Security policy and user awareness

Gaming service Twitch hacked, data leaked

Users of livestreaming platform Twitch may be at risk after a 125GB torrent of data was leaked Continue Reading

By

• Alex Scroxton, Security Editor

Apache web server users urged to patch immediately

New zero-day in Apache HTTP Server is already being actively exploited and must be addressed immediately Continue Reading

By

• Alex Scroxton, Security Editor

Auto-enrolment begins for Google multi-factor authentication

Google has started to turn on multi-factor authentication on consumer accounts by default, and aims to auto-enrol 150 million users by the end of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

New strategies needed to close the cyber security skills gap

Teaching cyber security in schools is a long-term solution to a present-day problem Continue Reading

By

• Martin Smith, SASIG

New Python-based ransomware attacks unfold in record time

Sophos researchers detail a new variety of Python-based ransomware attack targeting VMware ESXi-hosted VMs Continue Reading

By

• Alex Scroxton, Security Editor

Invest in cyber security with confidence using a structured approach

Cyber security has never been more challenging or important in rapidly changing business, regulatory, IT and threat environments. There is a need for a more structured approach to investment Continue Reading

By

• Warwick Ashford, Senior analyst

Two arrests made in European ransomware investigation

Unnamed ransomware operation was disrupted last week in Kiev, Ukraine, following a coordinated investigation Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Embracing vulnerability management for the greater good

When it comes to vulnerability management, CISOs should define a responsible disclosure policy so that they can receive and manage identified vulnerabilities transparently, practically and collaboratively, says Paul Watts of the ISF Continue Reading

By

• Paul Watts, Information Security Forum

Amnesty International exploited in malware campaign

According to new intelligence from Cisco Talos, Amnesty International’s branding and profile is being used as part of a new malware campaign that exploits people’s fears of the notorious Pegasus spyware app Continue Reading

By

• Alex Scroxton, Security Editor

JVCKenwood hit by Conti ransomware attack

Nearly 2TB of data was stolen from Japanese electronics firm in a Conti ransomware hit Continue Reading

By

• Alex Scroxton, Security Editor

UK consumers would collectively pay over £1bn a year for control of their data

UK consumers are willing to pay a small fee per month to have control of the data they share with Google and Facebook Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

FoggyWeb malware latest tool of dangerous Nobelium APT

Microsoft’s threat intelligence team warns of a new strain of malware being used by the Russia-linked Nobelium APT Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: How SolarWinds came through its darkest hour

In his first major UK press interview, SolarWinds CEO Sudhakar Ramakrishna tells Computer Weekly how a relentless focus on transparency saw the company safely through a nightmare cyber breach scenario Continue Reading

By

• Alex Scroxton, Security Editor

How one red team exercise averted a new SolarWinds-style attack

Palo Alto Networks shares details of how its red teamers found and sealed a customer vulnerability that could have led to another SolarWinds-style supply chain attack Continue Reading

By

• Alex Scroxton, Security Editor

Women and BAME people bear brunt of cyber crime impact

Cyber crime has a disproportionate impact on women and BAME people, according to a new report Continue Reading

By

• Alex Scroxton, Security Editor

What it takes to attract and retain women in cyber security

The narrowing gender gap may be a cause for cheer, but more needs to be done to curb discrimination, and attract and retain women for cyber security roles in Asia-Pacific Continue Reading

By

• Ai Lei Tao

How Australia punches above its weight in cyber security

Australia is playing to its strengths in niche areas such as governance and deep tech to punch above its weight in the cyber security industry Continue Reading

By

• Aaron Tan, TechTarget

Fresh alert over Conti ransomware surge

Conti ransomware crew appears increasingly active, prompting fresh warnings from the US authorities Continue Reading

By

• Alex Scroxton, Security Editor

Threat actors target VMware vCenter Server users

Users of VMware vCenter Server are advised to patch a series of vulnerabilities post haste Continue Reading

By

• Alex Scroxton, Security Editor

Please protect us from our own stupidity

It seems like the simplest thing. Compose an email message and then CC colleagues. But,due to a Ministry of Defence blunder,  this simple action, built into pretty much every piece of email client ... Continue Reading

