Security policy and user awareness

Microsoft patches 66 vulnerabilities in September update

Another lighter-than-usual Patch Tuesday update includes important fixes for recently disclosed vulnerabilities, including a dangerous zero-day, and an update in the PrintNightmare saga Continue Reading

By

• Alex Scroxton, Security Editor

Mass health tracker data breach has UK impact

The leak of a database of 61 million users of health-tracking devices includes records on individuals located in the UK Continue Reading

By

• Alex Scroxton, Security Editor

Cost of ransomware attack in financial sector exceeds $2m

Mid-sized financial services organisations worldwide spend an average of over $2m recovering from ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

Apple patches ForcedEntry vulnerability used by spyware firm NSO

Apple patches ForcedEntry vulnerability that was used to target political activists with spyware Continue Reading

By

• Alex Scroxton, Security Editor

Smishing attacks up sevenfold in six months

Scam text messages are reaching pandemic proportions, thanks in part to the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

UK GDPR faces changes under planned reforms

DCMS is launching a major consultation on proposed changes to the UK’s data protection regime, under which several key elements of the GDPR are likely to change Continue Reading

By

• Alex Scroxton, Security Editor

REvil reappearance may herald new ransom campaigns

The re-emergence of the infamous REvil ransomware gang is a likely sign that more high-profile attacks will unfold over the coming weeks Continue Reading

By

• Alex Scroxton, Security Editor

Covid positive for security market, but still a source of stress

CIISec’s latest “State of the profession report” highlights both positives and challenges for cyber pros arising from the past two years Continue Reading

By

• Alex Scroxton, Security Editor

Stolen credit card data worth about £13 on dark web, PayPal worth more

The average price of a stolen credit card on a dark web marketplace comes in at around $17.40, or £12.60, according to new data – but the real money for cyber criminals is in hacked PayPal accounts Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Optimising privacy, post-GDPR

Airbus CyberSecurity CTO Paddy Francis explores the impact of regulation on data protection, and how it has changed how one goes about optimising data privacy in the enterprise Continue Reading

By

• Paddy Francis

OT security in APAC remains work in progress

Two operational technology security experts shed light on the state of OT security in the region, and what’s being done to address skills, competency and organisational challenges Continue Reading

By

• Aaron Tan, TechTarget

ICO in bid to end cookie pop-ups

Outgoing information commissioner Elizabeth Denham will call on her equivalents across the G7 group of countries to collaborate on an overhaul of cookie consent pop-ups Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: A response to planned data protection changes

The ISF’s Emma Bickerstaffe assesses how organisations might respond to proposed changes to the UK’s data protection regime Continue Reading

By

• Emma Bickerstaffe, Information Security Forum (ISF)

The rise of the chief risk officer

The impact of the Covid-19 pandemic has seen chief risk officers take their rightful place in the boardroom Continue Reading

By

• Chris Lorigan

UK’s new data protection strategy risks costing business more than it gains

The apparent business benefits of pursuing data adequacy agreements around the world may not be as enticing as they at first appear Continue Reading

By

• Ben Rapp

Berlin court reverses ban on use of EncroChat evidence in criminal trials

Berlin Superior Court allows use of EncroChat evidence in criminal trials but lawyers say the question will ultimately need to be decided by the German Supreme Court Continue Reading

By

• Bill Goodwin, Computer Weekly

Mandiant, Sophos detail dangerous ProxyShell attacks

Threat researchers and incident responders continue to track threat activity around the dangerous ProxyShell Microsoft Exchange vulnerabilities, including impactful ransomware hits Continue Reading

By

• Alex Scroxton, Security Editor

WhatsApp fined €225m over GDPR breaches

Irish data protection watchdog has issued one of the largest GDPR fines to date against Facebook-owned WhatsApp Continue Reading

By

• Alex Scroxton, Security Editor

Twitter tests auto-block feature for accounts at risk of abuse

Latest Twitter feature automatically blocks abusive users, and is intended to help victims regain control of their experience on the platform Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Managing data securely throughout its lifecycle

Managing data in a secure manner is key to ensuring its integrity and therefore its value to the organisation, as well as reducing risk from breaches and misinformation Continue Reading

