroxton, Security Editor

Australia to shore up cyber and digital capabilities in Budget 2023

Australia is spending more than A$2bn to strengthen cyber resilience, improve digital government services and fuel AI adoption, among other areas, in its latest budget Continue Reading

By

• Stephen Withers

Journalists’ confidential communications subject to unlawful spying, court hears

Campaign group Liberty and the National Union of Journalists tell Court of Appeal the government has not gone far enough to protect confidential journalist information and sources from surveillance Continue Reading

By

• Bill Goodwin, Computer Weekly

Black Basta ransomware attack to cost Capita over £15m

Exceptional costs arising from the March 2023 Black Basta ransomware attack on the systems of outsourcer Capita will be somewhere between £15m and £20m, the organisation says Continue Reading

By

• Alex Scroxton, Security Editor

standardization

Standardization is the process of developing, promoting and possibly mandating standards-based and compatible technologies and processes within an industry. Continue Reading

By

• Paul Kirvan

OVHcloud aims to bring Glacier-like cloud archive to Europe

OVHcloud makes Cold Archive GA with deep archive storage cheaper than AWS’s offer and all based on IBM 3592 tape hardware spread across four sites with Atempo backup Continue Reading

By

• Yann Serra, LeMagIT
• Antony Adshead, Storage Editor

Chat control: EU lawyers warn plans to scan encrypted messages for child abuse may be unlawful

Leaked legal advice warns that European ‘chat control’ proposals to require tech companies to scan private and encrypted messages for child abuse are likely to breach EU law Continue Reading

By

• Bill Goodwin, Computer Weekly

Capita pension clients told data may have leaked

Capita has told trustees of some of the pension funds for which it provides outsourced services that their customer data may have been stolen by the Black Basta ransomware operation Continue Reading

By

• Alex Scroxton, Security Editor

Santander reports increase in scams and admits fraud head was impersonated

Santander has reported an increase in impersonation scams, and admitted its own head of fraud was impersonated by a fraudster Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Cyber Action Plan for Wales launched

The devolved Welsh government has set out four priorities in an action plan designed to foster cyber resilience, talent and innovation across the country Continue Reading

By

• Alex Scroxton, Security Editor

Government anti-fraud strategy targets the tech behind the scams

The UK government’s anti-fraud strategy proposes to make it much harder for criminals to target their victims by cracking down on the exploitation of technology Continue Reading

By

• Alex Scroxton, Security Editor