Web application security

CW APAC: Trend Watch – security

It wasn’t that long ago when DevSecOps was little more than a mispronunciation of DevOps. Fast forward to today, the notion of embedding security into the development process is not only accepted, but increasingly championed. In this handbook, Computer Weekly looks at what organisations in the Asia-Pacific region are doing to secure their systems, from adopting a DevSecOps approach, to preparing for cyber attacks and ensuring the privacy of Covid-19 contact-tracing app users. Continue Reading

CW ANZ: Expert advice on security

Supply chain risks are invisible to many organisations, which means they are often not prioritised from an IT security perspective, partly because supply chain risk management is often seen as a procurement issue. In this handbook, Computer Weekly looks at how organisations in Australia and New Zealand can better protect themselves against supply chain attacks and other evolving cyber threats. Continue Reading

Cryptocurrency scammers attack Twitter in insider breach

Apparent insider breach at Twitter saw so-called “blue tick” accounts of business people, politicians and celebrities hijacked to promote a Bitcoin scam Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus shines spotlight on cyber security

Programme committee chair of this year's RSA Conference Asia-Pacific and Japan talks up the challenges that IT security professionals in APAC are facing to mitigate security risks amid the Covid-19 pandemic Continue Reading

By

• Aaron Tan, Informa TechTarget

Patch Tuesday: Microsoft fixes 123 bugs in July 2020 update

The bugs start coming and they don’t stop coming; Microsoft has issued yet another bumper Patch Tuesday update Continue Reading

By

• Alex Scroxton, Security Editor

Recon vulnerability puts thousands of SAP customers at risk

Users of multiple SAP products including S4/HANA should apply the security update as soon as possible to protect their systems Continue Reading

By

• Alex Scroxton, Security Editor

Australian enterprises facing more cyber attacks

The volume of cyber attacks in Australia jumped from 90% in October 2019 and 81% in February 2019, underscoring the worsening threat landscape in the country Continue Reading

By

• Aaron Tan, Informa TechTarget

Zoom zero-day a reminder to stop using Windows 7

Researchers have disclosed a newly discovered zero-day vulnerability to videoconferencing service Zoom, which only affects users of Windows 7 systems Continue Reading

By

• Alex Scroxton, Security Editor

HSBC customers targeted in new smishing scam

SMS phishing scam is targeting HSBC customers in the UK to trick them into handing over their bank account details Continue Reading

By

• Alex Scroxton, Security Editor

More Joker malware apps chucked off Google Play Store

Infamous Joker billing fraud malware continues to sneak past Google’s security controls Continue Reading

By

• Alex Scroxton, Security Editor

Pubs and restaurants failing on cyber fraud protection

Virtually all of the UK’s most popular restaurant and pub brands are failing to proactively block fraudulent emails from reaching their targets Continue Reading

By

• Alex Scroxton, Security Editor

Over 15 billion credentials for sale on dark web

Research by Digital Shadows reveals the scale of the security threat facing consumers as it uncovers 15 billion usernames and passwords stolen in more than 100,000 different data breaches Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: The past and future of security automation

Artificial intelligence and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation being gravely overestimated? Continue Reading

By

• Paddy Francis

Security funding soars despite Covid-19 slump, but problems lie ahead

The overall cyber security funding ecosystem in the UK is healthier than ever despite Covid-19, but the figures mask stark and concerning disparities in where the money is going Continue Reading

By

• Alex Scroxton, Security Editor

Cyber4Summer scheme to divert young people from cyber crime

Cyber4Summer platform will offer 100 different tracks covering a range of security skills to divert them from falling into a life of cyber crime Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Balancing human oversight with AI autonomy

Artificial intelligence and machine learning techniques are said to hold great promise in security, enabling organisations to operate an IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation gravely overestimated? Continue Reading

By

• Richard Absalom, Information Security Forum

Lorca scale-ups bring diverse security to the fore

London Office for Rapid Cybersecurity Advancement announces the cyber security scale-ups that will make up its fifth cohort Continue Reading

By

• Alex Scroxton, Security Editor

North Korea behind spate of Magecart attacks

The Magecart credit card skimmer found on the website of retailer Claire’s Accessories was likely put there by the Lazarus or Hidden Cobra North Korean APT group, reports Sansec Continue Reading

By

• Alex Scroxton, Security Editor

Locked-down teens flock to NCSC CyberFirst training scheme

A record number of 14 to 17-year-olds have signed up to the National Cyber Security Centre’s CyberFirst summer school Continue Reading

