Top 10 Stories

Kaspersky Lab’s Global Research and Analysis Team has published a report describing a new advanced cyberespionage actor taking aim precisely at US targets, including, possibly, within both the White House and State Department. The operation presents other alarming though fascinating aspects, such as involving crypto and anti-detection capabilities (the code hunts for several security products to evade: Kaspersky Lab, Sophos, DrWeb, Avira, Crystal, Comodo Dragon), strong malicious program functionality, and structural similarities mating this toolset...

AppRiver has announced its latest version of SecureSurf, a multi-layered adaptive solution to defend against existing and emerging Web-based threats. SecureSurf’s multi-layered cloud solution combines proactive features such as firewalls, intrusion detection, anomaly alerting, log analysis, malware forensics and virus intelligence data. Recently, only large companies could afford to implement and maintain comprehensive solutions, but SecureSurf delivers advanced Web security to businesses of all sizes. “Unfortunately for online users today, it’s no longer a question...

IBM is to offer its security intelligence technology IBM QRadar as a cloud-based service, giving companies the ability quickly prioritise real threats and free up critical resources. The new services are available to clients through a cloud-based SaaS model with optional IBM security managed services to provide deeper expertise and flexibility for security professionals. Also offered is IBM Security Intelligence on Cloud which helps organisations determine if security-related events are simple anomalies or potential threats,...

Waratek, the creator of a runtime application self-protection solution for Java, has been named as the winner of RSA Conference's annual Innovation Sandbox. Recognising the title of Most Innovative Company, the tenth annual contest saw Waratek win over the likes of BugCrowd, Cybereason, Fortscale, NexDefense, SecurityDo, SentinelOne, TrustInSoft, Vectra and Ticto. The latter was named runner-up. The massive problem that Waratek aims to solve, is that applications, specifically Java apps, cannot test, diagnose, or protect...

As many as 1,500 iOS apps are vulnerable to an HTTPS flaw that would allow an attacker to bypass security and steal passwords or other sensitive data. According to SourceDNA, the problem traces back to AFNetworking, an open-source code library many apps use for networking functions. Version 2.5.1, released in January, accidentally introduced a bug which could let someone on the same WiFi network — or otherwise able to monitor a connection — present a fake...

(ISC)² and the Cloud Security Alliance (CSA) have introduced a new cloud security certification. According to the two organisations, the CCSP represents the advanced skills required to secure the cloud, while establishing an international standard for professional-level knowledge in the design, implementation and management of cloud environments. It has been developed to meet a critical market need to ensure that cloud security professionals have the required knowledge, skills and abilities to audit, assess and secure...

The true cost of managing unwanted email could be costing the UK's army of medium-sized businesses more than £34,000 a year each. According to an analysis of time spent on managing spam, phishing and other unwanted emails by  Mailprotector, analysis of businesses with 150 employees over a 30 day period found that each employee receives 25 unwanted emails per day on average, which take around five seconds to open, glance at and delete, equating to...

Users on Windows machines are still the most likely entry point for a cyber attack, and its widespread use makes Windows forensics skills essential for all investigators and first responders. According to Christian Prickaerts, expert forensic investigator and SANS instructor, said that in many cases, the user is completely unaware of the attack which through social engineering or malware starts a chain reaction that can ultimately lead to an incident which in the case of APT...

BT has announced the launch of a security service developed to test how exposed connected vehicles are to cyber attacks. Named BT Assure Ethical Hacking for Vehicles, it is designed to test the exposure of connected vehicles and includes a range of tests targeted at the “attack surfaces” of the vehicle; so the Bluetooth links, USB ports or the DVD drive within the car, as well as links to mobile networks or power plugs. Udo Steininger,...

The use of encryption continues to grow in response to consumer concerns, privacy compliance regulations and on-going cyber attacks . According to research by Thales and Ponemon Institute, there are still major challenges in managing key across what are the mostly fragmented and tactical deployments of encryption technologies. The survey of 4,700 business and IT managers found that 34 per cent of respondents say that their organisation uses encryption extensively, while 36 per cent of...