The Stack

A data sugar rush is giving digital leaders a “data metabolism” challenge 
Enterprise IT
Featured
Read This
data metabolism
DXC Technology
sugar

A data sugar rush is giving digital leaders a “data metabolism” challenge 

Data, says Mohammed ‘Khal’ Khalid, “behaves a bit like sugar.” It’s an unusual simile, but the DXC Technology advisory director says his team’s conversations with Chief Information Officers and Chief Data Officers show that organisations are “experiencing a crisis in decision making exacerbated by an inability to metabolise...
The Stack
Novel cloud attack pivoted from K8s to Lambda, pulled IAM keys from Terraform
Cybersecurity
Featured
Read This
cloud security
containers
Kubernetes
Sysdig

Novel cloud attack pivoted from K8s to Lambda, pulled IAM keys from Terraform

A recent attack tracked by researchers at cloud security company Sysdig saw the attackers use an exposed Kubernetes container to move laterally to the victim’s AWS account – gaining initial access by exploiting a public-facing service in a self-managed Kubernetes cluster hosted inside an AWS cloud account. The company'...
The Stack
New "Venture Science Doctorate" aims to turbocharge climate-tech, life-sciences startups
Enterprise IT
Featured
innovation
research
spinoffs
study
university
Venture Science Doctorate

New "Venture Science Doctorate" aims to turbocharge climate-tech, life-sciences startups

A unique new Venture Science Doctorate (VSD) has started taking candidate applications. The unique doctorate was set up by UK venture creator Deep Science Ventures – which has already generated a portfolio of 35 science-based companies, worth upwards of £250 million – and is explicitly venture-focused. The three-year doctorate is fully funded...
The Stack
22,600+ emails = 599 vulnerabilities. Security disclosure triage is HARD
Cybersecurity
Featured
Read This
Apache Software Foundation
CVEs
open source
security research

22,600+ emails = 599 vulnerabilities. Security disclosure triage is HARD

Security researchers regularly chafe at the deafening silence when they report a critical vulnerability in software: White Hats simply wanting to help organisations fix their cybersecurity all too often still find themselves being ignored – or worse, threatened with legal action when trying to help publicly exposed organisations that have not...
The Stack
FAA outage triggered by “damaged database file” -- after agency warned on old hardware
Featured
Read This
Three Feature Slider
aviation
FAA
legacy IT
Outages
technical debt

FAA outage triggered by “damaged database file” -- after agency warned on old hardware

A serious IT outage at the Federal Aviation Authority (FAA) which forced it to halt all US departing flights on Wednesday 11 has been attributed by the transportation agency to a “damaged database file” “At this time, there is no evidence of a cyber attack. The FAA is working diligently...
The Stack
AWS's new SimSpace Weaver product provides dedicated infrastructure, SDK for immersive spaces modelling
Cloud
AWS
ReInvent
SimSpace Weaver

AWS's new SimSpace Weaver product provides dedicated infrastructure, SDK for immersive spaces modelling

Amazon has released a new fully managed service called AWS SimSpace Weaver – designed to help customers create “dynamic, 3D experiments to understand possible real-world outcomes and visualize and train in immersive spaces” or conduct experiments that closely approximate real-world systems locally or in the cloud. By providing a dedicated compute...
The Stack
A mystery threat actor is running an "abnormally" large freejacking campaign that taps GitHub, Heroku to mine crypto
Cybersecurity

A mystery threat actor is running an "abnormally" large freejacking campaign that taps GitHub, Heroku to mine crypto

Security researchers at Sysdig say that they have identified a previously unreported threat actor “using some of the largest cloud and continuous integration and deployment (CI/CD) service providers” in a massive “freejacking” campaign that makes use of trial accounts’ free compute to power cryptomining campaigns. Dubbing it PURPLEURCHIN, Sysdig...
The Stack
This Azure bug is a perfect CVSS 10, gives you control over K8s clusters
Cloud
Cybersecurity
Azure
Kubernetes
Patch Tuesday
vulnerabilities

This Azure bug is a perfect CVSS 10, gives you control over K8s clusters

A critical vulnerability in an Azure tool that lets users manage Kubernetes clusters can be exploited remotely without authentication to gain administrative control over Kubernetes clusters, as well as Azure edge devices. The vulnerability, allocated a maximum possible CVSS (severity rating) score of 10 has been allocated CVE-2022-37968. It is...
The Stack
Deutsche Bank turns to a known quantity as digital shakeup continues
Enterprise IT
Featured
Read This
Banking
Deutsche Bank
digital transformation
Kyndryl