By

• Alex Scroxton, Security Editor

UK’s unsung cyber security heroes sought

Nominations have opened for the fifth annual Security Serious Unsung Heroes Awards Continue Reading

By

• Alex Scroxton, Security Editor

Zoom making progress on cyber security and privacy, says CEO

Three months after being hit by a spate of security incidents, Zoom’s CEO, Eric Yuan, has been discussing progress towards a more secure product Continue Reading

By

• Alex Scroxton, Security Editor

Remote workers more aware of security, but still flout the rules

Almost three-quarters of remote workers reckon they have gained in cyber security awareness during lockdown, but don’t seem to be especially bothered about keeping themselves safe Continue Reading

By

• Alex Scroxton, Security Editor

Mysterious EvilQuest macOS ransomware spreads through torrents

A new strain of ransomware, dubbed EvilQuest, is threatening Apple Mac environments, and seems to behave quite oddly Continue Reading

By

• Alex Scroxton, Security Editor

Black Lives Matter, but do bots know that?

The volume of content generated each day necessitates automated moderation to curate everything as it is published, ensuring offensive and objectionable material is blocked. But this only works if systems are adequately configured and reviewed Continue Reading

By

• Peter Ray Allison

Security Think Tank: Get your house in order before deploying AI

AI and machine learning techniques are said to hold great promise in security, enabling organisations to operate a IT predictive security stance and automate reactive measures when needed. Is this perception accurate, or is the importance of automation being gravely overestimated? Continue Reading

By

• Mike Gillespie

FakeSpy Android malware targets Royal Mail app users

The FakeSpy malware was first identified in October 2017 but is now significantly more powerful and dangerous Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: ‘Shift left’ to secure containers

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Paul Holland, Information Security Forum

Pub ‘check-in’ apps provoke fresh privacy concerns

With pubs and restaurants required to collect customer data for contact tracing when they reopen, data privacy risks will be heightened Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Securing containers needn’t be taxing

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Andrew Morris, Turnkey Consulting

How to apply zero-trust models to container security

Containers have become a common fixture in software development, but they have resulted in new concerns for security teams. Is zero-trust the answer to tackling them? Continue Reading

By

• Nicholas Fearn

Neurodiversity on the rise among career hackers

More diverse hackers enhance the ability of both traditional and cutting-edge cyber security solutions to find and fix vulnerabilities, according to a new report from Bugcrowd Continue Reading

By

• Alex Scroxton, Security Editor

Flash-based MacOS malware hides in plain sight

By masquerading as a legitimate Adobe web application, the new malware strains can trick Mac users into bypassing their on-board defences Continue Reading

By

• Alex Scroxton, Security Editor

Australian prime minister confirms country is suffering repeated nation-state cyber attacks

Concern over critical national infrastructure as cyber attackers repeatedly try to gain access to network of organisations operating in multiple sectors Continue Reading

By

• Caroline Donnelly, Senior Editor, UK

CW APAC: Trend Watch – data protection

Asia-Pacific organisations see the importance of having good data protection practices, even as they are still grappling with organisational and operational challenges. In this handbook, Computer Weekly looks at the different levels of preparedness across the region and what firms can do to plug any gaps. Continue Reading

Cisco patches dangerous Webex vulnerability

CVE-2020-3347 bug enables cyber criminals to steal meeting records from within Cisco’s Webex service Continue Reading

By

• Alex Scroxton, Security Editor

Check Point uncovers targeted Microsoft Office 365 phishing campaign

Organised criminal campaign exploited Adobe, Oxford University and Samsung web domains to trick users into giving up their passwords Continue Reading

By

• Alex Scroxton, Security Editor

Zoom U-turns on end-to-end encryption

Embattled video-conferencing provider Zoom backtracks on previous refusals to provide end-to-end encryption to free users Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: 50% of security pros had no pandemic contingency plan

A survey of security professionals conducted on behalf of Bitdefender reveals the lack of forward planning for events such as the Covid-19 coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Activists call on Zoom to implement encryption for all

A coalition of tech organisations and nonprofits have urged Zoom CEO Eric Yuan to make end-to-end encryption available to all users Continue Reading

By

• Alex Scroxton, Security Editor

Accessories store Claire’s hit by Magecart credit card fraudsters

Attackers gained access to retailer’s website as long ago as March Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Enterprise VPN adoption in India set to rise

Advancement in cloud technologies and secured remote access to applications will significantly contribute to the overall growth of India’s VPN market, says GlobalData Continue Reading

