Crooked Bough News Round-up

— Scattered Spider on the hook for M&S cyber attack

 

at 4/29/25 10:06am

The infamous Scattered Spider hacking collective may have been behind the ongoing cyber attack on Marks and Spencer that has crippled systems at the retailer and left its ecommerce operation in disarray.

— Gov.uk One Login yet to meet government cyber security standards for critical public services

 

at 4/29/25 6:45am

The government’s flagship digital identity system still does not fully conform to key national security standards three years after launch, while questions remain over whether historic security problems have been resolved

— What is a risk map (risk heat map)?

 

at 4/27/25 6:00pm

A risk map, or risk heat map, is a data visualization tool for communicating specific risks an organization faces.

— M&S suspends all online sales as cyber attack worsens

 

at 4/25/25 5:15am

M&S shuts down online sales as it works to contain and mitigate a severe cyber attack on its systems

— M&S systems remain offline days after cyber incident

 

at 4/24/25 4:23am

M&S is still unable to provide contactless payment or click-and-collect services amid a cyber attack that it says has forced it to move a number of processes offline to safeguard its customers, staff and business

— Data breach class action costs mount up

 

at 4/24/25 3:45am

Organisations exposed to the US market paid out over $150m in class action settlements in just six months. Security leaders must do more to address cyber gaps, respond better to incidents and demonstrate compliance

— Challenges persist as UK’s Cyber Security and Resilience Bill moves forward

 

at 4/24/25 2:26am

Elements of the proposed Cyber Security and Resilience Bill are welcome but questions remain about how best to act in the face of persistent challenges like geopolitical chaos, threats to critical infrastructure, and technological advances, writes CSBR chief exec James Morris

— Podcast: RSA 2025 to grapple with AI compliance, US and EU regulation

 

at 4/24/25 1:55am

We preview RSA 2025 with Vigitrust CEO Mathieu Gorge who looks forward to learning lots around compliance and regulation as CIOs wrestle with artificial intelligence and geopolitical upheavals

— Ericsson boosts NetCloud SASE with integrated clientless ZTNA for wireless WAN

 

at 4/24/25 12:45am

Leading comms tech provider claims industry’s first fully integrated clientless zero-trust network access, designed for wireless wide area network with update to core secure access service edge platform

— March ransomware slowdown probably a red herring

 

at 4/23/25 9:00pm

An apparent slowdown in ransomware attack volumes is raising eyebrows, but the statistics never tell the full story

— What is risk exposure in business?

 

at 4/23/25 6:00pm

Risk exposure is the quantified potential loss from currently underway or planned business activities.

— Rethink authentication to remove the burden on users

 

at 4/23/25 10:47am

The rise of AI powered threats and non-human identities will push an already strained identity security model over the edge

— Financially motivated cyber crime remains biggest threat source

 

at 4/23/25 10:34am

Mandiant’s latest annual threat report reveals data on how financially motivated cyber criminals, such as ransomware gangs, dominate the cyber security landscape

— Financially-motivated cyber crime remains biggest threat source

 

at 4/23/25 10:34am

Mandiant's latest annual threat report reveals new data on how financially-motivated cyber criminals, such as ransomware gangs, dominate the cyber security landscape

— Amid uncertainty, Armis becomes newest CVE numbering authority

 

at 4/23/25 2:00am

Amid an uncertain future for vulnerability research, exposure management company Armis has been given the authority to assign CVE IDs to newly discovered vulnerabilities

— Qualys goes to bat for US cricket side San Francisco Unicorns

 

at 4/22/25 10:59pm

Cloud security specialist Qualys partners with US T20 cricket squad San Francisco Unicorns and its Sparkle Army fanclub as the team prepares for its summer 2025 campaign

— Digital ID sector calls for changes to government data legislation

 

at 4/22/25 10:30pm

Suppliers urge technology secretary to work more collaboratively with private sector over concerns government’s digital wallet will gain a monopoly in the market

— Cyber attack downs systems at Marks & Spencer

 

at 4/22/25 6:35am

A cyber attack at Marks & Spencer has caused significant disruption to customers, leaving them unable to make contactless payments or use click-and-collect services

— Cyber ‘agony aunts’ launch guidebook for women in security

 

at 4/22/25 5:49am

Cyber ‘agony aunts’ Amelia Hewitt and Rebecca Taylor are launching a book aimed at empowering women in their cyber security careers

— Secure Future Initiative reveals Microsoft staff focus

 

at 4/22/25 5:45am

IT security is now a metric in the Microsoft employee appraisal process

— Beyond baselines - getting real about security and resilience

 

at 4/22/25 3:40am

In an increasingly contested world, the UK government needs a security certification that goes beyond baseline measures.

As of 4/30/25 12:56am. Last new 4/29/25 3:01pm.