A significant security vulnerability in Apache Struts 2 was addressed last week, but it is currently being exploited with publicly available proof-of-concept (PoC) code. Struts is a widely used Java-based web application framework, favored by large corporations and government institutions. Issues in this open-source framework can have severe consequences, reminiscent of the Equifax breach in…
Dive Brief Microsoft is enhancing its vulnerability disclosure process by adopting the Common Security Advisory Framework (CSAF), enabling organizations to more efficiently prioritize and remediate CVEs (Common Vulnerabilities and Exposures). This machine-readable format allows for faster and higher volume processing of CVEs, while customers can still access updates through the Microsoft security update guide or…
Selecting an effective password can be challenging. The NCSC has emphasized through various blogs and guidance that it’s crucial to modify password policies to ensure users are encouraged to select secure passwords. One of the strategies includes the utilization of password deny lists, which prevent users from choosing passwords that are frequently exposed in data…
Customers of Marriott International, a prominent hotel group, may find that their personal information has been compromised in connection with the guest reservation database managed by Starwood. Incident Overview Marriott has announced that an internal investigation revealed that unauthorized access to the Starwood guest reservation database began in 2014, potentially impacting approximately 500 million customers….
The National Cyber Security Centre (NCSC) is investigating the implications of a vulnerability in WPA2 Wi-Fi networks known as ‘Krack’, first reported on 16 October 2017. This page offers guidance to enterprise administrators, small business owners, and home users regarding the recently identified vulnerability in their Wi-Fi networks. This information will be revised as new…
Overview This guide details the steps for enabling 2-step verification (2SV) on your vital online accounts. Implementing this feature significantly reduces the likelihood of unauthorized access, even if your password has been compromised. For IT professionals seeking guidance on broader implementation of 2SV in larger organizations, please consult the NCSC’s dedicated resource on multi-factor authentication…
Intended Audience for This Guidance This information is directed towards customers of Dixons Carphone plc and its main brands in the UK, specifically Currys PC World and Carphone Warehouse, as the National Cyber Security Centre (NCSC) collaborates with them to investigate a data breach. Overview of the Incident On June 13, 2018, Dixons Carphone plc…
Individuals frequently approach the NCSC to inquire whether it is advisable to use password managers (also known as password vaults). They ask questions about which password managers are recommended, who should utilize them—be it private individuals, small businesses, or large corporations—and the appropriate methods for using them. Furthermore, many wonder if it is secure to…
The National Cyber Security Centre (NCSC) is actively collaborating with organizations and partners throughout the UK that have been impacted by the ransomware known as ‘WannaCry’. This page provides guidance for home users and small businesses looking to decrease the risk of falling victim to WannaCry or other forms of ransomware. This guidance will be…
Many individuals inquire with the NCSC about the appropriateness of utilizing password managers (also referred to as password vaults). They wonder whether password managers are suitable for everyone – private citizens, small businesses, or large enterprises. Additionally, questions often arise regarding the safest methods to use these tools. Is it secure to store all essential…
