Security policy and user awareness

This Christmas, Covid-19 heightens retail security risks for everyone

Do you think it’s only retailers and consumers who need to consider cyber security when shopping online during the holidays? You’re dead wrong. This year, the Covid-19 pandemic and the shift to remote working has thrown a spanner in the works Continue Reading

By

• Alex Scroxton, Security Editor

APAC plagued by APT, ransomware attacks

The Asia-Pacific region was a primary target of advanced persistent threat groups, mostly from China, Iran, North Korea and Russia, that carried out 34 campaigns between June 2019 to June 2020 Continue Reading

By

• Aaron Tan, Informa TechTarget

From front line to back office – how supporting the cyber community keeps the NHS safe

NHS Digital’s chief information security officer describes how the Cyber Associates Network benefits security experts in health and care Continue Reading

By

• Neil Bennett, NHS Digital

Securing UK’s critical national infrastructure is a 2021 priority

Government outlines the UK’s strategic cyber security policies for the coming 12 months, with critical national infrastructure a clear priority Continue Reading

By

• Alex Scroxton, Security Editor

Belgian security researcher hacks Tesla with Raspberry Pi

Belgian security researcher Lennert Wouters once again succeeds in hacking a Tesla vehicle, this time by exploiting the Bluetooth Low Energy standard Continue Reading

By

• Alex Scroxton, Security Editor

Accidental heroes: How one scaleup pivoted to cyber

Simeon Quarrie designed his business using virtual reality and interactivity as a tool to tell stories that effect cultural change in enterprise environments – then a cyber criminal emptied his bank account Continue Reading

Nominet introduces new resources for cyber scam victims

Domain name registrar is working with law enforcement to provide new information, guidance and resources for potential victims of online scams Continue Reading

By

• Alex Scroxton, Security Editor

NCSC issues retail security alert ahead of Black Friday sales

National Cyber Security Centre issues refreshed guidance as cyber criminals turn their eyes to the holiday shopping season Continue Reading

By

• Alex Scroxton, Security Editor

Manchester United praised for swift response to cyber attack

Manchester United’s systems were attacked last week, and the club has been praised for a swift and decisive response Continue Reading

By

• Alex Scroxton, Security Editor

MPs subjected to over 22 million malicious email attacks in 2020

Members of Parliament are targeted by millions of spam and phishing emails every month, according to a Freedom of Information disclosure Continue Reading

By

• Alex Scroxton, Security Editor

Security pros fear prosecution under outdated UK laws

CyberUp, a group of campaigners who want to reform the Computer Misuse Act, finds 80% of security professionals are concerned that they may be prosecuted just for doing their jobs Continue Reading

By

• Alex Scroxton, Security Editor

CW APAC: Expert advice on zero-trust security

Zero trust is a security model that eliminates the traditional perimeter and assumes that no user or device can be trusted until proven otherwise. In this handbook, Computer Weekly looks at how enterprises can take a zero-trust approach to securing their network, devices and workforce. Continue Reading

Security sector broadly backs Boris Johnson’s Cyber Force

Security community says the presence of a robust cyber defence force alongside a robust physical one will be vital to the UK’s national security Continue Reading

By

• Alex Scroxton, Security Editor

2021 the year of commodity ransomware, says Sophos

Sophos researchers anticipate a trickle-down effect in the cyber criminal underground Continue Reading

By

• Alex Scroxton, Security Editor

US cyber security chief fired for contradicting Trump

CISA chief Chris Krebs ousted for doing his job fighting disinformation in an apparent purge of officials deemed disloyal to president Donald Trump Continue Reading

By

• Alex Scroxton, Security Editor

HMRC warns over uptick in Self Assessment tax scams

HMRC issues updated warnings as 2021 Self Assessment deadlines loom Continue Reading

By

• Alex Scroxton, Security Editor

Ransomware stats overload risks confusing buyers

UK-based organisations are either more, or less, likely to pay ransoms, depending on which cyber security supplier you want to believe Continue Reading

By

• Alex Scroxton, Security Editor

Financial services data volumes heighten risk of insider breach

Financial services organisations hold so much data that it is becoming virtually impossible to safeguard properly against data breaches caused by malicious or careless employees Continue Reading

By

• Alex Scroxton, Security Editor

Brexit and risks to data privacy and governance

EY privacy specialists assess the risks to data privacy, protection and governance on the table for businesses, with less than two months until Brexit Continue Reading

By

• Paul Smith and Krittika Singh

How to build an effective vulnerability management programme

As cyber criminals increasingly look to exploit vulnerabilities in software and hardware, businesses must build and implement an effective vulnerability management programme to counter this growing threat Continue Reading