By

• Cliff Saran, Managing Editor

Managing cyber risk through integrated supply chains

High-profile supply chain cyber attacks have caused huge disruption this year. PA Consulting’s Carl Nightingale considers key questions business leaders should be asking of their organisations Continue Reading

By

• Carl Nightingale

US sanctions Suex crypto exchange over ransomware links

US Treasury cracks down on cryptocurrency exchange that supposedly facilitated proceeds from multiple ransomware gangs Continue Reading

By

• Alex Scroxton, Security Editor

Investigation launched after MoD email blunder

Exposure of PII on Afghan interpreters who worked with the UK may put hundreds at risk of Taliban reprisals Continue Reading

By

• Alex Scroxton, Security Editor

Spanish police bust Mafia-linked phishing gang

A joint operation between European authorities has dismantled a cyber criminal gang with links to the Italian Mafia Continue Reading

By

• Alex Scroxton, Security Editor

security policy

A security policy is a document that states in writing how a company plans to protect its physical and information technology (IT) assets. Continue Reading

By

• Ben Lutkevich, Site Editor

Dutch education administrators underestimate threat of cyber crime

Research shows educational establishments in the Netherlands are becoming favoured targets of cyber criminals and administrators are underestimating the risks Continue Reading

By

• Kim Loohuis

Bitdefender launches free REvil ransomware decryptor

Working alongside law enforcement partners, Bitdefender has developed and released a tool to help REvil victims recover their data for free Continue Reading

By

• Alex Scroxton, Security Editor

Travel-themed phishing lures spiked this summer

As people begin to take holidays again after more than a year of restrictions and lockdowns, opportunist cyber criminals have taken note, according to new data from Palo Alto’s Unit 42 Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches 66 vulnerabilities in September update

Another lighter-than-usual Patch Tuesday update includes important fixes for recently disclosed vulnerabilities, including a dangerous zero-day, and an update in the PrintNightmare saga Continue Reading

By

• Alex Scroxton, Security Editor

Mass health tracker data breach has UK impact

The leak of a database of 61 million users of health-tracking devices includes records on individuals located in the UK Continue Reading

By

• Alex Scroxton, Security Editor

Cost of ransomware attack in financial sector exceeds $2m

Mid-sized financial services organisations worldwide spend an average of over $2m recovering from ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Apple patches ForcedEntry vulnerability used by spyware firm NSO

Apple patches ForcedEntry vulnerability that was used to target political activists with spyware Continue Reading

By

• Alex Scroxton, Security Editor

Smishing attacks up sevenfold in six months

Scam text messages are reaching pandemic proportions, thanks in part to the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

UK GDPR faces changes under planned reforms

DCMS is launching a major consultation on proposed changes to the UK’s data protection regime, under which several key elements of the GDPR are likely to change Continue Reading

By

• Alex Scroxton, Security Editor

REvil reappearance may herald new ransom campaigns

The re-emergence of the infamous REvil ransomware gang is a likely sign that more high-profile attacks will unfold over the coming weeks Continue Reading

By

• Alex Scroxton, Security Editor

Covid positive for security market, but still a source of stress

CIISec’s latest “State of the profession report” highlights both positives and challenges for cyber pros arising from the past two years Continue Reading

By

• Alex Scroxton, Security Editor

Stolen credit card data worth about £13 on dark web, PayPal worth more

The average price of a stolen credit card on a dark web marketplace comes in at around $17.40, or £12.60, according to new data – but the real money for cyber criminals is in hacked PayPal accounts Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Optimising privacy, post-GDPR

Airbus CyberSecurity CTO Paddy Francis explores the impact of regulation on data protection, and how it has changed how one goes about optimising data privacy in the enterprise Continue Reading

By

• Paddy Francis

OT security in APAC remains work in progress

Two operational technology security experts shed light on the state of OT security in the region, and what’s being done to address skills, competency and organisational challenges Continue Reading

By

• Aaron Tan, TechTarget

ICO in bid to end cookie pop-ups

Outgoing information commissioner Elizabeth Denham will call on her equivalents across the G7 group of countries to collaborate on an overhaul of cookie consent pop-ups Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: A response to planned data protection changes

The ISF’s Emma Bickerstaffe assesses how organisations might respond to proposed changes to the UK’s data protection regime Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

The rise of the chief risk officer

The impact of the Covid-19 pandemic has seen chief risk officers take their rightful place in the boardroom Continue Reading

