While cybersecurity teams are contending with rising workloads and chronic staffing issues, new research shows practitioners are still charging ahead and meeting targets.

In a new study from Tines and IDC, 88% of InfoSec leaders said their teams are exceeding targets, and a key factor here lies in the adoption of new AI tools and automation.

The study found that six-in-ten leaders work with teams consisting of 10 practitioners or fewer. However, 72% said that they'd been expected to take on more work over the last year, and a quarter said they'd had to work evenings or weekends.

Virtually all were enthusiastic about AI, with only one-in-twenty worried about their job. Notably, they want to see AI and automation eliminate business siloes, with nearly all looking to connect these tools across security, IT, and DevOps functions.

The most common AI use cases so far include manipulating security data, with around a third of teams using AI for summarization, threat intelligence analysis, or threat detection.

If they were only able to use AI and automation to free up more time, 43% said they'd use it to focus more on security policy development, with a similar number saying they'd do more on training and development, and 38% on incident response planning.

That’s easier said than done, however. Tines’ study revealed a third of security leaders are worried about the time required to train their teams on AI, with a quarter citing compliance as a problem.

Other hurdles included AI hallucinations, secure AI adoption, and slower than expected implementation times.

"Security professionals, who already face an unprecedented threat landscape in 2025, are met with the daunting task to integrate AI across their workflows," said Matt Muller, field CISO at Tines.

"Our research shows that security teams are stepping up. However, organizations must take a flexible approach to automation and AI to ensure it remains secure and effective."

Tool sprawl remains a problem in cybersecurity

A key barrier to productivity in security teams is tool sprawl, according to the study from Tines. More than half of teams typically manage 20 to 49 tools, while 23% use fewer than 20, and 22% use 50 to 99.

But only a third of security leaders said they were satisfied with their team’s tools, with a quarter struggling with poor integration, and a third reckoning their stack lacks key functionality.

"Siloed automation across departments complicates managing security programs and creates vulnerabilities, especially as less technical employees adopt these technologies," said Christopher Kissel, research vice president, security and trust products at IDC Research, which carried out the research.

"The security leaders we surveyed are strongly in favor of embracing shared automation between security and closely-knit business units like IT and DevOps to improve collaboration, strengthen security posture, streamline operations, and reduce complexity."

Tool sprawl is a frequent complaint among IT professionals, with a report last year from Google Workspace finding that teams with ten or more security tools experienced more incidents than those with a consolidated tech stack.

That didn't stop IT leaders from introducing them, however, with nearly two-thirds admitting to adding new security tools as they go along.

MORE FROM ITPRO

• Cybersecurity skills: Addressing the gaps and challenges
• MSPs are struggling with cyber security skills shortages
• Cybersecurity is the fastest growing tech occupation in the UK

Application development infrastructure is full of significant security risks, with research by Legit Security finding high or critical risks in the developer environments of every company it examined.

The security company's report into the state of application risk found flaws in applications but also the "software factories" that make them. The report is based on data from its own platform, looking at a range of organizations from large to small, across various industries.

Legit said application security is no longer simply about spotting flaws in source code, noting that the attack surface for applications has grown and diversified.

"With software development that is faster, more automated, more dynamic, and highly reliant on third parties, new opportunities to introduce risk abound."

According to the report, 89% of companies have pipeline misconfiguration issues and 46% are using AI models in source code in a risky way. Notably, security teams are actually unaware where AI is in use, making the booming technology an emerging threat for application security.

"Our research uncovered great risks everywhere throughout the development process," said Liav Caspi, Legit CTO and co-founder.

"These results highlight that teams are overlooking risks in their development environments and CI/CD pipelines, and are inviting the next supply chain attack by neglecting critical security hygiene."

Leaking secrets

The report found that all organizations on its platform had three or more application risks, but only two-thirds had public repositories with two or more risks. Those included exposed information that should have been secret, like cloud keys, GitHub personal access tokens, and even personal information such as credit card numbers.

Such data was often found in source code that could be accessed by any user with access to a repository, such as an external supplier or anyone if it was made public.

But a third of that information was actually outside source code and found in documentation and collaboration tools like Confluence or in ticketing systems.

Legit advised companies not to hard-code "secrets" into source code by using a password manager or environment variable.

"To prevent exposed secrets, focus first on SaaS services keys (e.g., AWS access keys), since if code is leaked, credentials to SaaS services are immediately usable if they are valid, whereas internal credentials require attackers to also have network connectivity," the report added.

Another challenge is giving too much access: the report found 85% of development teams are over-permissioned, while 23% of repositories across organisations have external suppliers or collaborators with admin privileges in places they shouldn't.

The wrong tools

The study also found that most companies use inefficient application security scanning, with 78% using duplicate software composition analysis scanners that would produce the exact same results, and 39% having duplicate static application security testing scanners.

Legit pinned this on developers working in different parts of the business using free versions of scanners, noting that would be exacerbated by mergers and acquisitions.

"To make an analogy, it’s as if they are preparing delicious, innovative dishes, in a kitchen with rusty, dirty, malfunctioning equipment," Caspi added.

"Most security teams today don’t have the visibility or the context they need to identify risk outside of source code or to effectively triage AppSec findings."

The role of the CISO is growing in status as cybersecurity becomes an increasingly pressing issue for enterprises globally, new research shows.

A recent study from Splunk shows security execs are being granted more powers to make strategic decisions for the business and are fostering closer collaborative ties with the boardroom and CEO.

More than eight-in-ten CISOs now report directly to the CEO, a huge increase from 47% in 2023. Meanwhile, 83% participate in board meetings somewhat often or most of the time.

However, while six-in-ten acknowledge that board members with cybersecurity backgrounds have a more powerful influence on security decisions, only 29% say their board includes at least one member with cybersecurity expertise.

"As cybersecurity becomes increasingly central to driving business success, CISOs and their boards have more opportunities to close gaps, gain greater alignment, and better understand each other in order to drive digital resilience,” said Michael Fanning, chief information security officer at Splunk.

“For CISOs, that means understanding the business beyond their IT environments and finding new ways to convey the ROI of security initiatives to their boards. For board members, it means committing to a security-first culture and consulting the CISO as a primary stakeholder in decisions that impact enterprise risk and governance."

CISOs on the board builds strong security practices

Splunk’s research found that board members with a security background reported stronger relationships with security teams, and felt more confident about the organization’s security posture.

They were much less likely than other board members to express concern they weren't doing enough to protect the organization.

Working relationships where a board member had a security background were particularly good when it came to setting and aligning on strategic cybersecurity goals, with CISOs on the board delivering a three-fold improvement.

Other areas to benefit included communicating progress against milestones and security goal achievements, along with budgeting adequately to meet goals.

There were, though, differences in priorities. More than half of CISOs thought innovating with emerging technologies was a priority, compared with just a third for board members. A similar proportion of CISOs prioritized upskilling or reskilling security employees, versus only 27% for boards.

