SQL injection is arguably the most severe problem web applications face. OWASP, an online community devoted to web application security, consistently classifies injection vulnerabilities as number one on their OWASP Top 10 Project. SQL injection vulnerabilities are a favorite amongst a number of “hactivist” groups whose aim is to cause disruption in...

A new report reveals that civilian nuclear facilities are not paying adequate attention to developing "cyber security readiness". According to the executive summary of "Cyber Security at Civil Nuclear Facilities: Understanding the Risks", the Royal Institute of International Affairs at well known think tank Chatham House conducted in-depth...

Businesses have some serious problems on their hands when it comes to security. Major breaches seem to be occurring at an alarming pace – every other week seems to bring headlines of another large company suffering a security breach, and that doesn’t even begin to touch the thousands of breaches that don’t get media attention. With cyber attacks...

According to the 2015 Information Security Breaches Survey, 44 percent of both large and small organizations increased their security expenditure in 2015 compared with 53 percent and 27 percent in 2014, respectively. Despite the increase in expenditure, however, 90 percent of large organizations and 74 percent of small organizations reported that...

Our security roundup series covers the week’s trending topics in the world of InfoSec. In this quick-read compilation, we’ll let you know of the latest news and controversies that the industry has been talking about recently. Here’s what you don’t want to miss from the week of September 28, 2015: A massive data breach at Experian – one of largest...

Hackers have compromised the personal information of 15 million T-Mobile customers after successfully infiltrating one of Experian's servers. John Legere, CEO of T-Mobile, has published a letter about the incident: "We have been notified by Experian, a vendor that processes our credit applications, that they have experienced a data breach. The...

I recall engaging into a conversation with a fellow security professional this year on the subject of where the CISO role should reside and to whom they should report.My opponent’s opinion was very much contrary to my own, vocalising the value of the CISO having full alignment with the main board and the company executive.I, on the other hand, feel...

What a whirlwind the past few months have been for data security, breaches and hacking events. From the Wyndham v. FTC ruling to yet another breach by a BCBS affiliate, there is increasing pressure across the information security industry to push organizations to perform those pesky security risk assessments touted by the National Institute of...

A Russian antivirus (AV) firm was firebombed back in 2014 as a result of a report it published on a particular malware sample. On December 18, 2013, the AV company Doctor Web published a news item announcing that Trojan.Skimmer.18 had been added to the company's virus database. Later that same day, the company received a threatening email presumably...

The post office email scam is a time-tested method of attack among malicious actors. Indeed, when users see that they have received an email from an actor purporting to be their local post office, most of them buy into the familiarity of this governmental institution and click on a link without taking the time to inspect the sender address....

Two security researchers uncovered thousands of medical systems exposed online that are vulnerable to web attacks. On Saturday, September 26, researchers Scott Erven and Mark Collao presented their findings at Derby Con 5.0 in a presentation entitled "Medical Devices: Pwnage and Honeypots." "We know medical devices are exposed to the Internet both...

Today, a segment will air on Crime Watch Daily where Tripwire Senior Security Researcher Craig Young and I reveal on camera how vulnerable smart homes can be when not properly secured. We show firsthand that the key weaknesses in most smart homes are a combination of insecure networks and default configurations, including systems that installers may...

Banks have another security headache on their hands, as ATM-infecting malware is becoming increasingly sophisticated in its attempt to help criminals audaciously empty out cash machines on the high street on demand, without having to have previously stolen the payment cards of legitimate customers. Dubbed GreenDispenser by researchers at Proofpoint,...

Tripwire recently hosted a webcast entitled, “Talking To The Board: How To Improve Your Board's Cyber Security Literacy -- UK Edition.” For the presentation, Amar Singh, Interim CISO and Founder of both Cyber Management Alliance and Give01Day, an organization that connects volunteer information security professionals together with charities seeking...

Our security roundup series covers the week’s trending topics in the world of InfoSec. In this quick-read compilation, we’ll let you know of the latest news and controversies that the industry has been talking about recently. Here’s what you don’t want to miss from the week of September 21, 2015: According to independent security journalist Brian...

A new study reveals that dozens of apps endorsed by the National Health Service (NHS), four publicly funded health care systems in the United Kingdom, are transmitting personal and medical information over the web without any protection. According to The Guardian, researchers from the Imperial College London examined 79 apps endorsed by the NHS...

Craig Young and I spent several days with the crew at Crime Watch Daily in Los Angeles – a new national crime show. In this first segment, we showed them how malicious hackers gain access to baby monitors and IP cameras, demonstrating a number of techniques that can be used to gain access to the devices to hijack the video feeds and audio, as well...

The United States Navy has announced it is currently working on developing a new system aimed at protecting its ships from pervasive Internet attacks, often leading to network spying and confidential data theft. Codenamed the Resilient Hull, Mechanical, and Electrical Security (RHIMES) system, the Office of Naval Research (ONR) revealed the enhanced...

The Office of Personnel Management (OPM) has revealed in a statement that when hackers breached its systems earlier this year they made away with approximately 5.6 million fingerprints - a significant increase from the 1.1 million previously reported. As is now well known, in addition to fingerprint data being stolen the Social Security numbers,...

Our smartphones know everything about us – who our friends are, where we have been, our financial details, our health information and other intimate details of our lives. But can we trust our phones to keep these our personal information secret? One of the biggest security and privacy challenges of smartphones are the very apps we install on them...