By

• Andrew Morris, Turnkey Consulting

Experts warn on Office 365 phishing attacks

Newly observed campaign is particularly dangerous because it appears to neutralise one of the most widely known anti-phishing techniques Continue Reading

By

• Alex Scroxton, Security Editor

Remote workers routinely bypassed security tools during pandemic

New data from Palo Alto Networks reveals that over 25% of UK security leaders saw their employees circumventing or switching off security measures at the height of the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Supply chain cyber security is only as strong as the weakest link

A spate of high-profile cyber attacks has highlighted the criticality of supply chain security and put new pressures on security leaders. How can we ensure that cyber security remains robust down the full length of supply chains? Continue Reading

By

• Martin Smith, SASIG

How the cyber security market is evolving

The cyber security market has gained even greater importance in the post-Covid era and continues to grow and evolve. But what factors are driving trends in that market and what should your organisation consider when making cyber security investments? Continue Reading

By

• Warwick Ashford, Senior analyst

Are proposed data protection changes a threat to UK citizens’ privacy?

Though changes are as-yet undefined pending an upcoming consultation, concerns are already being expressed over the government’s plan to liberalise data protection laws in the service of innovation and growth Continue Reading

By

• Alex Scroxton, Security Editor

Tech giants commit to Biden's cyber security action plan

Some of the world’s most prominent tech giants have made a series of commitments to enhance the US’ national cyber security posture following a high-profile meeting with president Biden Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Steps to a solid data privacy practice

Petra Wenham of the BCS shares her expertise on building, or rebuilding, a solid business data privacy practice in a post-Covid-19 world Continue Reading

By

• Petra Wenham

NZ privacy lead John Edwards named new information commissioner

DCMS has named John Edwards, currently New Zealand privacy commissioner, to succeed Elizabeth Denham as UK information commissioner Continue Reading

By

• Alex Scroxton, Security Editor

Calling the cops for ransomware attacks doesn’t help, say cyber pros

A new study for the #Ransomaware campaign reveals some insight into why so few victims report ransomware attacks Continue Reading

By

• Alex Scroxton, Security Editor

UK loses £1.3bn to fraud and cyber crime so far this year

New figures from the National Fraud Intelligence Bureau show a threefold spike in reported financial losses to fraud and cyber crime in the first six months of 2021 Continue Reading

By

• Alex Scroxton, Security Editor

Half of MS Exchange servers at risk in ProxyShell debacle

Up to 50% of MS Exchange users in the UK are exposed to three vulnerabilities that are now being actively exploited Continue Reading

By

• Alex Scroxton, Security Editor

The ransomware debate – to pay or not to pay?

The debate around banning ransomware payments is highly nuanced, and we must take care to avoid overt victim-blaming, in favour of an open and honest approach, says SASIG’s Martin Smith Continue Reading

By

• Martin Smith, SASIG

How datacentre power growth is leaving Dublin in distress

In this week’s Computer Weekly, we look at the challenges faced by Dublin’s datacentre sector, as growth leaves the city’s electricity infrastructure creaking. We ask whether recent initiatives to close the UK’s digital skills gaps are working. And we examine the latest injustice to hit the Post Office Horizon scandal. Read the issue now. Continue Reading

More data breaches in Australia arising from ransomware

The number of data breaches in Australia arising out of ransomware attacks grew by 24% during the first half of 2021, according to OAIC’s latest data breach report Continue Reading

By

• Aaron Tan, TechTarget

Security Think Tank: Data privacy not in isolation, but on a spectrum

The gap between data privacy and data governance is narrowing, and security leaders need to be aware of the implications, says KuppingerCole’s Anne Bailey Continue Reading

By

• Anne Bailey

Pub apps harvesting swathes of customer data unnecessarily

Some pub and restaurant chain apps demand data such as gender and marital status, raising eyebrows among privacy campaigners Continue Reading

By

• Alex Scroxton, Security Editor

IT leaders fear ‘trickle-down’ of nation-state cyber attacks

Three-quarters of IT decision-makers are concerned that the tactics, techniques and procedures used by nation-state attackers could be used against them Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Data privacy and ethics in a post-Covid world

The radical change caused by the pandemic requires new approaches to data privacy practice, says PA Consulting’s Daniel Gordon Continue Reading