By

• Nicholas Fearn

How Standard Chartered approaches cyber security

Bank uses security-by-design principles and conducts red-teaming exercises among other measures to fend off cyber breaches Continue Reading

By

• Aaron Tan, Informa TechTarget

Privacy advocates call for European probe into Palantir

Dutch group SOMI is trying to raise awareness of Palantir’s data privacy practices and how it works with European government agencies Continue Reading

By

• Alex Scroxton, Security Editor

Hackney systems could be unavailable for months, says council

A month after a highly disruptive cyber attack on its systems, Hackney Council is still struggling to get back up and running Continue Reading

By

• Alex Scroxton, Security Editor

Online kids’ game Animal Jam confirms large breach

Cyber criminals have stolen data on 46 million Animal Jam player accounts via a third-party attack Continue Reading

By

• Alex Scroxton, Security Editor

Security pros coped admirably with remote working transition

Despite facing tight timescales at the onset of the pandemic, security professionals have come through the transition to remote working remarkably well, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft drops fix for serious zero-day among 112 Patch Tuesday updates

November’s Patch Tuesday contains fixes for 112 bugs, including a potentially serious zero-day exploit that malicious actors are already taking advantage of Continue Reading

By

• Alex Scroxton, Security Editor

EU aid funds used to train ‘unaccountable intelligence agencies’ in high-tech surveillance

Hundreds of documents obtained by campaign group Privacy International show how the EU is supporting surveillance programmes in the Balkans, the Middle East and Africa Continue Reading

By

• Bill Goodwin, Computer Weekly

Leaky AWS S3 bucket once again at centre of data breach

Prestige Software exposed millions of records after failing to pay attention to the security of its cloud instances Continue Reading

By

• Alex Scroxton, Security Editor

Zoom rapped over historic security practices

The US Federal Trade Commission rules that Zoom’s practices undermined the security of its users Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2020: After Covid-19, security goes back to basics

This year’s transition to remote working highlighted big gaps in the fundamentals of security, as updated TechTarget/Computer Weekly data reveals Continue Reading

By

• Alex Scroxton, Security Editor

EU moves closer to encryption ban after Austria, France attacks

Draft resolution document setting up an EU-wide ban on end-to-end encryption is set to be waved through this week Continue Reading

By

• Alex Scroxton, Security Editor

Credential stuffing: When DDoS isn’t DDoS

Ten years ago, credential stuffing attacks posed a comparatively minor threat, but with an escalating number of data breaches, the threat posed has now increased. What are the solutions to this very human problem? Continue Reading

By

• Peter Ray Allison

NHS warned over Ryuk spreading through Trickbot replacements

NHS Digital tells healthcare organisations to be mindful of a marked rise in usage of the Bazar and Buer loaders Continue Reading

By

• Alex Scroxton, Security Editor

Singapore government rolls out digital signature service

Individuals and businesses will soon be able to sign documents digitally using a new service on the Singapore government’s SingPass digital identity platform Continue Reading

By

• Aaron Tan, Informa TechTarget

India and Japan report stronger concern over cyber threats

Security operations teams in the two Asian giants see the increased volume of cyber threats as their biggest challenge amid the Covid-19 pandemic Continue Reading

By

• Aaron Tan, Informa TechTarget

GDPR lawsuit against Oracle and Salesforce moves forward

Class action suit seeks claims worth more than £10bn over the processing of personal information Continue Reading

By

• Alex Scroxton, Security Editor

NHS weathers cyber crime storm during pandemic, says NCSC

The NCSC dealt with over 700 incidents in the 12 months to August 2020, with over 200 specifically related to Covid-19, and the NHS a critical area of focus Continue Reading

By

• Alex Scroxton, Security Editor

Accidental heroes: How one scaleup pivoted to cyber

Simeon Quarrie designed his business using virtual reality and interactivity as a tool to tell stories that effect cultural change in enterprise environments – then a cyber criminal emptied his bank account Continue Reading

By

• Alex Scroxton, Security Editor

CISOs more confident in identity practice after pandemic shock

Identity practice and management has become a critical element of cyber security strategies to support remote workers Continue Reading

By

• Alex Scroxton, Security Editor

ICO slashes Marriott breach fine to £18.4m

Reduced fine reflects both improvements made to hotel group’s cyber security and impact of coronavirus on the travel and hospitality sector Continue Reading

By

• Alex Scroxton, Security Editor

Surge in Ryuk ransomware attacks has hospitals on alert

Russian cyber criminals are conducting a targeted campaign against hospitals with Ryuk ransomware Continue Reading