"As the role of the CISO grows more complex and critical to organizations, CISOs must be able to balance security needs with business goals, culture, and articulate the value of security investments," commented Shefali Mookencherry, chief information security and privacy officer at the University of Illinois Chicago.

"By establishing strong relationships across various departments and stakeholders, CISOs can provide guidance and leadership to propel cybersecurity and privacy programs."

CISOs face regulatory challenges

As regulatory environments have become more complex, expansive, and punitive, CISOs are having to deliver faster incident reporting, and are facing more liability.

However, only 15% of CISOs ranked compliance status as a top performance metric, a significant contrast to 45% of boards. Nearly a quarter (21%) of CISOs said they'd been pressured not to report a compliance issue, although 59% said they would become a whistleblower if their organization was ignoring compliance requirements.

Meanwhile, cyber budgets reflect inconsistent support and misalignment, with three-in-ten CISOs saying they receive the appropriate budget for cybersecurity initiatives and accomplishing their security goals, compared with four-in-ten board members who think budgets are adequate.

Other woes included concerns that they're not doing enough, with 18% revealing they were unable to support a business initiative because of budget cuts in the last 12 months. Nearly two-thirds said that lack of support led to a cyber attack.

Managed Security Service Providers (MSSP) are at the forefront of emerging market trends, meaning they need to identify and adopt the latest technology to best protect their customers and keep step with competitors. 

The demand for dark web intelligence has skyrocketed over the past few years, as organizations grow ever more aware that cyber attacks originate in marketplaces, forums, and sites they cannot see. It is therefore not surprising that most MSSPs have already started to address customer demands for dark web threat insights.

But despite many MSSPs already undertaking dark web monitoring, our latest research identified that 35% of MSSPs believe that dark web monitoring is too complex, while nearly one-third (29%) believe it isn’t relevant to their service offering, and 18*+% are yet to be convinced they will be able to sell it.

With 34% of MSSPs not seeing value in dark web monitoring tools, some providers are potentially missing out on providing essential insights into an online criminal underworld where cyber criminals discuss and plan future attacks. 

MSSPs, therefore, have an opportunity to harness the power of dark web intelligence to protect their customers from cyber threats.

Dark web intelligence and the “cyber kill chain”

When we talk about cyber security, most of a security team’s resources and tools are focused on the late stages of “cyber kill chain” (the sequence of actions a cybercriminal has to take to execute their attacks). 

For instance, email security tools sit at the ‘delivery’ phase of a cyber attack, whilst endpoint, network, and antivirus security solutions focus on identifying the subsequent activity as the attacker makes their way across an organization’s infrastructure. 

As cyber criminals continue to evolve their capabilities and skill sets to be able to bypass existing security solutions, preventing an attack is not always as simple as not clicking a phishing link. To give the best chance of disrupting a cyber criminal’s operation in clients systems, MSSPs need to “shift left” and act as early in the cyber kill chain as they can on behalf of their customers. 

Dark web intelligence allows MSSPs to investigate the ‘reconnaissance’ stage, right at the beginning of the “kill chain” when threat actors are planning their cyber attacks on dark web hacking forums, and buying the exploits and tools they need on malicious marketplaces. 

By starting this early, MSSPs can make a dent in an attack plan and advise their clients on how to take preventative action that stops their network from being breached in the first place. 

MSSPs’ position in the market requires them to be early adopters, able to identify the latest tools and technologies to protect their customers. It is no surprise then, that 56% of MSSPs already undertake dark web intelligence, recognising the benefit. 

Companies of all sizes are increasingly conscious of dark web threats and the opportunity dark web intelligence holds for helping them identify the early warning signs of attack. 

This has created an opportunity for MSSPs to use dark web intelligence as a basis to deliver the analysis, expertise, services, and solutions that help their customers act on the dark web risk they have heard so much about.

Meeting customer demand

According to our research, customer interest in the dark web has been increasing, with 65% of MSSPs stating that their customers have asked for threat intelligence from the dark web. 

Why is that? Well, there are three main reasons for this demand. Firstly, as visibility in cyber security is key, customers want to identify vulnerabilities affecting their organization. Secondly, they want to know if they or their competitors are currently being targeted on the dark web. 

Thirdly, they want to own and act upon intelligence on threat groups including ransomware gangs that are active in the threat environment.

So, as the topic of dark web monitoring grows in prominence, those MSSPs that have started to build out their capabilities, data sources, and understanding will be able to benefit as more customers look for guidance on the dark web, giving them an advantage in the competitive market of managed security services.

Unlocking benefits for MSSPs

Aside from striking benefits for customers, MSSPs can also take advantage of dark web intelligence from a commercial perspective. When asked about the benefits of using dark web intelligence, 37% of MSSPs reported that it helps them identify customer details on the dark web, closely followed by giving them new products and services to sell to customers and making their current services more efficient.

By “shifting left” in the cyber kill chain, MSSPs are enabled to move from reacting to threats to proactively preventing them from happening in the first place. This makes good business sense as it means MSSPs can document and demonstrate value based on attributes exposed and/or being discussed on the dark web. 

It also means that MSSPs don’t have to wait for their clients to be breached before they can prove their worth – they can often find threats that could impact the organization, from day one.

According to research, the most common use for threat intelligence is to inform pentests and security audits (35%) followed by informing incident response (34%). The MSSPs which use dark web intelligence in one-off engagements are missing a trick in integrating dark web intelligence into their value proposition and hence recurring revenues, where they could be capitalizing month-on-month. 

A huge opportunity lies in MSSPs wrapping dark web monitoring into their Managed Security and SOC services to provide customers with an ongoing view of their dark web risk over time and alert them as soon as a serious situation emerges.  

The turbulent nature of criminal activity means that the dark web shifts and changes at an even faster rate than the clear web. Marketplaces, forums, and criminal groups appear out of nowhere, rise to prominence, jostle with other criminals and law enforcement, and disappear just as quickly as they came. 

Dark web threat prevention is, therefore, not something that can be done on a six monthly or yearly basis. If organizations want to truly understand their threat risk on the dark web, they need their MSSPs to continuously monitor and deliver meaningful insights for effective cyber security protection and healthy cyber posture.

The US government is underlining its willingness to foster a collaborative relationship with private enterprise and the open source community on AI and security with the launch of its newest scheme. 

On Wednesday, the Biden administration unveiled plans to launch a major government-backed competition aimed at exploring the use of artificial intelligence (AI) to support national cyber security. 

The ‘AI Cyber Challenge’ will offer up to $20 million in prizes and help “drive the creation of new technologies to rapidly improve the security of computer code”, which the White House said is among the country’s most “pressing challenges”. 

In addition, the scheme will involve close collaboration with a host of top companies operating in the AI space, including Google, Microsoft, OpenAI, and Anthropic.