By

• Chris Lorigan

UK’s new data protection strategy risks costing business more than it gains

The apparent business benefits of pursuing data adequacy agreements around the world may not be as enticing as they at first appear Continue Reading

By

• Ben Rapp

Berlin court reverses ban on use of EncroChat evidence in criminal trials

Berlin Superior Court allows use of EncroChat evidence in criminal trials but lawyers say the question will ultimately need to be decided by the German Supreme Court Continue Reading

By

• Bill Goodwin, Computer Weekly

Mandiant, Sophos detail dangerous ProxyShell attacks

Threat researchers and incident responders continue to track threat activity around the dangerous ProxyShell Microsoft Exchange vulnerabilities, including impactful ransomware hits Continue Reading

By

• Alex Scroxton, Security Editor

WhatsApp fined €225m over GDPR breaches

Irish data protection watchdog has issued one of the largest GDPR fines to date against Facebook-owned WhatsApp Continue Reading

By

• Alex Scroxton, Security Editor

Twitter tests auto-block feature for accounts at risk of abuse

Latest Twitter feature automatically blocks abusive users, and is intended to help victims regain control of their experience on the platform Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Managing data securely throughout its lifecycle

Managing data in a secure manner is key to ensuring its integrity and therefore its value to the organisation, as well as reducing risk from breaches and misinformation Continue Reading

By

• Andrew Morris, Turnkey Consulting

Experts warn on Office 365 phishing attacks

Newly observed campaign is particularly dangerous because it appears to neutralise one of the most widely known anti-phishing techniques Continue Reading

By

• Alex Scroxton, Security Editor

Remote workers routinely bypassed security tools during pandemic

New data from Palo Alto Networks reveals that over 25% of UK security leaders saw their employees circumventing or switching off security measures at the height of the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Supply chain cyber security is only as strong as the weakest link

A spate of high-profile cyber attacks has highlighted the criticality of supply chain security and put new pressures on security leaders. How can we ensure that cyber security remains robust down the full length of supply chains? Continue Reading

By

• Martin Smith, SASIG

How the cyber security market is evolving

The cyber security market has gained even greater importance in the post-Covid era and continues to grow and evolve. But what factors are driving trends in that market and what should your organisation consider when making cyber security investments? Continue Reading

By

• Warwick Ashford, Senior analyst

Are proposed data protection changes a threat to UK citizens’ privacy?

Though changes are as-yet undefined pending an upcoming consultation, concerns are already being expressed over the government’s plan to liberalise data protection laws in the service of innovation and growth Continue Reading

By

• Alex Scroxton, Security Editor

Tech giants commit to Biden's cyber security action plan

Some of the world’s most prominent tech giants have made a series of commitments to enhance the US’ national cyber security posture following a high-profile meeting with president Biden Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Steps to a solid data privacy practice

Petra Wenham of the BCS shares her expertise on building, or rebuilding, a solid business data privacy practice in a post-Covid-19 world Continue Reading

By

• Petra Wenham

NZ privacy lead John Edwards named new information commissioner

DCMS has named John Edwards, currently New Zealand privacy commissioner, to succeed Elizabeth Denham as UK information commissioner Continue Reading

By

• Alex Scroxton, Security Editor

Calling the cops for ransomware attacks doesn’t help, say cyber pros

A new study for the #Ransomaware campaign reveals some insight into why so few victims report ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

UK loses £1.3bn to fraud and cyber crime so far this year

New figures from the National Fraud Intelligence Bureau show a threefold spike in reported financial losses to fraud and cyber crime in the first six months of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

Half of MS Exchange servers at risk in ProxyShell debacle

Up to 50% of MS Exchange users in the UK are exposed to three vulnerabilities that are now being actively exploited Continue Reading

By

• Alex Scroxton, Security Editor

The ransomware debate – to pay or not to pay?