By

• Alex Scroxton, Security Editor

Privacy and online safety are focus of new UKRI research funding

Online safety research centre of excellence will look into technology to boost privacy and tackle disinformation, fake news, conspiracies and other online harms Continue Reading

By

• Alex Scroxton, Security Editor

Barracuda eyes Indochina markets

Barracuda is looking to expand its local presence and headcount in fast-growing emerging markets of Vietnam, Cambodia and Laos Continue Reading

By

• Aaron Tan, Informa TechTarget

Zero-trust network policies should reflect varied threats

Role-based access systems create enormous pools of responsibility for administrators. Explore how to eliminate these insecure pools of trust with zero-trust network policies. Continue Reading

By

• Katie Donegan, Social Media Manager
• O'Reilly Media

Zero-trust methodology's popularity a double-edged sword

The authors of 'Zero Trust Networks' discuss how the zero-trust methodology's popularity produces both vendor hype and renewed attention to critical areas of security weakness. Continue Reading

By

• Katie Donegan, Social Media Manager

Calls for clarity over Amazon insider breach

Security experts call for more clarity from Amazon over an apparent leak of customer data Continue Reading

By

• Alex Scroxton, Security Editor

Sopra Steria hit by new version of Ryuk ransomware

IT services company Sopra Steria says it has contained the ransomware virus, but systems will take a few weeks to be fully operational Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

APAC CISOs warm up to zero trust

Security leaders in Asia-Pacific are adopting zero-trust security, but challenges stand in their way of reaping the full potential of the security model Continue Reading

By

• Aaron Tan, Informa TechTarget

Cooperation between Norway’s security agencies planned following cyber attack on parliament

Government seeks to develop enhanced national IT infrastructure with an embedded early warning system and defence shield to protect the IT systems of public and private organisations Continue Reading

By

• Gerard O'Dwyer

SonicWall patches 11 firewall vulnerabilities

SonicWall users are advised to download updates that fix 11 CVEs in the SonicOS operating system, uncovered by Positive Technologies Continue Reading

By

• Alex Scroxton, Security Editor

Protecting remote workers an opportunity to do security better

Securing the fully remote workforce has been a challenge for IT teams, but it presents an opportunity to commit to a higher standard of cyber security, according to a Cisco report Continue Reading

By

• Alex Scroxton, Security Editor

NSA’s top CVE list a timely reminder to patch

Many of the CVEs detailed on the NSA’s top 25 chart are golden oldies Continue Reading

By

• Alex Scroxton, Security Editor

Charities warned over ‘Robin Hood’ cyber criminals

Accepting donations from cyber criminal groups could be deemed as profiting from crime, money laundering or handling stolen goods – so don’t do it Continue Reading

By

• Alex Scroxton, Security Editor

Customer loyalty accounts in danger from cyber criminals

Billions of credential stuffing attacks are harvesting valuable customer data for the dark web economy Continue Reading

By

• Alex Scroxton, Security Editor

Why securing the DNS layer is crucial to fight cyber crime

Domain name system security is often overlooked by organisations, but focusing on this layer could actually improve the effectiveness of cyber security strategies. We explore the latest DNS trends and best practice Continue Reading

By

• Nicholas Fearn

Retailers get access to new security toolkit

The British Retail Consortium has worked with the NCSC to develop a new cyber security toolkit pitched at retailers Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Essential tools to mitigate double extortion attacks

The threat of identity theft via a data breach is heightened with the rise of attacks where ransomware threat actors both encrypt and ransom, and exfiltrate and leak their victims’ data. How does this evolution in cyber crime heighten risk for the enterprise, and what steps can we take to safeguard the personal data we hold? Continue Reading

By

• Jim Metcalfe

Resilient Trickbot down but not yet knocked out

Global, Microsoft-led effort to disrupt the Trickbot botnet has seen some success, but new command and control servers continue to pop up Continue Reading

By

• Alex Scroxton, Security Editor

Police given access to self-isolation data

NHS Test and Trace self-isolation data will be made available to police after new guidance changes data-sharing rules Continue Reading

By

• Sebastian Klovig Skelton, Data & ethics editor

BA breach penalty sets new GDPR precedents

The 90% reduction in the fine levied on BA over a 2018 data breach has legal experts talking about the ramifications for the future of data protection Continue Reading

By

• Alex Scroxton, Security Editor

Podcast: Cybersecurity Awareness Month, Covid-19 and storage

We look at how organisations can use Cybersecurity Awareness Month as an opportunity to revisit their handling of data and compliance, especially with changes brought by Covid-19 and home working Continue Reading