“The Biden-Harris Administration today launched a major two-year competition that will use artificial intelligence to protect the United States’ most important software, such as code that helps run the internet and our critical infrastructure,” the White House said in a statement. 

“It marks the latest step by the Biden-Harris Administration to ensure the responsible advancement of emerging technologies and protect Americans.”

The move from the government appears to build on its intention to foster closer ties with the private sector, the open source community, and major industry players as part of its broader National Cybersecurity Strategy. 

Last month, the White House published an outline of its first actions through the strategy, which included the creation of a comprehensive framework aimed at reducing the risk of vulnerable software in critical infrastructure. 

The government said that, under the framework, the “biggest, most capable, and best-positioned” organizations across both the public and private sectors should assume a “greater share of the burden for mitigating cyber risk”. 

Creating a closer relationship with the private sector works to the government’s advantage in this regard, enabling it to draw on the country’s significant expertise and expansive technology ecosystem. 

With the AI challenge scheme, the situation is no different and could help the administration accelerate the use of AI systems to bolster national security amid a period of escalating threats. 

Open source commitments

A key talking point within the announcement this week is the requirement that participating organizations make their materials and solutions open source. 

“AI companies will make their cutting-edge technology – some of the most powerful AI systems in the world – available for competitors to use in designing new cyber security solutions,” the White House said in a statement. 

The Open Source Security Foundation (OpenSSF), part of the Linux Foundation, will also serve as an advisory figure on the challenge. 

As part of its involvement in the scheme, the foundation will help “ensure that the winning software code is put to use right away protecting America’s most vital software”. 

This desire to involve the open source community in the scheme aligns closely with the government’s general position on the ecosystem of late. 

Last month’s announcement confirmed that the Cybersecurity and Infrastructure Security Agency (CISA) will work with both the private sector and the open source community to accelerate the development of secure-by-design software moving forward. 

Creating a welcoming environment for the open source ecosystem is an aspect of the US’ current strategy that has been hailed in recent months. 

At the launch of the cyber strategy in March this year, the Biden administration was commended for its position on open source innovation, which comes in stark contrast to what has been seen in the European Union (EU) across the same period. 

The union has been repeatedly criticized for its stonewalling of the open source ecosystem on both AI development and security, with critics describing the approach as highly inhibitive and creating a “chilling” effect across the community. 

A host of major ransomware gangs could be sharing intel and conferring over attack techniques, according to Sophos. 

Researchers at the security firm analyzed connections between three of the most notorious ransomware outfits over the past year, including the Royal, Hive, and Black Basta gangs. 

There were “distinct similarities” between techniques employed during four different incidents at the beginning of 2023, analysis showed, raising questions over whether the gangs have been collaborating. 

“Despite Royal being a notoriously closed off group that doesn’t openly solicit affiliates from underground forums, granular similarities in the forensics of the attacks suggest all three groups are sharing either affiliates or highly specific technical details of their activities,” Sophos said. 

These “unique similarities” included using the same usernames and passwords when attackers seized control of victims’ systems, the company said. These striking similarities included:

• Hive – first incident: Adm01/Adm02 | Pa$$w0rd991155 and AdminBac | P@ssW0dDP@ssW
• Royal – second incident: Adm04 | Pa$$w0rd12321 and AdminBac | P@ssW0dDP@ssW 
• Black Basta – third incident: Adm066 | Pa$$w0rd11225 and WDAGUtilityAccount | P@ssw0rd123456789 

In addition, similar techniques employed by all three included delivering payloads in .7z archives named specifically after the victim organization, as well as “executing commands on infected systems with the same batch scripts and files”. 

Andrew Brandt, principal researcher at Sophos said traditional ransomware-as-a-service models require significant involvement from outside affiliates to conduct attacks. As such, there’s often crossover in tactics, techniques, and procedures they use. 

But the similarities here were striking, and could point to a deep degree of cross-communication, as well as the reliance on established affiliates for gangs like Royal.

“In these cases, the similarities we’re talking about are at a very granular level,” he added. “These highly specific, unique behaviors suggest that the Royal ransomware group is much more reliant on affiliates than previously thought.”

The attacks Sophos observed include a high-profile attack Hive instigated in January. The group, however, was taken down in a landmark operation conducted by the FBI and Europol later that month. 

Law enforcement infiltrated Hive’s operations networks in mid-2022, with the takedown hailed as a rare occasion in which the FBI used offensive security tactics to cripple the organization. 

The sting bore similarities to the joint international law enforcement takedown of the REvil ransomware gang in 2021, which prevented more than $100 million worth of ransomware payments being made, according to the FBI. 

Sophos’ analysis suggested some of the corroborating techniques observed this year could point toward the use of Hive affiliates by other existing groups, specifically Royal. 

“This operation could have led Hive affiliates to seek new employment – perhaps with Royal and Black Basta – which would explain the similarities in the ensuing ransomware attacks,” researchers said.

BAE Systems has reported accelerated growth in its cyber business as nations look to double down on cyber security, amid strong financials for the first half of 2023.

The firm’s Cyber & Intelligence business reported revenue of £1.15 billion ($1.47 billion) in H1 2023, with external customer revenue in Cyber alone having grown 30% across the period to £759 million. 

The domain was the main driver for Cyber & Intelligence, representing 69% of its external customer revenue against the smaller contributions of air, maritime, and land.

Overall BAE reported 13% year-on-year revenue growth in its H1 2023 results, topping £11 billion ($14.06 billion). Operating profit hit £1.2 billion ($1.53 billion), up 20% year-on-year.

The firm linked growth in its Cyber & Intelligence business to an increase in systems integration and classified intelligence work, as well as a “sharp” uptick in national security cyber sales outside the US market. 

Customers in central government, national security agencies, militaries, telecoms, and law enforcement continue to invest in BAE services. It serves clients around the world such as the US Department of Defense, with 10,700 employees in Cyber & Intelligence in total.

Both the public and private sectors employ BAE for mission-critical work, against the backdrop of the National Cyber Security Centre’s (NCSC’s) recent warning that new Russian groups seek to destroy critical national infrastructure.

Sales across the business increased by 7% across the period, with a single contract to support critical operations for a government customer having brought in $457 million (£371 million) in March.

The firm stated that it is now using artificial intelligence (AI) at an increasing level across all business areas, such as in manufacturing and design work. Increasing cyber attacks continue to drive revenue across its cyber division in the UK and US.

"We've delivered a strong financial performance in the first half of the year, thanks to the outstanding efforts of our employees,” said Charles Woodburn, CEO at BAE Systems.

"Our global footprint, deep customer relationships, and leading technologies enable us to effectively support the national security requirements and multi-domain ambitions of our government customers in an increasingly uncertain world.”

What does BAE provide?

BAE Systems is Europe’s largest defense contractor, and is based in London. It specializes in cyber security and intelligence services, as well as the production of munitions and equipment for use in land, air, and maritime combat.

Its worldwide workforce comprises more than 93,000 employees, with the majority of these based in the UK, US, Saudi Arabia, and Australia.