The debate around banning ransomware payments is highly nuanced, and we must take care to avoid overt victim-blaming, in favour of an open and honest approach, says SASIG’s Martin Smith Continue Reading

By

• Martin Smith, SASIG

How datacentre power growth is leaving Dublin in distress

In this week’s Computer Weekly, we look at the challenges faced by Dublin’s datacentre sector, as growth leaves the city’s electricity infrastructure creaking. We ask whether recent initiatives to close the UK’s digital skills gaps are working. And we examine the latest injustice to hit the Post Office Horizon scandal. Read the issue now. Continue Reading

More data breaches in Australia arising from ransomware

The number of data breaches in Australia arising out of ransomware attacks grew by 24% during the first half of 2021, according to OAIC’s latest data breach report Continue Reading

By

• Aaron Tan, TechTarget

Security Think Tank: Data privacy not in isolation, but on a spectrum

The gap between data privacy and data governance is narrowing, and security leaders need to be aware of the implications, says KuppingerCole’s Anne Bailey Continue Reading

By

• Anne Bailey

Pub apps harvesting swathes of customer data unnecessarily

Some pub and restaurant chain apps demand data such as gender and marital status, raising eyebrows among privacy campaigners Continue Reading

By

• Alex Scroxton, Security Editor

IT leaders fear ‘trickle-down’ of nation-state cyber attacks

Three-quarters of IT decision-makers are concerned that the tactics, techniques and procedures used by nation-state attackers could be used against them Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Data privacy and ethics in a post-Covid world

The radical change caused by the pandemic requires new approaches to data privacy practice, says PA Consulting’s Daniel Gordon Continue Reading

By

• Daniel Gordon

Cyber Runway programme supports new security businesses

The Cyber Runway programme is a government-backed scheme to support entrepreneurs, startups and scaleups in launching and growing new security businesses Continue Reading

By

• Alex Scroxton, Security Editor

Hospitals see cyber security investment as a low priority

Almost half of hospitals have experienced an IT shutdown as a result of a cyber attack in the past six months, but just over one in 10 hospital executives see cyber security investment as a high priority Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

ICO consults on new international data transfer agreement

Information Commissioner’s Office to consult on its draft international data transfer agreement and guidance, which will replace standard contractual clauses to protect personal data during overseas transfers Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

The Netherlands still lacks digital resilience, says report

Report by National Coordinator for Counterterrorism and Security says the Netherlands’ digital resilience has improved, but is still insufficient Continue Reading

By

• Kim Loohuis

Third of finance firms accelerate use of artificial intelligence to detect money laundering

Financial services firms are stepping up their use of artificial intelligence and machine learning technology to fight increasing money laundering activity Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Apple unveils plans to scan US iPhones for child sex abuse images

Apple will introduce child sexual abuse material detection for US users later this year, but some experts are worried that the technology could be repurposed to scan phones for other kinds of content Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Initial access brokers unaffected by ransomware content bans

Banning ransomware content from cyber crime forums has done little to prevent initial access brokers from advertising their services, with the number of access listings increasing in the second quarter of 2021 Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

UK MoD turns to hackers to help secure digital assets

Hackers given direct access to internal Ministry of Defence systems to identify and report security vulnerabilities Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Ransomware attacks increase dramatically during 2021

Dramatic increase in ransomware attacks globally during first half of 2021 driven by triple extortion technique, and is only set to expand further Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Technical hiccups force Babuk ransomware gang to change tactics

The Babuk ransomware operation backed away from encrypting its victims’ files, and technical difficulties may be to blame, reports McAfee Continue Reading

By

• Alex Scroxton, Security Editor

Almost half unaware of GP data-sharing plans

Around half of adults in England – approximately 20 million people – remain unaware of the scope of the NHS GPDPR programme, prompting calls for a public education campaign Continue Reading

By

• Alex Scroxton, Security Editor

COP26 cyber resource hub launched for Glasgow businesses

New digital information hub for Glasgow business to help organisations keep secure both physically and online ahead of major climate change summit Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Consider cyber policies and procedures as you welcome employees back

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Simon Backwell

ICO ends its involvement in dispute between NatWest Bank and data breach whistleblower

The Information Commissioner’s Office has ended its involvement in a dispute between a data breach whistleblower and NatWest bank Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Malicious actors turn to obscure programming languages

Using new, lesser-known or otherwise uncommon programming languages to code new malwares can help skirt cyber defences Continue Reading

By

• Alex Scroxton, Security Editor

No More Ransom initiative saves £850m over five years

Initiative’s free ransomware decryption tools have been used by more than six million people since 2016 Continue Reading

