Stuart O'Brien, Author at Cyber Secure Forum | Forum Events Ltd - Page 3 of 5
Posts By :

Stuart O'Brien

Reaper ‘botnet’ could bring down internet, experts warn

 960 640 Stuart O'Brien
By:
0
0

Cyber experts have warned that a massive botnet named ‘Reaper’ that has been growing over the past few weeks could have the ability to bring down the internet.

Experts at security specialist Check Point have spotted a collection of devices which have been deliberately hacked – sending surges of data to servers – causing them to crash and go offline.

A similar attack last year, the Mirai botnet, caused disruption across the US, wiping out the internet across the East Coast.

A blog published on Check Point Research warned of a “cyber-storm that could take down the internet’.

It went on to say: “So far we estimate over a million organisations have already been affected worldwide, including the US, Australia and everywhere in between, and the number is only increasing.

“Our research suggests we are now experiencing the calm before an even more powerful storm.

“The next cyber hurricane is about to come.”

Experts claim that Reaper could have already infected one million companies.

NCSC first year anniversary of protecting the UK

 960 640 Stuart O'Brien
By:
0
0

A report published to mark the first year anniversary of the National Cyber Security Centre (NCSC) protecting the UK from cyber threats has revealed that within 12 months the organisation received 1,131 incidents, with 590 classed as ‘significant’.

Part of GCHQ, the NCSC focuses on cyber security for the UK. The incidents listed within the report outlined the work undertaken by the organisation to help improve security of online transactions throughout the country, along with providing support for the UK Armed Forces.

“Our response has been to transform to stay ahead of them,” said Jeremy Flemming, director of GCHQ.

“The NCSC is a pivotal part of that transformation. It is a critical component not only of GCHQ, where it benefits from the data and expertise it has access to as part of the intelligence community, but of how the government as a whole works to keep the UK safe,” Flemming added.

In its first year, the NCSC has been credited for a 43% increase in the Cyber Security Information Sharing Partnership (CISP), leading the UK response to the WannaCry virus, hosting the three-day Cyber UK Conference in Liverpool and enrolling over 1,000 youngsters on the CyberFirst courses.

Morrisons staff sue over data breach

 960 640 Stuart O'Brien
By:
0
0

Grocery giant Morrisons is being sured by thousands of current and former employees in a class action over damages brought about from a data leak.

The case at London’s High Court follows a breach of security in 2014, when a former senior internal auditor, Andrew Skelton, working at the retailer’s Bradford HQ, posted the payroll information of nearly 100,000 employees on the internet.

The information included bank, salary and national insurance details, phone numbers and addresses.

Skelton was found to bore a grudge against  Morrisons and was jailed for eight years in 2015 fro fraud, securing unauthorised access to computer material and disclosing personal data.

The new case is being viewed as the first data leek class action in the UK, with legal experts agreeing that the case has potential implications for every individual and business in the country.

The trial is concerned with the use of liability, involving claims brought by 5,518 current and former Morris’s staff, who allege the company failed to prevent the leek.

The claimants also allege that the data leek exposed them to identity theft and potential financial loss, with Morrisons responsible for breaches of privacy confidence and data protection laws.

The lawsuit is being brought bylaw firm JMW Solicitors.

Discussing the case, Nick McAleenan, partner at JMW Solicitors said: “The court will decide whether Morrisons bears any legal responsibility for the misuse and disclosure of the payroll information of the many thousands of people bringing claims in this case.”

Morrisons denies liability.

GCHQ: Keeping the UK safe from cyber-attacks “as important as fighting terrorism”

 960 640 Stuart O'Brien
By:
0
0

The head of intelligence monitoring service GCHQ has said that keeping the UK safe from cyber-attacks is now as important as fighting terrorism – with increased funding from GCHQ being spent on making it a “cyber-organisation” as much as a counter-terrorism and intelligence organisation.

Jeremy Flemming became the GCHQ director in March 2017, from a career in MI5 that saw him rise to the rank of deputy director. Writing in the Daily Telegraph, Flemming said there had been nearly 600 “significant” cyber-attacks this year alone, and that the UK’s adversaries were “quick to spot new ways of doing us harm”.

“If GCHQ is to continue to help keep the country safe as we prepare for our second century, then protecting the digital homeland – keeping our citizens safe and free online – must become and remain as much part of our mission as our global intelligence reach and our round-the-clock efforts against terrorism,” commented Flemming.

“We all derive great benefit from the ease and speed of connecting across the planet: access to knowledge, reduced costs of communication and commerce, and from the additional security provided by default encryption.

“It’s also true to say that hostile states, terrorists and criminals use the same features to undermine our national security, attack our interests and, increasingly, to commit crime.”

Fleming concluded: “All of this can feel deeply challenging for a GCHQ that by necessity has worked in the shadows. It remains the case that much of what we do must remain secret. But the success of the NCSC demonstrates that we are more effective, a better employer and more trusted if we are more transparent, more visible and take advantage of the internet to drive change.”

