SecurityWeek

When Forrester's John Kindervag first wrote about the concept of the Zero Trust Model (ZTM) it almost seemed too paranoid. ZTM posits that attackers are so successful in penetrating networks that a network architect should consider each and every device—from the Internet, to the firewall, to the switch, to the server—to be potentially compromised.

Adobe released on Tuesday patches for its Creative Cloud, RoboHelp Server and AIR products.

Researchers have identified another IBM Java patch that can be easily bypassed and claim the vendor failed to properly analyze the vulnerability they reported back in 2013.

Released today, Symantec's Internet Security Threat Report 2016 (ISTR) is a data-based analysis of cybersecurity events and issues over the last year. Symantec has been producing these reports for more than 10 years, drawing data from more than 63.8 million attack sensors in more than 150 countries and territories.

Updates released by Microsoft and Samba on Tuesday patch the vulnerability dubbed “Badlock,” although it turns out that the issue is not as severe as expected.

Mobile phone-based two-factor authentication (2FA) mechanisms are plagued by synchronization vulnerabilities that allow attackers intercept One-Time Passwords (OTPs) and bypass the security of many financial services, researchers say.

Researchers at BAE Systems have observed an improved version of the Qbot malware being used in attacks aimed at public institutions in the United States and other countries.

Atmos, a derivative of the ZeuS/Citadel stable, has been detected targeting banks in France. The malware has been active since late 2015, but this seems to be its first concerted use.

Manila - Philippine authorities are investigating a computer security breach at the state election agency, officials said Tuesday, less than a month before the nation goes to the polls.

Researchers have identified possible links between Rokku and Chimera, and between PowerWare and PoshCoder ransomware.PowerWare and PoshCoder

The developers behind the Locky ransomware are tireless in their quest to evade security controls and gain a higher infection rate, and they have recently implemented a variety of changes to the ransomware’s code to support their mission.

Every week we hear of several new high profile ransomware incidents affecting hospitals, schools, businesses and government. It’s gotten so bad that cybersecurity agencies in the U.S. and Canada recently issued an alert about the growing number of ransomware attacks affecting health care organizations.

Researchers at Dell SecureWorks and Palo Alto Networks have teamed up to analyze the Ramdo click-fraud malware, a threat that has been infecting computers around the world since late 2013.

SecureWorks plans to offer 9 million shares in an upcoming initial public offering (IPO) at a price between $15.50 and $17.50 per share, according to an S-1 registration statement filed witht the U.S Securites and Exchange Commission (SEC) on Monday.

Several ARRIS SURFboard broadband cable modem models suffer from cross-site request forgery (CSRF) vulnerability that allows an attacker to reboot them without authentication.

Cisco's John Stewart believes there are roughly a million security role vacancies, and this gap is now officially a crisis. We are about a million brains and bodies short of what we need to plug the many growing holes that perforate our highly internetworked environments.

A hacktivist group calling itself the Cyber Justice Group announced on Twitter that it has dumped 10GB of data from the Syrian government. The hackers left a message on Pastebin and dumped the data to file sharing site Mega. The data is compressed, and expands to a full 43GB.

Cybercriminals have come up with a clever way to deliver a piece of malware to users in China and ensure that it would not be detected by an antivirus solution.

Time was when you could trust big names. Not any more – in fact 'big names' are increasingly targeted by the bad guys simply because we do tend to trust them. Amazon is just the latest.

Researchers have come across a piece of JavaScript malware that is capable of changing the DNS settings of home routers from mobile devices.