By

• Aaron Tan, Informa TechTarget

NHS email service users ensnared in phishing attack

More than 100 accounts on the NHSmail service were affected by attack, but health service says no patient data was accessed Continue Reading

By

• Alex Scroxton, Security Editor

Fake contact-tracing apps delivering banking trojans

Spoof government coronavirus apps are popping up all over the world, says the Anomali Threat Research team Continue Reading

By

• Alex Scroxton, Security Editor

100,000 cheap wireless cameras vulnerable to hacking

Active devices built by Chinese firm HiChip have been sold in the UK as webcams and connected baby monitors Continue Reading

By

• Alex Scroxton, Security Editor

Twitter kills thousands of misinformation accounts

The accounts were linked to the governments of China, Russia and Turkey, and engaged in systematic operations against pro-democracy activists, political opponents and dissidents Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Container security starts with good DevOps practice

Adopting containers promises great organisational efficiency advantages, but the fast-evolving technology can be problematic for security teams. What do CISOs need to know to safeguard containers? Continue Reading

By

• Paddy Francis

Government to fund nine advanced security projects

Nine academic projects have been selected to receive a share of a £10m funding pot as they develop advanced cyber security solutions using prototype chipsets Continue Reading

By

• Alex Scroxton, Security Editor

Decade-old vulnerability among 129 Patch Tuesday fixes

A 10 year-old bug in Windows Group Policies could easily enable attackers to gain highly privileged user status on target systems, opening the doors to a wave of cyber attacks Continue Reading

By

• Alex Scroxton, Security Editor

Unsecured Elasticsearch server breached in eight hours flat

Comparitech’s Bob Diachenko wanted to find out how long it would take for hackers to find and attack an unsecured, public internet-facing database, so he set up a honeypot Continue Reading

By

• Alex Scroxton, Security Editor

Virtual GP practice accidentally exposes patient video calls

A small number of users of Babylon’s GP at Hand service were briefly able to view other patients’ video GP consultations thanks to a bug in a new software feature Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: How to go back to the office safely and securely

Security teams should be used to supporting remote workers effectively by now, but what’s going to happen when people start returning to their offices? We look at the risks and how to address them. Continue Reading

By

• Alex Scroxton, Security Editor

Poorly-secured AWS buckets used to launch Magecart attacks

Cyber criminals are exploiting misconfigured AWS S3 buckets to run credit card fraud and malvertising campaigns, according to new data Continue Reading

By

• Alex Scroxton, Security Editor

What it takes to get DevSecOps right

DevSecOps will drive at least 50% of new applications in Asia-Pacific by 2024, but getting it right will require change management, a collaborative mindset and the right automation tools Continue Reading

By

• Aaron Tan, Informa TechTarget

Police chiefs working with Public Health England on contact-tracing security

Police force representatives are in talks with Public Health England over operational security concerns arising from the NHS Test and Trace coronavirus contact-tracing scheme Continue Reading

By

• Alex Scroxton, Security Editor

Small businesses failing on remote worker protection

Only one-third of people working for small businesses have received any guidance from their employers on how to secure their remote working set-up Continue Reading

By

• Alex Scroxton, Security Editor

Black Lives Matter activists targeted by cyber attacks

Civil liberties organisations are being targeted by far-right trolls as protests over the murder of George Floyd spread worldwide Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: How the BSI protects the IoT from itself

David Mudd of the BSI reveals how a pragmatic and realistic approach to security vulnerabilities underpins its internet of things kitemark, helping give users the confidence to buy smart devices safely Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Cyber criminals target laid-off workers

Malicious actors are targeting workers laid-off or furloughed during the coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Privacy campaigners call for radical changes to contact-tracing app

Liberty, Privacy International and the Open Rights Group join calls for the government to either put in place better data protection policies or abandon its Covid-19 contact-tracing app altogether Continue Reading

By

• Alex Scroxton, Security Editor

Test and Trace has not passed data protection impact assessment

Public Health England failed to complete the required impact assessment before launching the Covid-19 Test and Trace programme Continue Reading

By

• Alex Scroxton, Security Editor

How Sega Europe slashed incident response times using cloud SIEM

Gaming company’s SOC radically improves its operational efficiency with Sumo Logic’s cloud SIEM service Continue Reading

By

• Alex Scroxton, Security Editor

Public Health England to keep contact-tracing data for 20 years

PHE will retain the data it collects via the NHS Test and Trace programme for 20 years Continue Reading