Since 2008 the company has heavily invested in cyber security, rapidly expanding its portfolio in the space through a string of acquisitions.

BAE provides risk advisory and incident response services for its clients, alongside more extensive design work on cyber defense for nation-states. It also provides operational expertise on advanced cyber threats, as well as software and hardware to protect against electronic warfare.

In 2022, BAE was hired by the UK Foreign Office for urgent data remediation following a cyber security incident. The same year, the US Army awarded BAE a $699 million (£567 million) contract to provide support for its high-performance computing (HPC) supercomputer work.

The firm has profited greatly from Russia’s invasion of Ukraine, both through increased sales of traditional hardware and munitions by Ukraine’s allies as well as through increased investment in cyber defenses by countries in the wake of booming Russian cyber attacks.

BAE’s order backlog now stands at £66.2 billion ($84.63 billion), following £21.1 billion in order intake across H1 2023. This included new and renewed orders on fighting vehicles for the Czech Republic, UK nuclear submarines, and fighter jets for Saudi Arabia.

New data breach reporting rules introduced by the Securities and Exchange Commission (SEC) last week have been described as “worryingly vague” and may create a harmful operating environment for security professionals, according to (ISC)2. 

Tara Wisniewski, EVP for advocacy, global markets, and member engagement at the security non-profit, challenged the new scheme, warning that many aspects of the new framework are open to interpretation. 

While Wisniewski broadly welcomed the changes, she suggested that the announcement could create confusion for professionals in the industry.  

“While we support the fundamental principles of public disclosure to inform and protect shareholders, customers, and other constituents, the SEC ruling is worryingly vague. It poses more questions than answers, and may create ambiguity for cyber professionals.”

Under the new rules, public companies will be held to a higher standard of reporting, with firms required to disclose security incidents within four days. 

The ‘Form 8-K’ requirement means companies will have to report any security incident they deem ‘material’ within this timeframe and provide information on the timing of the attack, its scope, and the potential impact on the business and customers. 

However, the terminology used by the SEC is a point of serious contention for (ISC)2 and could be left “open to interpretation”. 

This, the organization said, could lead to over-reporting of security incidents, placing greater pressure on overworked staff. Similarly, (ISC)2 warned the framework could prompt a trend of under-reporting, which in the long term might leave cyber security practitioners personally liable for incidents. 

As such, the organization called for a clearer definition of what constitutes an incident under the new guidelines. 

“There are no concrete definitions for which cyber incidents must be disclosed, or what the SEC means by ‘material impact’. There are millions of attempts on businesses daily, some unsuccessful, others partially so,” said Wisniewski.

“Without clearer definitions, the rules are open to interpretation which could either lead to over-reporting, distracting cyber professionals from their main task of network protection, or under-reporting, which could expose cyber professionals to personal liability.”

Overburdened security professionals

Another point of contention raised by (ISC)2 centers around new board oversight requirements outlined in the SEC’s recent changes. Under the new rules, businesses will be required to disclose annual reports on their security risks, cyber strategy, and governance practices.

Annual 10-K reports will be required to outline specific measures taken by organizations to identify and mitigate security threats, as well as insights on executive oversight of company security practices. 

Wisniewski said that these new rules “do not go far enough”, adding that the guidelines are ambiguous and could lead to increased pressure on practitioners as executives rely on staff for advice and guidance. 

As a result, the non-profit has called for the establishment of a “more formal framework for board oversight responsibilities”. 

“The ambiguity only creates more burden for overworked and under-staffed cyber security professionals, as boards and corporate leaders will increasingly rely on them for interpretation of the guidance,” she said. 

“So while we support collaborative efforts to protect consumers, the importance of cyber threats and the complexity of management requires very clear guidelines with detailed definitions so cyber professionals do not inadvertently fall afoul of well-intentioned regulation,” Wisniewski added. 

“Cyber professionals are looking for clarity, and this ruling falls short in that regard.”

Deloitte has refuted claims that the Cl0p ransomware gang has breached its systems and stolen client data amid speculation online. 

The accountancy firm was cited as a victim on Cl0p’s breach disclosure blog, sparking concerns that clients at the consultancy could be at risk. 

In its disclosure, Cl0p claimed “the company doesn’t care about its customers” and that it “ignored their security”.

The claims come amid a flurry of breach disclosures from Cl0p in the wake of the MOVEit breach, which so far has affected hundreds of companies globally. 

Last month, the group claimed to have compromised systems at EY and PwC, two of the other ‘Big Four’ accountancy firms. 

At the time of writing, Cl0p still has both companies listed on its blog along with an array of download options for files the cyber criminal outfit claims to have stolen from them.

However, in a statement given to ITPro, Deloitte has denied suggestions that it had suffered a breach off the back of the global security incident. 

A spokesperson for the firm said in the aftermath of the attack it took immediate action to apply security updates according to the vendor’s guidance and has mitigated risks to clients. 

“Immediately upon becoming aware of this zero-day vulnerability, Deloitte applied the vendor’s security updates and performed mitigating actions in accordance with the vendor’s guidance." 

Deloitte also said that it conducted an investigation into the possibility of a breach in the wake of the MOVEit incident, but has thus far determined that no client data has been impacted. 

The spokesperson noted that the firm’s use of the file transfer software was “limited”. 

“Our analysis determined that our global network use of the vulnerable MOVEit Transfer software is limited,” they said. “Having conducted our analysis, we have seen no evidence of impact to client data.”

Deloitte's page on Cl0p's website does not yet feature download links for files. This could indicate that Deloitte's assessment is correct and Cl0p has not managed to access client data.

It could also mean that Cl0p is still waiting to negotiate a payment from Deloitte for any data it was able to steal during an attack. Deloitte said client data is believed to be unaffected but in multiple recent Cl0p-associated incidents, data stolen from victims has concerned internal staff rather than clients.

Cl0p has also been linked with the earlier GoAnywhere breach which saw the Pension Protection Fund also lose data related to current and former staff, but not current members.

MOVEit attack - what happened?

News of the MOVEit attack emerged in late May amid speculation that a zero-day vulnerability in the transfer software had been exploited by threat actors. 

Security researchers at Microsoft quickly identified Cl0p as the group behind the attack, and the incident began to spiral out of control.

Within days, several major organizations globally revealed they had been impacted by the breach, including payroll provider Zellis.

This sparked a series of subsequent breaches at a host of major organizations globally, with the number of victims rising to 513 at the time of writing, according to Emsisoft's figures.

To date, hundreds of organizations spanning a number of industries have been affected by the breach. 

Cl0p has added nearly 50 victims to its list in the last week alone, including Toyota’s European subsidiary and Virgin Pulse. 

The number of women working in the UK cyber security industry has decreased, sparking concerns that efforts to improve diversity in the space are falling flat. 

