SecurityWeek

The US State Department -- on the front lines of the sensitive Iran nuclear negotiations -- said Thursday it was confident there had been no security breach, after Swiss and Austrian investigators launched probes into alleged cyber-spying.

Suspected Chinese hackers who infiltrated the US government's human resources records have sensitive information on all federal employees, an American union said Thursday.

The existence of a new version of the notorious Duqu worm has come to light this week. This highly sophisticated piece of malware has been used by threat actors in targeted attacks aimed at several major organizations, including Russia-based security firm Kaspersky Lab.

The Forum of Incident Response and Security Teams (FIRST) announced this week the availability of version 3 of the Common Vulnerability Scoring System (CVSS).

Red Lion Controls is preparing a firmware update to address a vulnerability in the N-Tron 702-W Industrial Wireless Access Point that can be exploited by an attacker to compromise communications and the integrity of the device.

Recent versions of the content management system (CMS) Concrete5 address several vulnerabilities, including security holes reported by Italy-based researcher Egidio Romano of Minded Security.

Researchers with Raytheon|Websense have identified a massive malvertising campaign that has hit Web users in Europe and the U.S.

A tech-savvy US teen pleaded guilty in court on Thursday to using social media to aid the Islamic State group, a crime punishable by up to 15 years in prison. Ali Shukri Amin, 17, a resident of Virginia, admitted in court to providing advice and encouragement to IS and its supporters.

OpenSSL versions 1.0.2b, 1.0.1n, 1.0.0s and 0.9.8zg have been released. The latest versions of the open-source toolkit for SSL/TLS address several moderate and low severity security bugs.

One topic of conversation that surfaces quite regularly is the skills gap and critical staffing shortage present in the security field. From the data points I’ve been able to gather, this need is felt most acutely in the security operations and incident response space.

The man responsible for reviewing Britain's anti-terrorism laws called Thursday for greater judicial oversight over data interception as ministers prepare legislation firming up the powers of security services following leaks by Edward Snowden.

Honeywell released a security update for the company’s Falcon XLWeb controller several months ago, but only a small number of organizations have applied the patch, according to researchers at vulnerability management company Outpost24.

Mozilla Has Announced the Launch of a Bug Bounty Hall of FameResearchers who responsibly disclose vulnerabilities found in Firefox can now earn more than $10,000, Mozilla announced this week.

The email client shipped with Apple’s iOS mobile operating system is plagued by a vulnerability that can be exploited to load remote arbitrary HTML content in the application, a researcher has warned.

Chinese hackers accused of attacking US federal databases may have snared the names of Chinese with links to American officials, putting them in danger, The New York Times said Wednesday.

It's not just hype - point-of-sale (PoS) systems are being compromised more than ever, and much of the blame falls on mistakes surrounding remote access.

When sophisticated attackers come back, they can come back with a vengeance.

More and more industry standards and regulations promote or even mandate that organizations apply the concept of “continuous compliance”. Continuous compliance includes the reconciliation of assets and automation of data classification, alignment of technical controls, automation of compliance testing, deployment of assessment surveys, and automation of data consolidation. This approach can not only increase an organization’s compliance posture, but also its security efficacy.

Europol's European Cybercrime Centre (EC3) announced on Wednesday the results of a joint international operation targeting a criminal group that used malware and social engineering to steal a large amount of money.

Nearly three quarters of global organizations lack the maturity to address cybersecurity risks, and size is not a determinant of strong maturity, according to RSA’s inaugural Cybersecurity Poverty Index.