Vendor fraud techniques used to bypass Office 365 security
Financial fraud email attacks are increasing year-on-year at 73 percent, with 44 percent of these representing sophisticated, targeted attacks such as wire, invoice, or vendor fraud, according to a new report from Armorblox.
The research has uncovered two vendor fraud attacks targeting approximately 4,000 inboxes each. In these the attackers used 'Look-alike Domain' attack techniques to bypass Microsoft Office 365 email security and impersonate trusted vendors with emails that looked like legitimate requests for payments.
Automated threats responsible for 62 percent of eCommerce security incidents
Automated threats, ranging from account takeover, credit card fraud, web scraping, API abuses, Grinch bots, and DDoS attacks, are a persistent challenge for the eCommerce industry, according to a new report.
Cybersecurity company Imperva has conducted a 12-month analysis of threats targeting the retail industry. A continued barrage of attacks on retailers’ websites, applications, and APIs throughout the year and during peak holiday shopping times is a continued business risk for the retail industry.
ID fraud levels still high despite post-pandemic drop
A Freedom of Information request by identity verification company ID-Pal reveals that complaints to the Financial Ombudsman Service in the UK regarding identity fraud soared over the COVID-19 pandemic, finishing 2020 at 44 percent higher than 2019.
Even as the pandemic came to an end numbers in 2021 were still over 18 percent higher than pre-pandemic levels in 2019. Figures so far this year suggest that if identity fraud continues at the same pace, 2022 will see a 10 percent increase in complaints compared to 2021.
HP uses virtual machine technology to secure sensitive data
Privileged data and credentials are prime targets for attackers. Protecting this information is a challenge, particularly as systems have moved to the cloud and networks have become more diverse.
Larger organizations have often turned to things like privileged access workstations, but that means that access can only be made from a limited number of machines. HP Wolf Security has launched a new Sure Access Enterprise (SAE) product to protect users with rights to access sensitive data, systems, and applications but allow them to use a normal endpoint.
How digital IDs are set to shake up the way we access services [Q&A]
Around the world governments are increasingly keen on introducing digital identity systems for their citizens. These are seen as a secure way for people to access government and other services as these move online.
We spoke with Philipp Pointner, chief of digital identity at Jumio, to find out more about digital ID and its implications for security and privacy.
Dropbox confirms serious security breach in which hackers stole code from 130 GitHub repositories
Dropbox has revealed details of a phishing attack to which it fell victim. In the attack, a threat actor was able to steal code from the company after gathering employee credentials to GitHub repositories.
The security breach took place in the middle of last month, with GitHub notifying Dropbox of suspicious account activity on October 14. The cloud storage company says that the code that was accessed "contained some credentials -- primarily, API keys -- used by Dropbox developers" but insists that "no one's content, passwords, or payment information was accessed", and that its core apps and infrastructure were unaffected.
Alternative authentication methods take hold in response to digital dangers
As global problems spill over into the digital realm and hybrid working has taken hold, businesses are increasingly looking beyond the password in order to secure accounts.
The latest Trusted Access Report from Cisco company Duo shows a 50 percent increase in the percentage of accounts allowing WebAuthn passwordless authentication and a fivefold increase in WebAuthn usage since April 2019.
Nudge, nudge, block no more...
Why do people try to circumvent security controls -- for example to access an unapproved SaaS application or cloud service?
New research from Nudge Security suggests it may simply be down to poor user experience of the security process. "We now have evidence to suggest that improving the employee experience of security can actually lead to better security outcomes," says Russell Spitler, CEO and co-founder of Nudge Security.
Top tips to create a culture of security (Hint: it's not more training)
Enterprises investing ample time and money in secure email gateways are still seeing fraudulent messages being delivered to their users’ inboxes undetected. In fact, phishing attacks are the origin of most breaches today.
Many organizations have therefore turned towards user security awareness programs; training staff to recognize and avoid the threats that make it into their inboxes. Why then, despite these efforts, have the number of breaches originating from phishing attacks grown every year since 2017?
What popular culture gets wrong about hacking [Q&A]
It's safe to say that Hollywood and pop culture have not always been kind to the tech and cybersecurity industry.
Throughout the years, movies and TV shows have established a stereotype of how IT and security experts should look, with one of the biggest stereotypes being the representation of a hacker.
New gangs and new tactics mean more victims of ransomware
Ransomware actors have been forming affiliate gangs and using new tactics in order to lure additional victims, according to a new report.
The latest 2022 Bi-Annual Cyber Threat Report from Deep Instinct reveals changes in the world of ransomware gangs, including LockBit, Hive, BlackCat, and Conti.
Brave new (virtual) world? cyber security considerations in the Metaverse
When the likes of Meta and Microsoft spend billions to kick-start what they see as the next big tech gold rush, it’s worth taking notice. We are, of course, talking about the Metaverse, a prospect so compelling that it prompted Facebook’s corporate rebrand alongside an investment in the region of $10 billion per year.
According to their launch content, the money is going towards the creation of a "hybrid of today’s online social experiences, sometimes expanded into three dimensions or projected into the physical world. It will let you share immersive experiences with other people even when you can’t be together."
Will new CISA guidelines help bolster cyber defenses?
Do you know what IT devices are in your business or on your network right now? If not, it’s not just cybercriminals that might be knocking on your door very soon, but the White House.
Binding Operational Directive 23-01, or BOD 23-01, is a new directive from the U.S. Cybersecurity and Infrastructure Security Agency. CISA has issued a Binding Operational Directive (BOD) that orders federal agencies in the country to keep track of their IT assets and any vulnerabilities on their networks.
Top security advice on keeping cyber-scares at bay this Halloween
As suggested by historical data, October has, over the last few years, shown an 'exponential growth' in cyber-attacks, ironically it is also Cyber Security Awareness month, and Halloween. As we approach the end of this year's security awareness month, and head to Halloween, it’s important that close attention is paid to proactive insights and advice offered by industry leaders.
Here is some critical advice in terms of how organizations can maintain a resilient security infrastructure in today’s target-rich environment and potentially avoid a cyber horror.
Defending against critical infrastructure attacks [Q&A]
Critical infrastructure is a prime target for cybercriminals and nation state actors. It often operates on legacy operational technologies (OT) which have vulnerabilities that can't be fixed easily or directly.
We spoke to John Moran, technical director, business development at Tufin, to discuss how organizations can protect themselves. John is a former incident response consultant and is a cybercrime forensics expert.
Recent Headlines
© 1998-2025 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.