Editor's News

GCHQ has updated details on its website after it denied that an expired PGP key was offered for secure communication.   Researcher Terence Eden told IT Security Guru that when he contacted GCHQ and asked for a public key with which he could encrypt communications, he was directed to a key on their website which had expired a few days earlier.   In response, GCHQ denied that this was the case. A GCHQ spokesman said:...

The Target breach was made possible by a refrigeration, heating and air conditioning subcontractor who worked at several branches.   After it was revealed that the initial intrusion was made possible by the use of network credentials that were stolen from a third party vendor, security blogger Brian Krebs revealed that the attackers first broke into the retailer’s network on November 15th 2013 using network credentials stolen from Fazio Mechanical Services, a Pennsylvania provider of refrigeration and HVAC systems....

Industries providing essential services such as power, telecommunications and banking are adequately protected to avoid disruption to our everyday lives. Speaking at a summit for the financial, water, energy, communications and transport sectors, Secretary of State for Business, Innovation and Skills Vince Cable said that cyber attacks are a serious and growing threat to British businesses, but it is particularly important that those industries providing essential services such as power, telecommunications and banking are adequately...

The second Waking Shark stress test exercise has been deemed a success, with participants calling for stronger attacks next time. The exercise, which was held on Tuesday 12th November 2013, was s designed to follow up and reinforce the lessons learned from previous cyber exercises and reflect the continued evolution of the nature, intensity and sophistication of cyber threats over the past two years. It was conducted between 14 firms, six financial market infrastructure providers,...

The chief financial officer of Target has said that he is “deeply sorry” for the recent breach and it is determined to win back customers' trust.   Speaking before the US Senate Judiciary Committee hearing which is investigating the data breaches, John Mulligan, Target chief financial officer and executive vice president, said the cyber attack has strengthened its resolve and it will make “Target, and our industry, more secure for customers in the future”.  ...

Malwarebytes is to accept Bitcoin payments for its consumer anti-malware suite.   According to the company, it will accept Bitcoin for its Anti-Malware Pro product and any products that are purchased with Bitcoin will have a Bitcoin logo on the page. Malwarebytes will be using Coinbase as the payment platform.   Marcin Kleczynski, CEO of Malwarebytes, said that it was excited to accept a crypto currency that provides a level of anonymity to users. “Protecting...

The Open Group has launched an accreditation program to assure the integrity of commercial information and communication technology products.   Called the Open Trusted Technology Provider Standard (O-TTPS) Accreditation Program, this is intended to assure integrity in technology development and to prevent maliciously tainted and counterfeit products from entering the supply chain.   Companies seeking O-TTPS Accreditation can choose to be accredited for compliance with the O-TTPS standard for a specific product line, business unit...

A need for fully skilled, experienced professionals is causing headaches when hiring in information security.   Speaking to IT Security Guru, Christian Toon, head of information risk for Europe at Iron Mountain, said that a current recruitment drive has shown that there is a need for full skillsets and “a security all rounder”.   He said: “We do need someone with computer skills and defined ideas, but we need more. It is about being personable...

A security operations centre is to be opened by the UK Government for its public sector network (PSN) to be able to respond to threats.   In an email to IT Security Guru, a Cabinet Office spokesperson confirmed that rather than a continuous diagnostics and mitigation (CDM) system, which the US Department of Homeland Security has installed for US Government departments, this solution is being offered.   “We are not offering a centralised CDM system...

Google has said that it is not prepared to pay a bug bounty for a privacy flaw, despite needing to make a change in Calendar after it was reported.   In an email to IT Security Guru, Google said that it did not have any further comment to make on a recent blog after it initially reviewed the report made by Terence Eden. Eden said that the issue was formally disclosed to Google on 6th...