A report from the UK government on cyber security skills across the labor market found that only 17% of the cyber sector workforce is female, marking a decrease from 22% last year and on par with 2021 and 2020 statistics. 

The study found that just 14% of senior roles are filled by women across the industry, a figure that’s risen steeply since 2021’s result of just 3%, but one that still underlines a clear imbalance of power.

The report noted that the proportion of women in the cyber workforce has remained “broadly consistent” in recent years. The results from 2021, for example, showed that 16% of the cyber workforce was female, indicating only a very small improvement in the space of two years.

“Although there were signs of an upward trend last year, this has not been sustained,” it said. 

The dip in female representation comes at a critical time in the cyber security space, with demand for skills rising steeply in recent years. 

The report said there is an estimated shortfall of 11,200 people in the industry, and while this does mark a dip from 14,100 in 2021, this is largely due to slower growth in the sector. 

Around 50% of all UK businesses were found to have a “basic cyber security skills gap” while one-third (33%) have an “advanced” security skills gap. 

This aligns with previous estimates from 2022 and 2021, and highlights that firms across the country are still contending with an acute skills shortfall amid a period of rising threats. 

An analysis of cyber security job postings in the last year shows that firms are seeking to bolster security-related skills within their workforce.

160,035 job postings were recorded last year, but 37% of these vacancies were reported as “hard to fill” by businesses, the report said. 

What’s being done to improve diversity?

The report noted that businesses are accelerating efforts to improve workforce diversity. 

Nearly half (40%) of cyber firms said they had taken action to “adapt their recruitment processes or carried out specific activities” to attract and encourage applications from diverse groups. 

38% also said they have accelerated efforts to recruit more women and bolster gender diversity within the workforce.

Across all “diverse groups” - which spans women, people from ethnic minority backgrounds, neurodiverse, and physically disabled people - women were “slightly more likely” to have been targeted in recruitment drives.

Amanda Finch, CEO at The Chartered Institute of Information Security (CIISec) said that her organization’s own research shows firms can still do more to attract female talent and encourage women to enter the industry. 

“Often the security industry is stereotyped as something of a ‘boys only club’. CIISec’s latest state of the industry report highlighted the progress the industry still needs to make on this,” she said. 

“38% of organizations have not implemented development programs to attract women to join the profession or promote those already in it, and a further 5% have tried but failed.”

Alternative routes into cyber

Employers also revealed they are exploring alternative routes into the cyber workforce for diverse groups. However, the report noted that this is typically focused on entry-level roles. 

“Hiring through non-degree routes” was identified as a key approach among many, with ‘capture the flag’ tests used to “identify raw talent”. 

Similarly, firms revealed they are also working with third-sector organizations to improve support for diverse groups within the workforce talent pool. 

The average weekly volume of cyber attacks reached a two-year high in the second quarter of 2023 amid a spike in activity among ransomware groups. 

Analysis from Check Point Research (CPR) found that the frequency of attacks increased by 8% in Q2, with organizations globally facing an average of 1,258 attacks each week. 

A key factor in this surge lies in the evolution of “new evasive tactics”, combined with an increase in hacktivist-based attacks and increased ransomware group activity, the firm said. 

Despite a reduction in attacks compared to the year prior, the education and research sector still remained the most-targeted industry during the second quarter, CPR noted. 

The average number of attacks per organization stood at 2,179, although this marked a 6% decrease compared to the same period in 2022. 

UK-based academic institutions have faced a barrage of attacks so far during 2023. In June, the University of Manchester experienced a highly disruptive cyber attack that exposed research data belonging to more than 1.1 million NHS patients. 

The healthcare industry has been a key recurring target for cyber criminals in recent years, with the sector experiencing a significant year-on-year increase in attacks during Q2. 

Organizations operating in the sector faced an average of 1,744 attacks per week, marking a YoY increase of 30%. 

Earlier this month, Barts NHS Trust, which serves more than 2.5 million patients across several hospitals, fell victim to the ALPHV ransomware gang. 

The group claimed to have stolen more than 70 terabytes of data, which it said marks the largest breach of healthcare data in the UK to date. 

Ransomware resurgence raises concerns

A resurgence in activity among high-profile ransomware groups has raised concerns among security researchers in recent months, CPR said. 

Alternative analysis from FlashPoint found that LockBit and Cl0p alone accounted for nearly 40% of all recorded ransomware attacks across June, with nearly half (47.5%) of these directly targeted US-based organizations.  

Both groups have been highly aggressive in recent weeks, with Cl0p claiming responsibility for the devastating MOVEit supply chain attack. 

The file transfer platform is used by thousands of organizations globally, and initially impacted several UK firms including British Airways, Boots, and the BBC. 

This incident prompted a domino effect of incidents worldwide following a breach at HR and payroll provider, Zellis. 

LockBit has also been highly active, claiming responsibility for an attack on a third-party supplier for Taiwanese chipmaker, TSMC. The group listed the chipmaker on its dark web blog and set a ransom at $70 million, marking one of the largest ever. 

Continued threats for healthcare organizations may also raise concerns amid the increase in LockBit attacks highlighted by Flash Point. The ransomware group has traditionally targeted organizations operating in the sector. 

In August last year, the group claimed responsibility for an attack on a French hospital that saw sensitive patient data leaked after its $10 million ransom was refused. 

The observations on the leading ransomware organizations come against a backdrop of rising attacks generally across the industry.

A report published earlier this month noted a 48% year-on-year increase in attacks.

Chainalysis’ annual Crypto Crime report, also published earlier this month, noted that ransomware affiliates have returned to their old habits of targeting larger organizations.

Ransomware criminals have for years switched between targeting organizations of different sizes, with efforts from the past few years thought to have been focused more on smaller firms with comparatively less robust defenses than larger enterprises.

Overlooked vulnerabilities

Running in parallel to a surge in cyber attacks, FlashPoint research highlighted a concerning trend of overlooked or missing vulnerability disclosures in June. 

1,828 new vulnerabilities were reported across the month. However, 395 of these were missed by the Common Vulnerabilities and Exposures (CVE) program. 

More than one-third (35%) of these were rated as high or critical vulnerabilities, which the firm warned is putting organizations at heightened risk. 

“If exploited, these issues could pose a significant security risk”, the firm said in a blog post. 

Taiwanese chipmaker TSMC could be facing one of the largest ransom demands in history amid reports that threat actors have gained access to sensitive company information. 

An affiliate group of LockBit’s ransomware as a service offering, known as National Hazard Agency, claims to have gained access to TSMC network entry points as well as staff login details following a breach at third-party IT supplier Kinmax. 

LockBit has officially listed TSMC on its dark web blog, setting the ransom demand at $70 million. 

The blog listing from LockBit fails to provide additional information on the extent of the data compromised in the breach, nor does it provide samples to confirm what has been stolen. 

LockBit has threatened that “in the case of payment refusal” it will publish stolen information on network entry points, as well as login details. 

