SecurityWeek

GENEVA - Russia and Ukraine sit down for high-stakes talks in Geneva on Thursday, seeking to ease the crisis in the former Soviet republic after the US warned Moscow it must make concessions or face fresh sanctions.

OTTAWA - Federal police said Wednesday they have arrested and charged a 19-year-old man in the theft of 900 Canadian taxpayers' data, which was made vulnerable by the "Heartbleed" bug.

Oracle just released a massive security update that covers 104 vulnerabilities across its product portfolio. Thirty-seven of the vulnerabilities affect Oracle Java SE. According to Oracle's advisory, 35 of these can be exploited remotely without authentication. Four of the bugs have a CVSS Base Score of 10, the most critical rating a bug can achieve.

SQL injection attacks have been at the center of many data breaches big in small during the past. Yet it continues to plague organizations even today.

The sad truth is that the security practice lags behind pretty much every other IT discipline when it comes to automation. • Need to spin up compute power? Give me a few seconds. A new virtual server may even be spun up automatically when the workload requires it.

In any relationship, good communication is key, especially in the world of enterprise IT.

WASHINGTON - The heartache from the Heartbleed Internet flaw is not over, and some experts say the fix may lead to online disruption and confusion. The good news is that most sites deemed vulnerable have patched their systems or are in the process of doing so.

Researchers at FireEye have identified a vulnerability affecting Google Android that could be exploited to lead users to malicious sites.

LONDON - Britain Tuesday named a top foreign ministry official as the new head of GCHQ, the electronic eavesdropping agency that came under scrutiny after leaks by former US analyst Edward Snowden.

Dell SecureWorks has added a new managed service to its offerings, announcing on Tuesday that it now offers Advanced Endpoint Threat Detection (AETD) as the latest solution in its Advanced Threat Services portfolio.

LONDON - British parenting website Mumsnet is the latest organization to have been hacked due to the "Heartbleed" bug, founder Justine Roberts revealed on Monday.

Phishers continued to target shared virtual servers as a means to propagate their attacks during the second half of 2013, according to the Anti-Phishing Working Group (APWG). In the group's latest report on global phishing trends, APWG researchers reported that 18 percent of all phishing attacks worldwide could be attributed to the activity.

Akamai Technologies admitted custom code thought to protect against the Heartbleed vulnerability has a flaw of its own and has forced the company to reissue SSL certificates and keys to its customers.

OTTAWA, - Personal data for as many as 900 Canadian taxpayers was stolen after being made vulnerable by the "Heartbleed" bug, officials in Ottawa said on Monday.

After details of the critical “Heartbleed” vulnerability in OpenSSL emerged last week, which enables attackers to steal sensitive data typically protected by TLS encryption, there has been widespread concern among system administrators, network security teams, software developers and essentially anyone with any technical connection to the Internet.

BERLIN - Germany's aeronautics and space research center has for months been the target of a suspected cyber attack by a foreign intelligence service, a German news weekly reported Sunday. Der Spiegel said that several computers used by scientists and systems administrators at the Cologne-based DLR center had been infiltrated by spy programs.

WASHINGTON - The US National Security Agency on Friday denied a report claiming it was aware of and even exploited the "Heartbleed" online security flaw to gather critical intelligence.

Court Reverses Conviction of US 'Security Hacker' WASHINGTON - An appeals court in the United States overturned Friday the conviction of a self-described "security research" hacker for breaking into the AT&T online network to reveal a security flaw.

Maybe it’s my actuarial background, but I’ve always seen IT security as an activity that should work hand-in-glove with insurance. After all, both domains are about planning for, and if possible preventing, disaster. Both have trouble showing they are “working” until something really bad happens. Both therefore have to go to special efforts to make the case to a CFO for the expenses involved. And of course, insurance has a few centuries of experience that can teach us IT secfolks...

OTTAWA - Canada's government on Friday ordered all federal department websites vulnerable to the "Heartbleed" bug to be shut down.