Articles about Security

Cyber security in (big) numbers

Bricata security graphic header

We hear a lot about cyber attacks and the latest threats, but it can sometimes be hard to comprehend the scale of the problem.

Network security company Bricata has produced an infographic that sets out some of the statistics to put things into context.

Continue reading

Cisco launches cloud-based endpoint protection for MSSPs

Endpoint protection

According to Networking specialist Cisco, almost half of SMBs and enterprises in the US are outsourcing at least some of their security to managed security service providers (MSSPs) in order to counter the latest advanced threats.

The company is targeting this market by launching a set of new endpoint security solutions aimed specifically at MSSPs. These include three powerful cloud-based tools.

Continue reading

White House joins UK government in blaming Russia for NotPetya

White House on Russian flag

The US government has joined the government of the UK in pointing the finger of blame at Russia for the NotPetya cyberattacks. The ransomware/destructoware hit computers around the world last June.

After speculation that the attack was a state-sponsored one carried out by Russia, this position has now been confirmed as the White House accused the nation of the "reckless and indiscriminate." At the same time, the UK's National Cyber Security Centre said that the Russian military was "almost certainly" responsible for the attack.

Continue reading

Growth in Android ransomware slows, but it's getting sneakier

Mobile ransomware

While Android ransomware is still growing, it's doing so at a slower rate than at its peak in 2016. However, it is using sneaky new techniques to trick users.

New findings from researchers at ESET reveal techniques like the misuse of Android's Accessibility services being used to infect devices. The most popular attack technique though remains screen-locking followed by a ransom demand. The most frequently detected variant being the Android/Locker family.

Continue reading

2017 breaks record for new vulnerabilities

Risk dial

More than 20,000 new vulnerabilities were cataloged in 2017 according to breach analysis specialist Risk Based Security.

The figures from the company's own VulnDB eclipsed the total covered by MITRE's Common Vulnerability Enumeration (CVE) and the National Vulnerability Database (NVD) by more than 7,900.

Continue reading

Contractors pose cyber risk to government agencies

Capito building

While US government agencies are continuing to improve their security performance over time, the contractors they employ are failing to meet the same standards according to a new report.

The study by security rankings specialist BitSight sampled over 1,200 federal contractors and finds that the security rating for federal agencies was 15 or more points higher than the mean of any contractor sector.

Continue reading

If you're concerned about privacy, you might want to skip Facebook's VPN -- Onavo Protect

Facebook icon on iPhone 8

Facebook and privacy are not words that really belong in the same sentence, so the idea that the social network is offering a VPN tool might well raise your suspicions. Back in 2013, Facebook acquired Onavo, the company behind the VPN tool Protect.

Recently, users of the Facebook iOS app noticed a link to something labelled Protect within settings. While this appears to be a built-in setting, it is in fact just a link to the Onavo Protect VPN app -- and the idea of a Facebook-owned VPN tool being promoted from within the Facebook app has people concerned. Take a look at the app description, and you may well understand why.

Continue reading

With Intel's updated bug bounty program, you could earn big bucks for finding the next Meltdown

Intel keychain

Intel has updated its bug bounty program, offering up to $250,000 to anyone identifying vulnerabilities in its hardware and software. The key update here is that the program is now open to everyone through the HackerOne platform -- it was previously open to selected security researchers on an invite-only basis.

The move comes in the wake of the Meltdown and Spectre chip vulnerability revelations, and it's clearly an attempt by Intel to not only ramp up its security, but to be seen doing so. The company says it wants to create "a process whereby the security research community can inform us, directly and in a timely fashion, about potential exploits that its members discover."

Continue reading

Cryptomining malware tops January's 'most wanted' list

cryptocurrency mining

Malware seeking to steal processor time for crypto currency mining continues to be a problem, with 23 percent of organizations globally affected by a Coinhive variant in January.

These findings come from a study by Check Point which discovered three different variants of cryptomining malware in its top 10 most prevalent listing, with Coinhive ranking first.

Continue reading

NTT Security and ThreatQuotient partner to deliver threat intelligence

AI security

With a wider threat landscape presented by cloud and digital transformation strategies, accurate and up to date threat intelligence is more important than ever to protect against attacks.

To meet this need, NTT Security, the specialized security company of NTT Group, has partnered with ThreatQuotient to offer an improved threat intelligence capability.

Continue reading

Microsoft gives sysadmins Meltdown and Spectre detection in Windows Analytics

Broken processor

Microsoft has released an update to its free Windows Analytics tool, giving system administrators a new way to check for the Meltdown and Spectre vulnerabilities.

The update not only makes it possible to see whether firmware patches are already installed or if they are needed, but also helps sysadmins to determine whether the patches are causing problems of their own. The checking tool is available for fully updated versions of Windows 7 through Windows 10.

Continue reading

Microsoft to bring Windows Defender Advanced Threat Protection to Windows 7 and 8.1

Square Microsoft store logo

Formerly a Windows 10 exclusive, Microsoft today announced that Windows Defender Advanced Threat Protection (ATP) is coming to Windows 7 and Windows 8.1.

That's not to say that the older operating systems are set to gain the full benefit of ATP, however. Microsoft says that it is the Endpoint Detection & Response (EDR) functionality that will make its way to Windows 7 and 8.1 at some point this summer. This cloud-driven feature will be made available as a preview in the spring.

Continue reading

Security service providers suffer from false positive alert overload

Drowning in paper

A new survey of managed security service providers (MSSPs) reveals that they are suffering an avalanche of false positive security alerts.

The study from Advanced Threat Analytics reveals that 44 percent of respondents report a 50 percent or higher false-positive rate, half of those experience a 50-75 percent false-positive rate and the remainder a startling 75-99 percent rate.

Continue reading

Tests show how much Meltdown fixes will hit Linux system performance

Now that the initial shock about the Spectre and Meltdown chip vulnerabilities has died down, the focus is very much on getting the problems sorted. As has been noted already, there has been concern about the impact on performance that the bug fixes will bring.

Intel has been eager to downplay any suggestion of major slowdown, but the exact performance hit will vary from system to system depending on the tasks being performed. Brendan Gregg -- a Netflix engineer whose work involves large scale cloud computing performance -- has conducted some tests into the impact patches will have on Linux systems, concluding that "patches that workaround Meltdown introduce the largest kernel performance regressions I've ever seen."

Continue reading

Government websites in US, UK and Australia hacked to run secret cryptocurrency miner

Monero logo

Thousands of government websites around the world have been hijacked to mine the cryptocurrency Monero. A commonly-used accessibility script was hacked to inject the Coinhive miner into official sites in the US, UK and Australia. One security researcher described it as the biggest attack of its type that he'd seen.

In the UK, websites for the NHS and Information Commissioner's Office were affected; in the US, the United States Courts' site was hit; in Australia, government sites including that of the Victorian parliament were hit by the cryptojacking code. What all of the sites had in common was the fact that they included the text-to-speech accessibility script Browsealoud from Texthelp.

Continue reading

© 1998-2018 BetaNews, Inc. All Rights Reserved. Privacy Policy.