By

• Alex Scroxton, Security Editor

Enterprise clouds hammered by cyber attacks during pandemic

Remote workers logging onto enterprise cloud service accounts are an easy access point for attackers, says McAfee Continue Reading

By

• Alex Scroxton, Security Editor

Fears contact-tracing app will open the floodgates for cyber criminals

Study of UK consumers reveals worries over an uptick in cyber crime and a lack of trust in government Continue Reading

By

• Alex Scroxton, Security Editor

Android security vulnerabilities differ by country, say researchers

Manufacturers of Android devices including Huawei, Samsung and Xiaomi shipped devices with different levels of security in different regions, leaving their users exposed to attack Continue Reading

By

• Alex Scroxton, Security Editor

Hancock to Harman: No contact-tracing privacy law

Health secretary claims existing data protection law is good enough to guarantee the security of contact-tracing data Continue Reading

By

• Alex Scroxton, Security Editor

NCSC discloses multiple vulnerabilities in contact-tracing app

National Cyber Security Centre has received mountains of feedback on the security of the government’s Covid-19 contact-tracing app, and has now taken the step of making multiple disclosures Continue Reading

By

• Alex Scroxton, Security Editor

Serco exposes contact tracers’ data in email error

Error saw almost 300 coronavirus contact tracers’ email addresses made visible to other recipients of the message Continue Reading

By

• Alex Scroxton, Security Editor

Cancelled NCSC CyberUK event gets green light for 2021

The NCSC’s popular CyberUK event has been rescheduled to next year, and will again take place in Newport in south Wales Continue Reading

By

• Alex Scroxton, Security Editor

Doubts mount over effectiveness of UK contact-tracing app

Studies from BCS and Anomali reveal that a significant proportion of the UK population is not prepared to download the Covid-19 contact-tracing app Continue Reading

By

• Joe O’Halloran, Computer Weekly

GitLab makes foray into Southeast Asia

GitLab expands in Southeast Asia with a Singapore presence to shore up its growing footprint across the Asia-Pacific region Continue Reading

By

• Aaron Tan, Informa TechTarget

Harman seeks to bring private member’s bill over contact tracing

Chair of Human Rights Committee aims to put the proposed Contact Tracing (Data Protection) Bill 2020 before parliament as a private member’s bill if necessary Continue Reading

By

• Alex Scroxton, Security Editor

Venafi buys cloud protection service Jetstack

Jetstack specialises in open source machine identity protection software for Kubernetes and cloud native ecosystems Continue Reading

By

• Alex Scroxton, Security Editor

UK’s contact-tracing app targeted by scammers

Even though it is only operational on the Isle of Wight as a beta test, the UK government’s coronavirus contact-tracing app has already attracted the attention of cyber criminals Continue Reading

By

• Alex Scroxton, Security Editor

Report reveals inadequate cyber security at Schiphol Airport

A report has revealed problems with critical security systems in Amsterdam’s Schiphol Airport Continue Reading

By

• Kim Loohuis

Microsoft fixes 16 critical vulnerabilities on Patch Tuesday

The trend towards mammoth Patch Tuesdays continues as Microsoft fixes 111 vulnerabilities Continue Reading

By

• Alex Scroxton, Security Editor

Draft Covid-19 contact tracing legislation proposes formal oversight

Human Rights Committee chair Harriet Harman has outlined a proposed bill to guarantee the security and privacy of data generated by the UK’s Covid-19 contact tracing app Continue Reading

By

• Alex Scroxton, Security Editor

What are the security priorities for the post-coronavirus world?

The Covid-19 pandemic is forcing massive change across the business world and things may never go back to normal. What does security look like in this new world, and what will buyers be prioritising? Continue Reading

By

• Alex Scroxton, Security Editor

Zoom buys secure messaging service Keybase

Unified comms platform Zoom says the acquisition of Keybase will finally let it bring end-to-end encryption to the table Continue Reading

By

• Alex Scroxton, Security Editor

Contact-tracing app fails to protect privacy and human rights

Reassurances over the security and human rights implications of NHSX’s approach to developing its Covid-19 contact-tracing app are insufficient, says the cross-bench Human Rights Committee Continue Reading

By

• Alex Scroxton, Security Editor

Next round of Zoom updates targets consumer security

Casual consumer users of Zoom will get additional protections in an update to be released over the long weekend Continue Reading

By

• Alex Scroxton, Security Editor

Security Think Tank: Security teams are key workers and need support

Cyber criminals are enjoying a boom during the Covid-19 pandemic, and security teams are working overtime as a result. How can security pros manage their increased workload, safeguard their mental wellbeing, and avoid burnout? Continue Reading

By

• Petra Wenham

Contact tracing: The privacy vs protection debate

The Covid-19 pandemic has necessitated extreme measures not seen in peacetime for over 100 years. Contact-tracing apps are being developed as a tool for managing the pandemic, but are they a step too far? Continue Reading

By

• Peter Ray Allison

Homeworking - the new norm - is there any other option...

