Editor's News

CISO strategies are commonly built for two year plans. Speaking at the AppSec conference in Cambridge, Tobias Gondrom, OWASP Global Board Member and project lead for OWASP, featured highlights from the 2013 OWASP CISO survey report which found that there was more investment in application security than infrastructure. Gondrum said that 38 per cent of the 100 CISOs surveyed invested in infrastructure, compared to 47 per cent who invested in application security. He said that...

More focus should be placed upon the techniques and ecosystem used to compromise businesses by attackers than why they are attacking in the first place. Speaking in the opening keynote at the OWASP conference, Jacob West, CTO of HP Enterprise Security Products, said that in the last decade we have seen security become an accepted key requirement of software, not one that is sprinkled around, but this has left the industry on a downward slope of costs....

Microsoft's Interflow threat and information exchange platform has been described as a good move for collaborative working. According to a blog by Jerry Bryant, lead senior security strategist at Microsoft Security Response Center, Interflow is a “security and threat information exchange platform for analysts and researchers working in cyber security”. He said: “Interflow uses industry specifications to create an automated, machine-readable feed of threat and security information that can be shared across industries and groups...

A training capability to enable organisations to test and validate their cyber security in a safe, realistic and secure environment has been launched by Serco. Named cybX and affiliated to the Emergency Planning College (EPC) on behalf of the Cabinet Office, will offer organisations a hands-on technical and consequence management training programme against a cyber attack. According to the company, it is designed to test both IT staff and management teams on their ability to...

Reuters suffered a “malvertising” incident over the weekend when attackers affiliated to the Syrian Electronic Army accessed the news service via a third party.   In an email to IT Security Guru, security analysts from Bromium revealed that hackers spear-phished their way into the advertising network Taboola initially, which as a trusted service allowed them to deface Reuters' website and access Taboola services.   An updated statement revealed that this was enabled by targeting a...

An enterprise solution must be able to enforce and improve in search filtering and indexing in order to fulfil the needs of employees, as well as gain acceptance from IT and security departments.   Recent surveys of around 300 IT security professionals at the RSA Conference in February and Infosecurity Europe in April, found that despite the employee productivity benefits that internal enterprise search could bring to any organisation, only 38 per cent of respondents...

The phone hacking trial has seen former heads of the News of the World found not guilty, while a former editor has been found guilty on conspiracy to hack phones.   Former managing editor Stuart Kuttner has been found not guilty, while former News International chief executive Rebekah Brooks has been cleared of all charges. Her assistant Cheryl Carter and husband Charlie Brooks were also found not guilty. Mrs Brooks, a former editor of the...

Barclays is to introduce voice recognition for users of its telephone banking service.   In a new effort to move away from the use of passwords, the voice recognition system will verify customers based on their speech patterns and will be offered initially to Barclay’s Wealth customers, and then to its 12 million customers early next year, according to the Telegraph.   The system stores a recording of a customer’s “voiceprint” and future calls will...

The move to mobile ransomware is a “logical” one, but will not be as effective as what is hitting PCs.   Speaking to IT Security Guru, Michael Sutton, vice president of security research at Zscaler, said that as campaigns such as CryptoLocker have been so successful, it was logical that the ransomware threat moves to mobile devices.   This week, Robert Lipovsky, malware researcher at ESET, wrote in a blog about Simplocker which affects Android devices...

A “well orchestrated DDoS” attack put code-hosting domain Code Spaces down this week. In a statement, Code Spaces said that the denial-of-service attack was launched against it on Tuesday of this week, which is normally overcome, but “on this occasion however the DDOS was just the start”. Pointing at an “unauthorised” person, who gained access to its Amazon EC2 control panel and left a number of messages for Code Space to contact them using a...