In a statement, Kinmax confirmed it had suffered a security breach, revealing that its “internal specific testing environment” had been compromised. 

“The leaked content mainly consisted of system installation preparation that the company provided to our customer as default configurations,” Kinamax said. 

TSMC operations “not affected” by breach

TSMC told ITPro that it was aware that an IT hardware supplier had experienced a security incident, confirming that leaked data pertained to “server initial setup and configuration”. 

However, the Taiwanese semiconductor giant has refuted claims that the attack has impacted its operations, adding that no customer information had been compromised in the breach. 

“This incident has not affected TSMC’s business operations, nor did it compromise any TSMC customer information,” the firm said in a statement. 

Upon discovery of the Kinmax incident, TSMC said it “immediately terminated” its data exchange with the supplier in accordance with company security protocols. 

The firm is also working with law enforcement following the discovery. 

“TSMC remains committed to enhancing the security awareness among its suppliers and making sure they comply with security standards,” the firm said. 

“This cyber security incident is currently under investigation that involves a law enforcement agency.”

This latest LockBit ransom demand marks one of the largest ever from a hacker group, putting it on par with REvil’s infamous demand in the wake of the Kaseya breach. 

The hefty ransom also eclipses previous demands made by LockBit, specifically the Pendragon breach in 2022 that was set at $60 million. 

In March 2021, Acer was targeted by REvil, the group that used to occupy the role of the most prolific ransomware organization, with a ransom set at a maximum $100 million.

The price was originally set at $50 million, a sum that REVil promised to increase sharply if it wasn’t paid quickly.

Security experts have raised concerns about the risks posed to NHS patient data in the wake of the University of Manchester cyber attack. 

A report from the Independent claimed that data belonging to more than one million NHS patients may have been compromised in the June attack. 

Data accessed by threat actors during the incident is believed to pertain to trauma patients and people treated for injuries sustained in terror attacks. 

The data sets, gathered for research purposes by the university, included NHS numbers and the ‘first three letters’ of patients’ postcodes, according to leaked documents seen by the publication. 

The university has since informed NHS England of the data breach, but a notice to the healthcare provider warned that it is still unclear whether affected patients' names have been compromised.  

This prompted the university to issue a warning that there is potential for “NHS data to be made available in the public domain”. 

Similarly, university officials warned that some affected patients may not even know they are on the database as they were not required to provide consent. 

Deryck Mitchelson, field CISO at Check Point and former CISO at NHS National Services Scotland, said the incident should serve as a stark warning over the potential risks of data sharing between private organizations and public services. 

“The questions we need to be asking is why has the university, as a private commercial organization, had access to personal identifiable information from the NHS,” he said. 

“How many other universities have this type of data stored on their own servers?”

Mitchelson said the university must provide clarity on a number of key lingering questions, such as whether the data was obfuscated or de-identified, whether these data sets were segmented from others, and what safeguards the university had in place for the use of research data. 

“Where patient information is being used for research, there should be as much openness and transparency about that use as possible,” he said. 

“All of this opens up far more concerning conversations around data sharing between public and private organizations which needs to be addressed.”

ITPro has approached the University of Manchester for comment on the matter.

University of Manchester attack: What happened?

In early June, the university revealed it had experienced a “cyber incident” and confirmed that some systems had been accessed by an unauthorized third party.  

In the wake of the breach, staff were advised not to download files from university systems in an attempt to back them up.

University officials said that data had “likely been copied” during the breach and the institution was working with authorities to identify the source of the issue. Last week, the university confirmed that data had been stolen. 

The incident was initially believed to be linked to a breach at payroll provider Zellis in the wake of the MOVEit cyber attack. However, the university refuted these claims. 

To date, the university says it is yet to establish the identity of the threat actor or actors behind the attack. 

In recent weeks, students and staff members at the university have complained that they have received emails from the culprits threatening to sell or leak their personal data unless a ransom is not paid. 

Security experts have called for improvements in how private sector organizations share threat intelligence data with the wider industry.

It’s believed that better cross-organizational collaboration would improve cyber resiliency in the face of cyber attacks that continue to rise in frequency and develop ever more sophisticated.

“I think this is one of the ways in which the private sector can work with governments around the world, and each other across sectors, industries, and regions,” said Jen Ellis, co-chair at the Institute for Science and Technology’s Ransomware Task Force.

Government agencies such as the UK’s Information Commissioner’s Office (ICO) or the US’ Cybersecurity and Infrastructure Security Agency (CISA) enforce strict reporting deadlines around data breaches, but companies often report the minimum required information.

The designated cyber security authorities in the UK and US enforce strict reporting deadlines around data breaches and this is seen as a positive step. 

However, victims often report the minimum required information which in turn reduces other organizations’ ability to learn from, and potentially prevent, follow-on attacks.

The panel spoke at Infosecurity Europe 2023, discussing the topic of a so-called ‘catastrophic cyber storm’ that businesses currently face.

Nick Prescot, CISO at Norgine B.V, noted that there already is a great deal of information sharing in the industry, but much of the information is shared through private channels and the public’s perception of that exchange is limited.

“It’s easy to say that we can talk to everyone and every organization can talk to each other,” said Cedric Mallia, CISO at Play’n GO.

“In practice, that’s way more complex, because sometimes you have to share information with your competitors or with entities that could use that information to extrapolate things you don’t want them to.”

Mallia also noted that sometimes data shared can give an inaccurate picture of how an attack was carried out or handled.

“It is nearly a legal issue to know what to say, without giving away information that you don’t wish others to know. And that makes it very, very difficult.”

Some smaller organizations may currently lack the relevant resources or knowledge to react to an attack in the best way and could benefit from data sharing with larger organizations, particularly those that have weathered similar attacks.

But many fear exposing proprietary information by being too open around attacks, and security teams may be concerned that public insight into defensive strategies could open them up to further attacks down the line.

Dr. Fene Osakwe, group head of digital and technology assurance at the Wellcome Trust, suggested that legislation or guidelines could be drawn up for what data to share.

“It’s difficult to share without a framework that governs what is allowed to be shared, and what exactly is being classified as intelligence,” he said.

“I think that it’s important for a trusted, independent party whether it’s the government or an NGO, to create that framework that states under what conditions, how, and with who information will be shared and what it will be used for.”

Osakwe further suggested that it should be the responsibility of executives, rather than security teams, to ensure that these channels of communication are maintained.

“Arrogance” to try to avoid the storm

Mallia branded the attitude of some companies “arrogance”, and argued that those that still believe they can avoid becoming involved in the current threat landscape altogether could cause their own downfall.

“It is a storm at the end of the day, but we have the ability and knowledge to weather it out,” he continued. 

“Those who are resilient will come out the other side.”

For many businesses, the ‘storm’ of cyber attacks has arrived in full force. Cyber attacks on UK organizations rose 77% in 2022, and new ransomware strains like Rorschach continue to raise the threat ceiling.