Deloitte hit by cyber hack

 960 640 Stuart O'Brien
By:
0
0

Global accountancy firm Deloitte has been hit by a targeted hack, resulting in confidential emails and client plans being compromised.

The attack is thought to have gone unnoticed for several months before the firm being alerted in March this year.

The Guardian reported that the accountancy giant was the victim of a sophisticated hack that revealed confidential information regarding clients, including multinational companies, media enterprises and government agencies.

Six of Deloitte’s clients have been informed that they have been “impacted” by the hack. An internal investigation is ongoing.

Discussing the hack, a spokesperson for Deloitte said: “In response to a cyber incident, Deloitte implemented its comprehensive security protocol and began an intensive and thorough review including mobilising a team of cybersecurity and confidentiality experts inside and outside of Deloitte.

“As part of the review, Deloitte has been in contact with the very few clients impacted and notified governmental authorities and regulators.

“The review has enabled us to understand what information was at risk and what the hacker actually did, and demonstrated that no disruption has occurred to client businesses, to Deloitte’s ability to continue to serve clients, or to consumers.

“We remain deeply committed to ensuring that our cybersecurity defences are best in class, to investing heavily in protecting confidential information and to continually reviewing and enhancing cybersecurity. We will continue to evaluate this matter and take additional steps as required.

“Our review enabled us to determine what the hacker did and what information was at risk as a result. That amount is a very small fraction of the amount that has been suggested.”

 

 

 

VASCO and Nuvias expand distributor agreement

 960 640 Stuart O'Brien
By:
0
0

VASCO Data Security International and Nuvias have expanded their existing distributor agreement across EMEA in line with the demand for digital security solutions across the region.

Nuvias will play a key role in driving further growth and meeting demand across EMEA for VASCO’s security solutions, including two-factor authentication, transaction data signing, e-signatures, identity management and secure access to the cloud for online and mobile applications.

Previous to Nuvias’ acquisition of Wick Hill, VASCO had an ongoing 10 year distributor relationship in the UK and Germany with Wick Hill. Both Nuvias and VASCO are now looking to replicate this successful partnership across EMEA, with an initial focus on France, Poland and Benelux.

“Increasing reports of stolen passwords, along with the arrival of GDPR and a growing need for cloud and wi-fi authentication, are all major factors in driving the market for solutions that combat online and mobile fraud,” said Nuvias Group’s EVP Cyber Security, Ian Kilpatrick. “VASCO’s range of digital trust solutions are already delivering growth for us and our partners in many regions and we are really excited by this expansion of our longstanding relationship.”

“Partnerships with organisations like Nuvias enable VASCO to maximise its channel business opportunities,” said VASCO’s Channel Sales Manager EMEA, David De Pauw. “Nuvias’ knowledge of VASCO’s products and its presence in more than 20 countries across EMEA will help further VASCO’s success and offer value to a broader-reaching end user base.”

Kilpatrick concluded: “We are looking forward to expanding our relationship with VASCO, a company that is investing heavily in R&D to develop exciting new products and building strong go-to-market propositions.”

UK Public and education sector face major DNS threats

 960 640 Stuart O'Brien
By:
0
0

New research has revealed DNS-based attacks cost global organisations an average of over £1.7 million in 2016 alone, with UK councils, Government offices and schools affected badly.

One in five (19%) of public sector sites and 11% of education bodies affected by DNS attacks say sensitive information was stolen, compared to 16% in the UK overall. A fifth (20%) of public sector and 12% of educational victims also think intellectual property data was lost compared to 15% for UK organisations overall, while 10% of schools and colleges affected say they needed to take more than one day to recover.

This is in the context of annual average costs of DNS security breaches to be now running at £1.7m ($2.2m) for organisations globally, with malware (35%), DDoS (32%), Cache Poisoning (23%), DNS Tunnelling (22%) and Zero-Day Exploits (19%) as the main threats.

The findings come from the 2017 Global DNS Threat Survey report, created by EfficientIP.

David Williamson, CEO of EfficientIP, pointed out that the imminent (May 2018) arrival of the General Data Protection Regulation (GDPR) should sound loud alarm bells for CIOs and CISOs working in the sectors. “In less than a year, GDPR will come into effect, so organisations really need to start rethinking their security in order to manage today’s threats and save their businesses,” he added.

Over a third (35%) of public sector organisations and a quarter (25%) of education organisations have been subjected to DNS-based Malware, DDoS (31% and 22%), Cache Poisoning (26% and 24%), DNS Tunnelling (20% and 19%) and Zero-Day attacks (19% and 13%) in the past year.

49% of education sector DNS victims also stated the size of the DDoS attack they faced was between 1Gbits/sec and 5Gbits/sec and almost a third (30%) between 5Gbits/sec and 10Gbits/sec.

Although 59% of public sector organisations and 57% of education organisations have a hosted/cloud DNS Appliance base, 36% and 35% respectively suffered cloud service downtime in the last 12 months.