By

• Antony Adshead, Storage Editor

Security Think Tank: Safeguarding PII in the current threat landscape

The threat of identity theft via a data breach is heightened with the rise of attacks where ransomware threat actors both encrypt and ransom, and exfiltrate and leak their victims’ data. How does this evolution in cybercrime heighten risk for the enterprise, and what steps can we take to safeguard the personal data we hold? Continue Reading

By

• Sarah Nadwick, Turnkey Consulting

Cloud data protection keeps the Crick’s medical research Covid-secure

Cloud data management services from Rubrik gave the Francis Crick Institute a data protection edge and have helped keep its vital work going through the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Essential tools to mitigate data loss and identity theft

The threat of identity theft via a data breach is heightened with the rise of attacks where ransomware threat actors both encrypt and ransom, and exfiltrate and leak their victims’ data. How does this evolution in cybercrime heighten risk for the enterprise, and what steps can we take to safeguard the personal data we hold? Continue Reading

By

• Jim Metcalfe

Hackney services still offline in ongoing cyber attack

Services remain disrupted two days after council was hit by a serious incident, as residents are warned to be on their guard Continue Reading

By

• Alex Scroxton, Security Editor

Public sector security failings leave UK at risk, says think tank

Reform report urges adoption of new policies in the next version of the UK’s National Cyber Security Strategy Continue Reading

By

• Alex Scroxton, Security Editor

US Elections: Malicious internet domains spike as campaigns heat up

Internet domains related to the US presidential election are 56% more likely to be malicious than regular ones Continue Reading

By

• Alex Scroxton, Security Editor

Fintech ‘unicorn’ Klarna probed over data misuse

Online bank blames misuse of user data on human error as Information Commissioner’s Office weighs in Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft fixes 87 bugs in October 2020 Patch Tuesday

Smaller October Patch Tuesday update includes fixes for critical bugs in Windows 10 and Windows Server 2019 Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Adapting defences to evolving ransomware and cyber crime

The threat of identity theft via a data breach is heightened with the rise of attacks where ransomware threat actors both encrypt and ransom, and exfiltrate and leak their victims’ data. How does this evolution in cyber crime heighten risk for the enterprise, and what steps can we take to safeguard the personal data we hold? Continue Reading

By

• Paddy Francis

Suppliers neglecting virtual appliance security, putting users at risk

Software suppliers are often distributing their products on virtual appliances that contain known vulnerabilities or are running outdated or unsupported operating systems, according to a report Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: What you need to know about addressing the doxing threat

The threat of identity theft via a data breach is heightened with the rise of attacks where ransomware threat actors both encrypt and ransom, and exfiltrate and leak their victims’ data. How does this evolution in cybercrime heighten risk for the enterprise, and what steps can we take to safeguard the personal data we hold? Continue Reading

By

• Larry G Wlosinski, Coalfire-Federal

Five Eyes spy group again demands access to private messages

Spooks are once again calling for the tech industry to break end-to-end encryption in messaging platforms Continue Reading

By

• Alex Scroxton, Security Editor

Cyber security skills ad branded ‘crass’ by minister

Security skills campaign advert depicting a ballet dancer comes in for criticism as the arts sector struggles in the pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Making sense of zero-trust security

Implementing zero-trust security is not an easy feat, but enterprises can still get it right if they approach it from a process perspective and get a handle on their infrastructure footprint Continue Reading

By

• Aaron Tan, Informa TechTarget

Security Think Tank: Tighten data and access controls to stop identity theft

The threat of identity theft via a data breach is heightened with the rise of attacks where ransomware threat actors both encrypt and ransom, and exfiltrate and leak their victims’ data. How does this evolution in cyber crime heighten risk for the enterprise, and what steps can we take to safeguard the personal data we hold? Continue Reading

By

• Petra Wenham

NCSC relaunches SME security guide with home working focus

The NCSC is issuing an updated version of its guide to security for SMEs, reflecting the long-lasting changes to the world of work seen in 2020 Continue Reading

By

• Alex Scroxton, Security Editor

Emotet rated September’s ‘most popular’ malware

The current resurgence of Emotet is attracting attention as governments issue new warnings and cyber criminals rush to exploit the chaotic US election Continue Reading

By

• Alex Scroxton, Security Editor

Crown Prosecution Service suffers 1,600 data breaches in 12 months

CPS sees a spike in data security incidents, many of them serious enough to be reported to the Information Commissioner’s Office Continue Reading

By

• Alex Scroxton, Security Editor

Threat of GDPR fines increasingly driving security buying decisions

Scaring the people who hold the purse strings may be the best option for CISOs who need a little extra budget Continue Reading