International police forces have set their sights on LockBit, the notorious ransomware as a service operator, but attempts to stamp out threats continue to play second fiddle to defensive and remediation efforts.

The panelists urged attendees to consider their security contingencies, as attacks are bound to occur but businesses are made or broken by their preparedness to quickly recover.

“It’s about making it harder for attackers, every time,” said Ellis.

“It’s about raising that bar, making it more expensive and inconvenient for them. We’re never going to be this mythical thing of ‘secure’, but we can continue to make progress.”

Geopolitical awareness needed

All panelists made the case for companies to heighten awareness of the worldwide cyber security and geopolitical landscape to improve their threat posture.

“People think that the ‘big bad countries’ are going to flyswat small countries,” said Prescot.

“But with cyber it’s different, it’s very asymmetric,” he said, and cited Cl0p’s MOVEit supply chain attack as a recent example of the kind of smaller, possibly state-backed groups with which companies are having to contend.

Osakwe gave the example of an African company with whom he had worked, which was targeted by a politically-motivated cyber attack based on a rumor that it had worked with an opposition party.

“When that information came, it gave the security team a lot more perspective of what to do,” said Osakwe.

Data belonging to Toyota customers in Asia and Oceania may have been “publicly accessible” between October 2016 and May 2023 due to a cloud misconfiguration, the company has revealed. 

In an advisory, the car manufacturer revealed exposed data includes names, addresses, phone numbers, email addresses, vehicle identification numbers, and registration details.

Critical data, such as credit card information, was not exposed in the leak, the manufacturer insisted.

Toyota said the leak was caused by a cloud misconfiguration as a result of human error, adding that the flaw has since been remediated. 

“Some of the files that TC (Toyota Connected Corporation) manages in the cloud environment for overseas dealers' maintenance and investigation of systems were potentially accessible externally due to a misconfiguration,” the company said in a statement. 

“After this matter was discovered, we took steps to block access from outside the company.”

Toyota did not disclose the exact number of customers affected. It also said a preliminary investigation found no evidence any of the exposed data had been accessed or maliciously exploited. 

“We have also investigated whether, with this incident, there was any secondary use or if third-party copies remain on the internet, and no evidence of such has been found. At present, we have not confirmed any secondary damage,” it said.

Recurring Toyota data leaks

This latest disclosure follows an investigation into a similar data leak in early May in which data belonging to more than 2.15 million customers in Japan was left accessible for nearly a decade. 

At the time, Toyota said a worker at the firm was believed to have set a cloud system’s access level to ‘public’ instead of ‘private’, meaning that data pertaining to vehicle locations and identification numbers was exposed. 

This incident sparked a probe at the car manufacturer to improve monitoring of its internal systems and bolster employee data protection practices. Toyota said it has since introduced new rules and processes to monitor cloud configurations across its global operations. 

“As we believe that this incident also was caused by insufficient dissemination and enforcement of data handling rules, since our last announcement, we have implemented a system to monitor cloud configuration,” the company revealed. 

“Currently, the system is in operation to check the settings of all cloud environments and to monitor the settings on an ongoing basis. In addition, we will work closely again with TC to explain and thoroughly enforce the rules for data handling.”

This is also the third data breach of its kind in the space of a year for Toyota. In October 2022, the manufacturer revealed that data belonging to nearly 300,000 customers was exposed online. 

An access key was found to have been left publicly available on GitHub for nearly five years. This particular incident affected Toyota’s T-Connect service and allowed access to a server containing customer email addresses. 

The incident prompted Toyota to warn customers that they could face an onslaught of phishing threats in the wake of the leak.

The Data Protection Act 2018 (DPA 2018), designed to update existing data protection laws and regulations, came into force on 23 May 2018 as the third generation of the UK's data protection environment.

Based on the EU's General Data Protection Regulation (GDPR), the DPA 2018 is designed to consider advancements in data use in the modern age and how personal information is collected by online platforms for various legitimate and illegitimate purposes.

The DPA 2018 was introduced to replace the earlier Data Protection Act 1998. It outlines the legal extent to which data can be collected, processed, and used within the UK and sets out several penalties for those who breach these laws. More specifically, the framework laid out by the DPA 2018 governs the steps businesses and individuals must take when handling data. It also provides data owners, known as data subjects, with a clear guideline for their rights and protections concerning personal information.

The DPA 2018 was required in order for the UK to maintain a similar level of data protections to that of the EU - known as adequacy status. This allows the UK to process data owned by EU citizens. However, the DPA 2018 adds to and goes beyond the rules of GDPR. Instead of just copying GDPR into UK law, the DPA 2018 included the EU Law Enforcement Directive, which protects data used by the police and other law enforcement agencies.

Why do we need DPA 2018 when we have GDPR?

Although there are similarities between the two, the DPA 2018 and the EU's GDPR differ in several key areas:

When it came into force, GDPR automatically applied to all EU member states but allowed individual nations to create their own provisions to extend their reach depending on their particular needs. This flexibility enabled member states to implement data protection laws that complemented their existing regulations.

Most of the UK's data processing was governed by GDPR until Brexit, though a few regulatory issues were specific to the UK and handled only by domestic laws. Examples include immigration issues and processing freedom of information (FOI) data. The DPA 2018 also includes several national security exemptions. While GDPR sets a broad framework for data protection across the EU, it allows individual member states to tailor specific provisions to fit national contexts. The DPA 2018 addresses data protection needs and issues unique to the UK.

Also, the DPA 2018 integrates and updates the UK's previous data protection laws, ensuring they are compatible with GDPR while addressing purely domestic concerns. This includes exemptions and rules specific to the UK's regulatory environment. The DPA 2018 provides clear legal guidelines and enforcement mechanisms within the UK context. It defines the roles and responsibilities of the Information Commissioner's Office (ICO) and sets out penalties for non-compliance, thereby ensuring robust data protection enforcement within the UK.

For example, under the DPA 2018, the Home Office and other organisations processing immigration data can reject access requests to personal data if they believe it could harm "effective immigration control".

However, this exemption faced challenges from human and digital rights campaigners. The Open Rights Group and the3million launched a legal challenge in January 2019, arguing that the immigration data exemption was unlawful. The High Court ultimately rejected this challenge in October 2019.

The DPA 2018 also includes provisions not directly applied to GDPR in UK law. For instance, the legal age for consent to process personal data is 16 under GDPR, but in the UK, it is 13. Additionally, the DPA 2018 allows for automated decision-making or profiling on legitimate grounds with appropriate safeguards, while GDPR ensures individuals have the right to avoid such processes.

Brexit

Despite voting to leave the EU in 2016, the UK remained bound by EU legislation, including GDPR, until 31 January 2020. GDPR was incorporated into UK law via the European Union (Withdrawal) Act 2018. The DPA 2018 ensures the smooth flow of data from the EU to the UK post-Brexit. After leaving the EU on 31 January 2020, the UK entered a transition period, during which agreements on data adequacy were to be formalised. This agreement confirmed that UK laws provided adequate data protection.

