US and UK issue joint warning about Russian hacking of routers and ISPs
Global fears about cyberattacks by Russia are not calming down, and the US and UK have just issued a joint alert warning of state-sponsored attacks on network infrastructure devices, including residential routers.
The west is accusing Russia of an espionage-driven malicious cyberoffensive, and the Technical Alert -- which comes following a joint effort between the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the UK's National Cyber Security Centre (NCSC) -- warns that both governmental and residential hardware is being targeted to "potentially lay a foundation for future offensive operations".
US and UK blacklist China's ZTE
The US Department of Commerce has implemented a ban on American companies selling components to ZTE. The Chinese telecoms firm is being punished for violating sanctions on Iran and North Korea after pleading guilty last year.
At the same time, the UK's cyber defense watchdog, the National Cyber Security Centre (NCSC), has warned UK telecoms firms that the use of ZTE equipment or services pose a risk to national security. The action taken by the two nations is expected to have severe implications for the company.
A quarter of organizations have had data stolen from the public cloud
Public cloud services are now in use in 97 percent of organizations, but one in four have experienced data theft and cloud-first strategies are on the decline.
These are among the findings of the latest annual cloud report from McAfee. Among other highlights are that 83 percent store sensitive data in the public cloud and 69 percent trust the public cloud to keep their sensitive data secure. However, one in five organizations has experienced an advanced attack against its public cloud infrastructure.
ESET launches new enterprise security solutions
Cyber security company ESET is using this week's RSA Conference in San Francisco to launch its new range of enterprise security products.
These include a new ESET Enterprise Inspector, an Endpoint Detection and Response (EDR) solution, and ESET Dynamic Threat Defense, a tool that provides off-premise cloud sandboxing, which leverages machine learning and behavior-based detection to prevent zero-day attacks.
Thousands of Android apps have built-in crypto keys and passwords
A large number of free Android apps suffer with flaky security because software developers are leaving cryptographic keys embedded and passwords hard-coded.
Speaking at the BSides security conference in San Francisco, software vulnerability analyst Will Dormann revealed how he had found serious security problems in thousands upon thousands of apps. After testing 1.8 million apps, he found almost 20,000 featured built-in passwords and keys, and even when a separate password store was used, user data was still open to attack from simple password crackers.
Large scale data breaches provide drive for DevSecOps investments
Breaches related to open source components have grown 50 percent since 2017, and an eye-opening 121 percent since 2014, according to a new survey from open source governance and DevSecOps automation specialist Sonatype.
But the survey finds that those companies with mature DevOps practices are 24 percent more likely to have deployed automated security practices throughout their development lifecycle.
Star UK business names used to promote cryptocurrency scam
In a classic example of social engineering, well-known names from the BBC's Dragons' Den TV series and others are being used to advertise a cryptocurrency scam.
Websites claiming to offer cryptocurrency investments are using images and false recommendations from prominent individuals including Deborah Meaden and Peter Jones from Dragons' Den, and Martin Lewis, the founder of MoneySavingExpert.com, without their consent.
Is your smartphone lying to you about having the latest Android security updates?
If you thought your Android phone was patched with all of the latest security updates, it might be time to think again. A report by Security Research Labs found that some phone manufacturers were not only failing to deliver security updates, but were hiding this fact from users.
The company found that some devices suffered a "patch gap" whereby manufacturers altered the date reported to Android -- and users -- about when security updates were last installed, without actually installing any patches.
More than 44 percent of businesses fall victim to email account takeovers
Targeted attacks launched via a compromised account were the most successful email attack vector in the past 12 months according to new research.
The study carried out for email security company Agari by Osterman Research reveals that 44 percent of organizations have been victims of a successful ATO-based attack.
Integration of platforms delivers improved vulnerability handling
Security platform Illumio and cloud security and compliance platform Qualys are announcing a new integration that will enable organizations to visualize vulnerabilities across data centers and clouds.
Threat data from the Qualys Cloud Platform is integrated with the Illumio Adaptive Security Platform’s application dependency mapping to show potential attack paths in real time. The integration delivers vulnerability maps, enabling organizations to see connections to vulnerabilities within and between applications.
UK hit Islamic State with 'major offensive cyber-campaign'
The UK surveillance agency, GCHQ, has revealed that it launched cyberattacks on Islamic State. Speaking at the Cyber UK conference, GCHQ director Jeremy Fleming said that it had launched a "major offensive cyber-campaign" against the group.
He said that the attacks helped to stem the output of message from Islamic State (or Daesh) online. While Flemming said that a lot of the operation was "too sensitive to talk about", he was confident that it had been effective in disrupting the group's dissemination of messages.
Enterprises not prepared for fifth generation cyber threats
A new report reveals that 97 percent of organizations are not prepared for the latest multi-vector, fast-moving, mega-scale Gen V cyber threats targeting businesses.
The 2018 Security Report from Check Point analyses the security threats and attacks that organisations globally are experiencing on their networks. It finds just three percent of enterprises are using threat prevention with cloud and mobile security which protects against large-scale, multi-vector Gen V attacks.
New solution automates Kubernetes security
Kubernetes is one of the most popular container platforms, which means enterprises need fast and decisive responses when security incidents and potential attacks occur within their deployments.
Container security specialist NeuVector is launching an enhanced security solution to protect Kubernetes environments by building on the unique NeuVector run-time security automation, which combines east-west traffic visibility with container process monitoring and vulnerability scanning.
Over 2.5 billion records stolen or compromised in 2017
Almost 2.6 billion records were stolen, lost or exposed worldwide in 2017, an 88 percent increase over the previous year.
Although data breach incidents decreased by 11 percent, 2017 was the first year publicly disclosed breaches surpassed more than two billion compromised data records since Gemalto began its Breach Level Index in 2013.
Less than half of enterprises are aware of external sharing and DLP policy violations
Visibility and compliance challenges continue to haunt organizations, with only 44 percent of respondents claiming they have visibility into external sharing and DLP policy violations in their cloud application and environments.
The figure comes from a new report produced by cloud access security broker Bitglass which also finds that 85 percent of organizations acknowledge they are unable to identify anomalous behavior across cloud applications.
Recent Headlines
Most Commented Stories
© 1998-2024 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.