By

• Daniel Gordon

Cyber Runway programme supports new security businesses

The Cyber Runway programme is a government-backed scheme to support entrepreneurs, startups and scaleups in launching and growing new security businesses Continue Reading

By

• Alex Scroxton, Security Editor

Hospitals see cyber security investment as a low priority

Almost half of hospitals have experienced an IT shutdown as a result of a cyber attack in the past six months, but just over one in 10 hospital executives see cyber security investment as a high priority Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

ICO consults on new international data transfer agreement

Information Commissioner’s Office to consult on its draft international data transfer agreement and guidance, which will replace standard contractual clauses to protect personal data during overseas transfers Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

The Netherlands still lacks digital resilience, says report

Report by National Coordinator for Counterterrorism and Security says the Netherlands’ digital resilience has improved, but is still insufficient Continue Reading

By

• Kim Loohuis

Third of finance firms accelerate use of artificial intelligence to detect money laundering

Financial services firms are stepping up their use of artificial intelligence and machine learning technology to fight increasing money laundering activity Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Apple unveils plans to scan US iPhones for child sex abuse images

Apple will introduce child sexual abuse material detection for US users later this year, but some experts are worried that the technology could be repurposed to scan phones for other kinds of content Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Initial access brokers unaffected by ransomware content bans

Banning ransomware content from cyber crime forums has done little to prevent initial access brokers from advertising their services, with the number of access listings increasing in the second quarter of 2021 Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

UK MoD turns to hackers to help secure digital assets

Hackers given direct access to internal Ministry of Defence systems to identify and report security vulnerabilities Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Ransomware attacks increase dramatically during 2021

Dramatic increase in ransomware attacks globally during first half of 2021 driven by triple extortion technique, and is only set to expand further Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

Technical hiccups force Babuk ransomware gang to change tactics

The Babuk ransomware operation backed away from encrypting its victims’ files, and technical difficulties may be to blame, reports McAfee Continue Reading

By

• Alex Scroxton, Security Editor

Almost half unaware of GP data-sharing plans

Around half of adults in England – approximately 20 million people – remain unaware of the scope of the NHS GPDPR programme, prompting calls for a public education campaign Continue Reading

By

• Alex Scroxton, Security Editor

COP26 cyber resource hub launched for Glasgow businesses

New digital information hub for Glasgow business to help organisations keep secure both physically and online ahead of major climate change summit Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Consider cyber policies and procedures as you welcome employees back

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Simon Backwell

ICO ends its involvement in dispute between NatWest Bank and data breach whistleblower

The Information Commissioner’s Office has ended its involvement in a dispute between a data breach whistleblower and NatWest bank Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Malicious actors turn to obscure programming languages

Using new, lesser-known or otherwise uncommon programming languages to code new malwares can help skirt cyber defences Continue Reading

By

• Alex Scroxton, Security Editor

No More Ransom initiative saves £850m over five years

Initiative’s free ransomware decryption tools have been used by more than six million people since 2016 Continue Reading

By

• Alex Scroxton, Security Editor

Government-led innovation can help cyber startups find a market

There are many reasons why early-stage cyber startups often struggle to get off the ground, but government-backed programmes can help them find a path Continue Reading

By

• Saj Huq, Plexal

Tokyo 2020 hit by data breach

The user names and passwords of Tokyo 2020 ticket holders and event volunteers were reportedly compromised, but government official claims the data leak was not large Continue Reading

By

• Aaron Tan, TechTarget

Respect in Security challenges abuse and harassment in cyber

With around a third of cyber pros saying they have personally experienced harassment at work or online, a new initiative is urging organisations to pledge their support to help free the community from the scourge of abuse. We met its founders Continue Reading

By

• Alex Scroxton, Security Editor

Five ways to ensure remote working security and compliance

A mix of on-site and remote working has become a fact of life for many organisations. We look at five key things you should consider to ensure compliance and security Continue Reading

By

• Valéry Rieß-Marchive, Rédacteur en chef
• Antony Adshead, Storage Editor

France’s Macron among alleged Pegasus targets

Data relating to devices used by French president Emmanuel Macron and the head of the World Health Organization, among others, has been uncovered in a dataset linked to government use of spyware Continue Reading

By

• Alex Scroxton, Security Editor

NCSC’s Cameron urges deeper cyber alliance-building

Speaking to an event in Israel, NCSC CEO Lindy Cameron has praised joint UK-Israeli efforts on security collaboration Continue Reading

By

• Alex Scroxton, Security Editor

Sparsely staffed offices: the new post-pandemic cyber gap

With many offices still operating at limited capacity, a red teaming expert reveals how his job is getting easier, and why this is a problem Continue Reading

By

• Kyle Gaertner

The Secret IR Insider’s Diary: It’s all gone quie...