“The results once again highlight that despite the evolving threat landscape and the increase in cyber-attacks, organisations across the globe and their IT departments still don’t fully appreciate the consequences of DNS-based attacks,” added Williamson.

To read the full report, click here

HMRC site suffering from ‘serious’ security flaws

 960 640 Stuart O'Brien
By:
0
0

A researcher who spent 57 days trying to report a bug on HMRC’s online tax service site has said that the UK tax office must improve the way it handles website security problems – adding that finding the correct contact to report the issue to was even more challenging than actually finding the bug in the site.

Speaking with the BBC, the researcher and security expert simply known as ‘Zemnex’ found two separate bugs within the site, which could have easily have attackers view or modify tax records or collect key details from UK taxpayers.

“I spent days reaching out to half a dozen different Government social media accounts attempting to find where the right place to go was and got nothing meaningful in response,” he told the BBC.

He added that eventually the UK’s National Cyber Security Centre (NCSC) was able to help get the security problems solved.

Zemnex realised that the HRMC site was at risk as he checking his taxes. He quickly realised that it was possible to use the HRMC site as a ‘’forwarding service’, which could be utilised to coax a victim into revealing financial information, credentials and usernames and passwords. He then discovered a second bug that could potentially give an attacker control over a victim’s information.

Although the bugs were fairly easy to find, Zemnex then realised that trying to contact the right person to report the security issues wouldn’t be quite as easy.

“I understand the significant difficulties involved in these programmes,” he told the BBC. “If a programme were opened to the public to disclose issues without very significant and robust preparation, it would quickly become totally overwhelmed by the volume of reports, both valid and invalid.”

In a statement, HRMC said it was working with the NCSC regarding its security procedures.

Nuvias appointed pan-EMEA distributor for Juniper Networks

 960 640 Stuart O'Brien
By:
0
0

Nuvias is now a pan-EMEA distributor for Juniper Networks’ full range of networking, security, data centre and cloud solutions. The firm will support Juniper’s continued growth plans for EMEA, particularly in the mid-to-high end enterprise market.

Alongside Juniper, Nuvias has designed a full channel partner development and acceleration programme that complements Juniper’s existing channel strategy. It will offer technical, sales and marketing training to help maximise the business opportunities in high growth markets such as cloud, Internet of Things (IoT) and Software Defined Networking (SDN) – areas where Juniper also invests.

“Nuvias is excited by this new partnership with Juniper, a pioneer in networking innovation, performance and security. The strength of our commitment will be demonstrated through a dedication to partner enablement, services and solutions that can generate new opportunities and business,” said Paul Eccleston, CEO of Nuvias.

“We are equipping partners with the necessary skills to pursue opportunities independently, generate additional revenues, and deliver innovative services to their customers. Juniper invests in partners that bring in new business and this agreement presents a fantastic opportunity for the channel.”

High-performance network automation, SDN and intelligent, software-defined security will play a key role in organisations’ Digital Transformation strategies.

“We are delighted to be working with Nuvias, whose strengths in value-added networking and security distribution perfectly complement our strategic focus and solutions portfolio,” said Kristian Kerr, head of channel, alliances & commercial, EMEA, Juniper Networks.

“Nuvias’ approach reflects the dynamic IT landscape, while being able to consistently deliver the highest levels of capability, accreditation, sales, marketing, services and operational excellence to Juniper’s partners across EMEA.”

Retailer CeX suffers data hack

 960 640 Stuart O'Brien
By:
0
0

Tech trade-in retailer CeX has suffered a data breach, which could affect top to two million of its registered website customers.

In an email to its customers, managing director David Mullins said it was investigating the breach “as a priority” and that they would be “taking a number of measures to prevent this from happening again.”

It is believed that the breach was a result of an unauthorised third party accessing CeX’s computer systems, with customer information including names, addresses, email details and phone numbers compromised.

The email by Mullins also stated that for “a small number of customers” the breach may also extend to encrypted data from expired credit cards up to 2009, although it was unlikely any payment information was taken as CeX ceased storing customer cards in 2009.

CeX is currently contacting two million of its registered website customers.

“We are taking this extremely seriously and want to provide you with details of the situation and how it might affect you,” Mullins said in the email.

“This was a sophisticated breach of security and we are working closely with the relevant authorities to help establish who was responsible. Our cyber security specialists have already put in place additional advanced measures to fix the problem and prevent this from happening again.”

CeX is asking all customers to change passwords for its Webuy online account.

“Although your password has not been stored in plain text, if it is not particularly complex then it is possible that in time, a third party could still determine your original password and could attempt to use it across other, unrelated services,” the email said. “As such, as a precautionary measure, we advise customers to change their password across other services where they may have re-used their WeBuy website password.

“We take the protection of customer data extremely seriously and have always had a robust security programme in place which we continually reviewed and updated to meet the latest online threats. Clearly however, additional measures were required to prevent such a sophisticated breach occurring and we have therefore employed a cyber security specialist to review our processes. Together we have implemented additional advanced measures of security to prevent this from happening again.”