In the last blog, I touched on the lasting effects of the COVID-19 pandemic; the obvious fallout here is the massive increase in home/remote working, something I’ve been practicing since 1989 – ... Continue Reading

By

• Steve Broadhead, Broadband Testing

SD-WAN; One Way To Partly Consolidate The Complex Puzzle That Is Contemporary IT

I was recently sent an article by my PR mate Hannah from one of their clients, Versa – a company I’ve met up with and they talk a lot of common sense, far more than their er, so-called president… ... Continue Reading

By

• Steve Broadhead, Broadband Testing

Xen Orchestra latest victim of Salt cryptojackers

More victims of cyber criminals exploiting two critical Salt vulnerabilities are coming forward Continue Reading

By

• Alex Scroxton, Security Editor

Blogging platform Ghost hacked through Salt vulnerability

Publishing service’s network was taken over by illicit cryptominers after failing to patch a critical vulnerability Continue Reading

By

• Alex Scroxton, Security Editor

IT Priorities 2020: Compliance and risk are top security concerns

When it comes to security, buyers are prioritising solutions and services that address compliance issues, risk management and data protection, according to the Computer Weekly/TechTarget IT Priorities 2020 study Continue Reading

By

• Alex Scroxton, Security Editor

Why you should think before you Zoom

Feel free to use Zoom during the coronavirus lockdown, but think before you discuss anything confidential Continue Reading

By

• Dai Davis, Percy Crow Davis & Co

Critical SaltStack vulnerability affects thousands of datacentres

Critical vulnerabilities in the Salt remote task and configuration framework enable hackers to take control of cloud servers and must be patched right away Continue Reading

By

• Alex Scroxton, Security Editor

Mobile banking customers at risk from new EventBot trojan

Customers of Barclays, HSBC, Santander and many other banks should be alert to a dangerous new trojan Continue Reading

By

• Alex Scroxton, Security Editor

Under the spotlight, video apps rush to strengthen security

Most popular videoconferencing applications now meet Mozilla’s minimum security standards, with fierce competition and public pressure driving rapid improvement Continue Reading

By

• Alex Scroxton, Security Editor

Almost half of security pros being redeployed during pandemic

Close to half of cyber security professionals say they have been taken off some or all of their security duties to focus attention elsewhere during the Covid-19 coronavirus pandemic Continue Reading

By

• Alex Scroxton, Security Editor

Black Rose Lucy ransomware now posing as FBI porn warning

A new strain of Russian-developed ransomware impersonates US federal law enforcement to force payment, says Check Point Continue Reading

By

• Alex Scroxton, Security Editor

Microsoft patches .gif file vulnerability in Teams

Vulnerability could have enabled cyber criminals to use a malicious .gif file to scrape user data and take over Teams accounts Continue Reading

By

• Alex Scroxton, Security Editor

The Security Interviews: Can AV go from dodgy scareware to cyber hero?

Alun Baker, CEO of Clario, is on a mission to rehabilitate the image of consumer security products and take the fear out of selling antivirus. We find out how things are changing Continue Reading

By

• Alex Scroxton, Security Editor

iOS zero-day leaves iPhone users dangerously exposed

Researchers identify dangerous vulnerabilities in Apple’s iOS operating system that allow remote code execution on target devices Continue Reading

By

• Alex Scroxton, Security Editor

Zoom to roll out fresh cyber security updates

New features include support for advanced AES 256-bit encryption Continue Reading

By

• Alex Scroxton, Security Editor

Coronavirus: Cyber criminals may be changing tactics

Cyber criminals “may soon shift to heavier exploitation of footholds established through phishing and other scams”, warns Cyber Threat Coalition Continue Reading

By

• Alex Scroxton, Security Editor

NCSC launches coronavirus cyber security campaign

The National Cyber Security Centre has launched a reporting service for scam emails as part of a campaign to help people protect themselves from cyber criminals exploiting the pandemic Continue Reading

By

• Alex Scroxton, Security Editor