The ‘Q’ word isn’t one that’s really used in incident response, says the Secret IR Insider, largely because as soon as you use it, something happens Continue Reading

By

• The Secret IR Insider, Check Point

NHS Digital tightens rules for GPDPR data scrape

The proposed collection of patient data held by GPs will now only commence when three key criteria have been fulfilled, says NHS Digital Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: A return to the office is not a return to normal

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Mark Ward

Ripe for change – mixing digital innovation with traditional winemaking

In this week’s Computer Weekly, we find out how global winemaker Concha y Toro uses the latest tech to enhance 150-year old traditional processes. Pharma giant GSK explains how an API strategy is changing its business model. And we talk to retailers using video technology to bridge the gap between in-store and online selling. Read the issue now. Continue Reading

UK, US confirm Chinese state backed MS Exchange Server attacks

UK and US governments, alongside the EU and Nato, have formally attributed the March 2021 Microsoft Exchange Server attacks to Chinese state-backed actors Continue Reading

By

• Alex Scroxton, Security Editor

Pegasus mobile RAT abused to monitor journalists and activists

Israel-based surveillance specialist NSO Group is facing renewed pressure after it emerged its Pegasus mobile surveillance tool may be being widely abused by repressive regimes Continue Reading

By

• Alex Scroxton, Security Editor

Legacy SonicWall kit exploited in ransom campaign

Users of older versions of SonicWall Secure Mobile Access 100 and Secure Remote Access products are at risk from a new ransomware campaign Continue Reading

By

• Alex Scroxton, Security Editor

The Changing UK Cyberpolicing and Cyberskills scene - an update

The Covid Lockdown unleashed a torrent of employment and skills related fraud, as criminals seize the opportunity to loot the new programmes , as they did to the Individual Learning Accounts after ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Lawyers take EncroChat hacking operation to French supreme court

Lawyers head to French supreme court after appeals court finds EnroChat inception legal under French law Continue Reading

By

• Bill Goodwin, Computer Weekly

Privacy Shield: US surveillance law reforms essential for EU-US data, says EU parliamentary study

EU Committee on Civil Liberties, Justice and Home Affairs study calls for major reforms of US spying laws to enable an EU-US data-sharing agreement to replace Privacy Shield Continue Reading

By

• Bill Goodwin, Computer Weekly

Singapore to invest S$50m in ‘digital trust’ capabilities

The Singapore government is pumping in S$50m to bolster research in technologies that will foster digital trust in areas such as privacy protection and identity management Continue Reading

By

• Aaron Tan, TechTarget

REvil ransomware crew drops offline, reasons murky

The REvil ransomware operation appears to have gone dark, but claims about its demise are almost certainly exaggerated Continue Reading

By

• Alex Scroxton, Security Editor

Multiple Microsoft bugs being actively exploited

Microsoft’s July Patch Tuesday update fixes 117 vulnerabilities, 13 rated as critical and four already being actively exploited Continue Reading

By

• Alex Scroxton, Security Editor

Regional cyber clusters score £700k of funding

DCMS has awarded £700,000 of funding to a network of 20 regional cyber clusters Continue Reading

By

• Alex Scroxton, Security Editor

Modipwn vulnerability puts millions of building systems at risk

Authentication bypass vulnerability in a Schneider Electric product could lead to device takeover Continue Reading

By

• Alex Scroxton, Security Editor

UK Cyber Security Council calls for new push on training

Too many companies have cut back on security training and development during the pandemic, says UK Cyber Security Council Continue Reading

By

• Alex Scroxton, Security Editor

Met Police seize £180m worth of Bitcoin

The largest ever seizure of cryptocurrency in the UK comes just weeks after a previous multi-million pound confiscation, as law enforcement clamps down on money laundering Continue Reading