Any organisation with customers in the EU must adhere to GDPR rules, regardless of the UK's EU membership status. Therefore, having domestic policies aligned with GDPR benefits companies by allowing them to comply with UK and EU data handling requirements without conflicting systems.

On 19 February 2021, the EU Commission published its draft adequacy decision, confirming that UK law was adequate for data transfers without additional safeguards. The EU Commission formally declared on 28 June 2021 that the UK ensures sufficient data protection for personal data transferred under GDPR from the EU to the UK.

This ruling is expected to last until June 2025, with a decision in 2024 on whether to extend it for another four years. However, it does not apply to data transferred to the UK for immigration-related issues, which have different requirements. At the moment, the House of Lords European Affairs Committee, chaired by Lord Ricketts, is considering the extension, with Lord Ricketts stating:

"The free flow of data between the UK and EU is vital for trade and economic relations, and for effective law enforcement cooperation. Currently, the transfer of commercial and criminal investigation data is based on an EU adequacy decision which expires next year. Without it, maintaining data flows between the UK and the EU could become less straightforward for businesses and, therefore, have an impact on the UK economy. It could also have an impact on UK-EU security cooperation as it could lead to restrictions on the flow of data for law enforcement purposes between the UK and the EU."

Ricketts concluded: "My Committee has therefore decided to examine the way the current arrangement works, the factors that will influence a future data adequacy decision, and the implications should that decision be negative. The Committee encourages anyone with expertise in or experience of the matters under consideration in this inquiry to submit written evidence. The wider the range of evidence we receive, the more firmly based will be our conclusions."

Efforts to reform GDPR

The previous Conservative government had indicated that the GDPR may be partially or entirely replaced with new data protection legislation. On 8 March 2023, the government presented the latest version of the UK Data Protection and Digital Information Bill No.2, designed to alleviate the cost and administrative burden businesses in the UK feel complying with GDPR as it stands today in UK law.

Also, the Bill has components to govern and regulate artificial intelligence (AI), which was not a distinct part of GDPR when it came into force. The UK's new version of GDPR also connects to the Artificial Intelligence (Regulation) Bill, which was designed to define the secure application of these burgeoning systems that will impact every business process, including how workforces use tools like Generative AI.

Speaking at the time, then Conservative Secretary of State for Digital, culture, media and Sport (DCMS) Michelle Donelan, said: "Our plan will protect consumer privacy and keep their data safe whilst retaining our data adequacy, so that businesses can trade freely. Our new data protection plan will focus on growth, on common sense, on helping to prevent losses from cyberattacks and data breaches, while also protecting data privacy."

Julian David, TechUK CEO, also commented: "TechUK welcomes the new, targeted package of reforms to the UK's data protection laws, which builds on ambitions to bring organisations clarity and flexibility when using personal data. The changes announced today will give companies greater legal confidence to conduct research, deliver basic business services and develop new technologies such as AI, while retaining levels of data protection in line with the highest global standards, including data adequacy with the EU."

The current Information Commissioner has also stated: "I welcome the reintroduction of the Data Protection and Digital Information Bill and support its ambition to enable organisations to grow and innovate whilst maintaining high standards of data protection rights. Data protection law needs to give people the confidence to share information to use the products and services that power our economy and society. The Bill will ensure my office can continue to operate as a trusted, fair and independent regulator. We look forward to continuing to work constructively with the government to monitor how these reforms are expressed in the Bill as it continues its journey through Parliament."

There is little doubt that a new form of GDPR will be enacted into UK law to reflect how businesses collect and manipulate data. The final draft of the Bill is expected in 2025. The new Act will give organisations more control over the data they collect and move the regulations away from the top-down, prescriptive approach that GDPR currently takes and reflects what can be unique ways data is collected, manipulated and shared today.

For more information on the various ways in which leaving the EU effects GDPR, head to our GDPR and Brexit in-depth guide.

Definition of personal data under DPA 2018

The ICO defines personal data as: "any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

Personal data comprises anything that may be used to identify an individual and has even extended to include details such as a person's IP address in modern times.

What has changed since the DPA 1998

The latest legislation is designed to bring data protection to modern standards in light of the growth of massive internet companies and how data is collected, processed, and monetised in gigantic quantities. The DPA 2018 introduced far more protections for citizens and improved the protections and rights initially outlined in the legislations previous iteration.

Under the new regime, organisations are required to be more transparent about how and why they handle, collect, and process the data – much of this about their customers’ behavior. Data collection can only happen if an entity has an explicit and legitimate reason to do so.

Businesses must also consider several conditions when processing data, including:

• the data subject's consent
• legal obligation
• contractual obligations
• public interest
• vital interest
• and legitimate interests

One of the most significant changes has been in the way consent is viewed in the eyes of the law, with the threshold for consent raised significantly. Under the DPA 2018, user consent must be explicit for data processing about specifically outlined purposes, as opposed to blanket consent, as was sought previously.

More significant requirements have also been put on organisations to keep data accurate and up-to-date and immediately remove anything from inaccurate systems on request when such issues are flagged.

Processing data, meanwhile, is now limited entirely to the specific purposes for which it was collected, which differs from how organizations interpreted provisions in the 1998 DPA. Previously, companies could process data in any way provided it wasn't "excessive" to the original purpose.

How the Data Protection Act structured?

The DPA 2018 enforces four distinct data protection frameworks, each relating to a specific category of data processing.

• Within the scope of GDPR
• Outside the scope of GDPR
• By competent authorities for law enforcement purposes
• By the intelligence services

The Act is also split into seven parts, each containing multiple schedules. Following an introductory section and critical terms, Part 2 covers various aspects of the general processing of personal data, Part 3 covers law enforcement, Part 4 relates to intelligence service processing, Part 5 covers the powers of the Information Commissioner's Office (ICO), Part 6 outlines the scope of enforcement powers, and Part 7 covers additional provisions that do not fall under the previous categories.

Special provisions are set out for law enforcement processing, including the processing of personal data by the police, prosecutors, and similar criminal justice bodies. Similar provisions exist for processing by intelligence services, which aim to bring UK standards in line with international standards. The frameworks also ensure the smooth flow of data internationally to tackle crime while ensuring data protection is upheld.

Fines for breaching the Data Protection Act 2018

Like GDPR fines, the DPA 2018 gives the ICO the power to levy far tougher fines than anything seen in the past. Under the 1998 Act, the maximum possible fine was £500,000.

Under the DPA 2018, serious breaches of the data protection principles, or failing to report a data breach within 72 hours, can result in a fine of up to £17.5 million or 4% of your annual worldwide turnover, whichever is higher.

It remains to be seen how the UK Data Protection and Digital Information Bill No.2 will continue to evolve. What is clear is that the UK government is set on a trajectory to change the current implementation of GDPR and how this relates to DPA 2018.