By

• Alex Scroxton, Security Editor

Government-led innovation can help cyber startups find a market

There are many reasons why early-stage cyber startups often struggle to get off the ground, but government-backed programmes can help them find a path Continue Reading

By

• Saj Huq, Plexal

Tokyo 2020 hit by data breach

The user names and passwords of Tokyo 2020 ticket holders and event volunteers were reportedly compromised, but government official claims the data leak was not large Continue Reading

By

• Aaron Tan, TechTarget

Respect in Security challenges abuse and harassment in cyber

With around a third of cyber pros saying they have personally experienced harassment at work or online, a new initiative is urging organisations to pledge their support to help free the community from the scourge of abuse. We met its founders Continue Reading

By

• Alex Scroxton, Security Editor

Five ways to ensure remote working security and compliance

A mix of on-site and remote working has become a fact of life for many organisations. We look at five key things you should consider to ensure compliance and security Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef
• Antony Adshead, Storage Editor

France’s Macron among alleged Pegasus targets

Data relating to devices used by French president Emmanuel Macron and the head of the World Health Organization, among others, has been uncovered in a dataset linked to government use of spyware Continue Reading

By

• Alex Scroxton, Security Editor

NCSC’s Cameron urges deeper cyber alliance-building

Speaking to an event in Israel, NCSC CEO Lindy Cameron has praised joint UK-Israeli efforts on security collaboration Continue Reading

By

• Alex Scroxton, Security Editor

Sparsely staffed offices: the new post-pandemic cyber gap

With many offices still operating at limited capacity, a red teaming expert reveals how his job is getting easier, and why this is a problem Continue Reading

By

• Kyle Gaertner

The Secret IR Insider’s Diary: It’s all gone quie...

The ‘Q’ word isn’t one that’s really used in incident response, says the Secret IR Insider, largely because as soon as you use it, something happens Continue Reading

By

• The Secret IR Insider, Check Point

NHS Digital tightens rules for GPDPR data scrape

The proposed collection of patient data held by GPs will now only commence when three key criteria have been fulfilled, says NHS Digital Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: A return to the office is not a return to normal

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Mark Ward

Ripe for change – mixing digital innovation with traditional winemaking

In this week’s Computer Weekly, we find out how global winemaker Concha y Toro uses the latest tech to enhance 150-year old traditional processes. Pharma giant GSK explains how an API strategy is changing its business model. And we talk to retailers using video technology to bridge the gap between in-store and online selling. Read the issue now. Continue Reading

UK, US confirm Chinese state backed MS Exchange Server attacks

UK and US governments, alongside the EU and Nato, have formally attributed the March 2021 Microsoft Exchange Server attacks to Chinese state-backed actors Continue Reading

By

• Alex Scroxton, Security Editor

Pegasus mobile RAT abused to monitor journalists and activists

Israel-based surveillance specialist NSO Group is facing renewed pressure after it emerged its Pegasus mobile surveillance tool may be being widely abused by repressive regimes Continue Reading

By

• Alex Scroxton, Security Editor

Legacy SonicWall kit exploited in ransom campaign

Users of older versions of SonicWall Secure Mobile Access 100 and Secure Remote Access products are at risk from a new ransomware campaign Continue Reading

By

• Alex Scroxton, Security Editor

The Changing UK Cyberpolicing and Cyberskills scene - an update

The Covid Lockdown unleashed a torrent of employment and skills related fraud, as criminals seize the opportunity to loot the new programmes , as they did to the Individual Learning Accounts after ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Lawyers take EncroChat hacking operation to French supreme court

Lawyers head to French supreme court after appeals court finds EnroChat inception legal under French law Continue Reading

By

• Bill Goodwin, Computer Weekly

Privacy Shield: US surveillance law reforms essential for EU-US data, says EU parliamentary study

EU Committee on Civil Liberties, Justice and Home Affairs study calls for major reforms of US spying laws to enable an EU-US data-sharing agreement to replace Privacy Shield Continue Reading

By

• Bill Goodwin, Computer Weekly

Singapore to invest S$50m in ‘digital trust’ capabilities

The Singapore government is pumping in S$50m to bolster research in technologies that will foster digital trust in areas such as privacy protection and identity management Continue Reading

By

• Aaron Tan, TechTarget