By

• Alex Scroxton, Security Editor

Kaseya VSA services coming online after week-long outage

Kaseya has successfully deployed a patch to its ransomware-hit VSA product as per a revised schedule, and customers are beginning to come back online Continue Reading

By

• Alex Scroxton, Security Editor

Professionals need protection from the Computer Misuse Act

The UK needs cyber legislation fit for the 21st century, so it is important for the industry to get behind the government’s proposed reform of the Computer Misuse Act Continue Reading

By

• Martin Smith, SASIG

Ransomware gangs seek people skills for negotiations

The process of negotiating a ransomware payment is delicate, hence cyber criminal organisations are prepared to offer good terms to those with the right skillsets Continue Reading

By

• Alex Scroxton, Security Editor

Are you betting your future on the worst gambling odds in the world?

Gambling is a high-risk strategy. Doing nothing in the face of the threat from ransomware and hoping for the best provides some of the worst odds you will ever come across Continue Reading

By

• Elliot Rose, PA Consulting

How do we win back digital adolescents recruited to the Dark Side during lockdown?

The Hacker Forum is one of the most welcoming, friendly and attractive "support" group for those stuck in their bedrooms, isolated from friends and school during lockdown and bored with home-learning. Continue Reading

By

• Philip Virgo, Winsafe Ltd

Kaseya apologises for extended downtime after ransom attack

CEO of Kaseya apologises after pushing back the restoration of the firm’s VSA service following a REvil ransomware attack Continue Reading

By

• Alex Scroxton, Security Editor

Why identity is the central problem for the future of the internet

As debate rages over who has the right to control user identities online, is the concept of decentralised identity about to have its day? Continue Reading

By

• Nick Lambert

PrintNightmare haunts Microsoft as patch may miss mark

Microsoft dropped an out-of-band patch to fix PrintNightmare, but there are concerns it may not be totally effective. This does not mean it shouldn’t be applied Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Reopening is an opportunity to reassess wider security posture

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Louise Barber, Turnkey Consulting

ICO to probe Hancock over private email use

Former health secretary faces an investigation by the UK’s data protection watchdog over his use of private email to conduct government business Continue Reading

By

• Alex Scroxton, Security Editor

How the UK Cyber Security Council plans to professionalise security

As chair of the new UK Cyber Security Council, Claudia Natanson is in a superb position to develop professional standards in IT security and she intends to fundamentally reimagine what a security job actually is Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: As offices reopen, address patching and ‘build drift’

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Paddy Francis

About 60 Kaseya customers hit by REvil

Kaseya has revised upward the number of managed service providers compromised by the REvil ransomware gang in a supply chain attack at the weekend Continue Reading

By

• Alex Scroxton, Security Editor

Cyber insurance costs up by a third

The frequency and severity of ransomware attacks is a leading factor behind a substantial increase in the cost of obtaining cyber security insurance Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Returning workers to the office: Is your security posture up to date?

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Rasika Somasiri

Going back to office networks, only to dismantle them once and for all

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Alexei Balaganski

REvil crew wants $70m in Kaseya ransomware heist

Two days after one of the largest ransomware attacks in history by the REvil/Sodinokibi gang, the security community is assessing its next moves, while over 1,000 victims remain in limbo Continue Reading

By

• Alex Scroxton, Security Editor

Berlin court finds EncroChat intercept evidence cannot be used in criminal trials

In a major setback for police hacking operations, Berlin’s regional court has decided that intercepted data from the EncroChat phone network should not be used in criminal prosecutions Continue Reading

By

• Bill Goodwin, Computer Weekly

The secret to building a future-proof cyber security team

In a post-pandemic digital world, where cyber criminals see a feast of opportunities, what are the secrets to building a world-class cyber security function? Continue Reading

By

• Russ Kirby

Security Think Tank: Hydration, hiring, hacking – lessons in post-Covid risk

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

By

• Mike Lloyd, RedSeal

Should I be worried about PrintNightmare?

The accidental publication of proof of concept code for a Windows vulnerability, and the reclassification of said bug from low to critical severity, has the cyber community concerned. Is it right to be? Continue Reading

By

• Alex Scroxton, Security Editor

Cyber attackers up the ante on embattled IT teams

Opportunistic threat actors are pouncing on embattled IT teams that are under pressure to expand remote work arrangements Continue Reading

By

• Aaron Tan, TechTarget