Deutsche Bank turns to a known quantity as digital shakeup continues

Deutsche Bank has extended a contract with Kyndryl (previously IBM Infrastructure Services) to run its continental European core banking and mission critical IT infrastructures, in what the two described as one of the “largest and longest-running vendor contracts in the financial industry” at nearly 20 years together. Kyndryl will also...
The Stack
Uber hacker claims access to its internal AWS, SentinelOne, VMware: Is FIDO2 the answer?
Cybersecurity
Featured
Read This
data breaches
FIDO2
hackers
Uber

Uber hacker claims access to its internal AWS, SentinelOne, VMware: Is FIDO2 the answer?

Uber has confirmed that it is investigating a cybersecurity incident. After an initial breach the Uber hacker claims to have found an internal network share that contained Powershell scripts with privileged credentials that let them easily pivot to compromising Uber’s Duo (authentication), OneLogin, AWS, and GSuite environments. "One...
The Stack
Azure rolls out Ampere Arm-based VMs, touting large energy efficiency, performance gains
Cloud
Featured
Read This
Ampere
Azure
CPU
semiconductors

Azure rolls out Ampere Arm-based VMs, touting large energy efficiency, performance gains

Microsoft has joined Oracle and Google in now offering Ampere Altra Arm-based VMs to customers. Microsoft Azure Virtual Machines (VMs) running on Arm-based processors are Generally Available (GA) as of September 1, with the VMs "engineered to efficiently run scale-out, cloud-native workloads" Microsoft said. Pricing varies depending on...
The Stack
Hackers are proxying your Azure Active Directory login to bypass MFA
Cybersecurity
Featured
active directory
AiTM
MFA
Microsoft

Hackers are proxying your Azure Active Directory login to bypass MFA

Hackers proxied the Azure Active Directory (Azure AD) sign-in pages of thousands of organisations to steal credentials and bypass multi-factor authentication (MFA), Microsoft has warned, saying it tracked attempts against 10,000 organisations since September 2021 – many attacks resulting in successful follow-up business email compromise (BEC) campaigns (sophisticated phishing that...
The Stack
Down in the Goldman Sachs IT engine room, old school and open source rub shoulders
Enterprise IT
Featured
Read This
Analytics
databases
engineering
Goldman Sachs
HAProxy
Sybase

Down in the Goldman Sachs IT engine room, old school and open source rub shoulders

Goldman Sachs may have over $2 trillion in assets under supervision. But in its IT engine room, like many large organisations, the investment bank relies heavily on free and open source software (OSS) as well as some aging yet still widely deployed commercial databases -- including to help it serve...
The Stack
Interview: Insurance group Markerstudy's Head of Group IT Adam Miller
Featured
Leadership
Read This
Citrix
IGEL
insurance
Markerstudy
Thin Clients
vdi
Interviews

Interview: Insurance group Markerstudy's Head of Group IT Adam Miller

Some of the toughest challenges in IT can emerge around acquisitions. And insurance group Markerstudy has been acquisitive. In 2020, it bought the Co-op’s insurance underwriting business, making it the UK’s sixth largest motor insurance provider. In April 2021, it purchased Brightside Insurance. In January 2022, it acquired...
The Stack
BitLocker used to attack servers in "intrusion with almost no malware"
Cybersecurity
Featured
Read This
bitlocker
hackers
Microsoft
ransomware

BitLocker used to attack servers in "intrusion with almost no malware"

Hackers breached an organisation running on-premises Microsoft Exchange servers and after moving laterally proceeded to encrypt systems domain wide, using Microsoft's own BitLocker tool rather than malware associated with a Ransomware-as-a-Service group, analysts writing for The DFIR report said Monday. Dubbing it an "intrusion with almost no...
The Stack
New apps, new cloud data warehouse, new everything: consumer finance watchdog wants a little IT support...
Read This
contracts
IT support
public sector
tenders

New apps, new cloud data warehouse, new everything: consumer finance watchdog wants a little IT support...

The UK's Financial Ombudsman Service -- which handles complaints from consumers about financial services ranging from wedding insurance to business loans  -- is in the market for a new managed IT services provider, as it continues a major modernisation project including the replacement of its on-premises data warehouse...
The Stack