By

• Alex Scroxton, Security Editor

Southeast Asia remains hotspot for cyber attacks

Geopolitics and Covid-19 have been fodder for cyber criminals to advance their motives in Southeast Asia in 2020 Continue Reading

By

• Aaron Tan, Informa TechTarget

EU’s top court questions legality of UK phone and internet data surveillance

European Court of Justice rules that the UK and EU member states must comply with EU privacy laws when harvesting people’s sensitive communications data from telecoms and internet companies Continue Reading

By

• Bill Goodwin, Computer Weekly

The privacy and compliance challenges organisations face in 2021

Privacy and compliance teams have a lot on their plate as 2021 approaches. What are the key issues to consider? Continue Reading

By

• John Potts, GRCI Law

Ransomware attacks go through the roof

The volume of ransomware attacks has jumped 50% in the past three months, according to data produced at Check Point Continue Reading

By

• Alex Scroxton, Security Editor

MosaicRegressor APT campaign using rare malware variant

Kaspersky researchers have shared details of a APT campaign utilising a rarely seen and hard-to-stop variety of malware Continue Reading

By

• Alex Scroxton, Security Editor

Fake news tops list of online concerns worldwide

Receiving false information is a greater worry than other online risks such as cyber bullying and fraud, says the Lloyd’s Register Foundation Continue Reading

By

• Alex Scroxton, Security Editor

HMRC warns locked-down freshers of ‘wave’ of tax scams

New university intake may be being targeted by cyber criminals amid Covid-19 confusion Continue Reading

By

• Alex Scroxton, Security Editor

Honesty is the best policy: Forging a security culture in the NHS

Clinician and technologist Sam Shah helped set up NHSX in 2019. Now he’s helping advance digital transformation in healthcare from the outside, and a big part of that is addressing security in the sector Continue Reading

By

• Alex Scroxton, Security Editor

Security pros face sanctions if they help ransomware victims pay

New advisory from the US government warns cyber insurance and incident response specialists that they could be skating on thin ice if they help ransomware victims pay their attackers off Continue Reading

By

• Alex Scroxton, Security Editor

Find and fix your Adobe Flash dependencies, says NCSC

As Adobe’s Flash Player approaches end-of-life, the National Cyber Security Centre is urging organisations to fix their Flash dependencies Continue Reading

By

• Alex Scroxton, Security Editor

Threat actors becoming vastly more sophisticated

Malicious actors have been busily honing their craft and cyber security incidents are up across the board as a result, according to a Microsoft report Continue Reading

By

• Alex Scroxton, Security Editor

NCSC expands schools programme to north-east England and Northern Ireland

Following an initial roll-out in Gloucestershire and Wales, the NCSC’s CyberFirst Schools programme is being extended to north-east England and Northern Ireland Continue Reading

By

• Alex Scroxton, Security Editor

NatWest offers online banking customers free security services

Bank responds to a surge in cyber crime targeting users of online banking services Continue Reading

By

• Alex Scroxton, Security Editor

Ryuk attack downs private health provider in major incident

Private healthcare provider UHS has been been hit by a major big game hunting cyber attack that infected its systems with the Ryuk ransomware Continue Reading

By

• Alex Scroxton, Security Editor

TikTok ban stayed after last-minute court case

TikTok’s lawyers have staved off an imminent ban for the time being, after successfully arguing that it infringed rights guaranteed under the Constitution of the United States Continue Reading

By

• Alex Scroxton, Security Editor

Police Scotland to set up new cyber crime centre

National Centre of Excellence will employ specially trained officers to tackle a vertiginous rise in cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Security now main driving force behind digital transformation

Organisations are urgently remodelling their core technology stack in the light of the Covid-19 pandemic, and this is pushing security to the top of the agenda Continue Reading

By

• Alex Scroxton, Security Editor

Airbnb hosts’ account data exposed in internal leak

Data exposure within Airbnb’s system was the result of a technical issue but was swiftly fixed, says the firm Continue Reading

By

• Alex Scroxton, Security Editor

Digital Identity Policy must address Fake (and Fogged) Credentials   

Banks and employers cannot afford to trust the credentials (digital or otherwise) issued by Government or mandated by regulators (e.g. Passports, Driving Licenses or Utility Bills) until the issues ... Continue Reading

By

• Philip Virgo, Winsafe Ltd

Covid-19 has changed how we think about cyber security forever

Six months into the global pandemic, the true impact on the future of cyber security is beginning to look clearer, says Microsoft’s Ann Johnson Continue Reading

By

• Ann Johnson, Microsoft