52 articles · 2020 · page 2 of 3
Articles
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
NIST’s zero trust guide is remembered for its diagrams. Its real legacy was a less visible list of things an agency has to know about itself first: its devices, its people, its data and its signals. No vendor could sell those.
Week of 3 August 2020
Capital One’s cloud penalty was a verdict on sequencing
The $80 million penalty against Capital One judged a bank that moved critical systems faster than it could describe, test and watch the risks it was taking on. It passed no verdict on the cloud itself.
Week of 27 July 2020
Lifespan’s stolen laptop and the home office risk analyses missed
A laptop stolen from an employee’s car cost Lifespan $1,040,000. The July 2020 settlement turned on missing encryption, a weak device inventory and absent agreements, landing just as health care’s office staff moved home, beyond the reach of risk analyses written for hospital buildings.
Week of 20 July 2020
The control system map most operators did not have
On July 23, 2020, the NSA and CISA urged immediate action to protect the systems that run pumps, chillers and power. Their first and hardest request was an accurate map of what was actually connected, something few utilities, hospitals or data center operators had.
Week of 13 July 2020
Schrems II and the case for deciding where data lives first
On July 16, 2020, Europe’s highest court struck down Privacy Shield and made the remaining contracts depend on case-by-case checks. Organizations that first decided where their data lived, and who held the keys, found the paperwork easier and rode out later swings in the law.
Week of 6 July 2020
Why hospital COVID reporting turned out to be infrastructure
In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and use a new HHS route instead. The switch revealed reporting as real infrastructure, and hospitals still counting by hand paid for every change.
Week of 29 June 2020
Why Form CRS was the easy part of Regulation Best Interest
On June 30, 2020, brokers became bound to act in their retail customers’ best interest. Writing the plain-language summary, Form CRS, was the manageable part. Proving each recommendation met the standard, and that conflicts were controlled, took data most firms never captured.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center files through the breach of one small web firm. Each agency had weighed its own modest contract; nobody had weighed the shared platform, the archive piling up on it or everyone who could log in.
Week of 15 June 2020
What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, yet €1.9 billion of its cash probably never existed. Its partners learned that three checks cannot be handed to anyone else: where the money comes from, whether customer funds are visible, and how to leave.
Week of 8 June 2020
When vendors set facial recognition policy before agencies did
Within days in June 2020, IBM, Amazon and Microsoft stepped back from selling facial recognition to police. Agencies discovered their suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.
Week of 1 June 2020
UCSF’s ransom decision was shaped long before the attack
Ransomware hit servers at UCSF’s School of Medicine in June 2020, and the university chose to pay. The decision looked like a crisis call but was largely settled in advance, by backups, where data lived, insurance terms and which advisers were already on retainer.
Week of 25 May 2020
Why valid when made left bank-fintech lenders two open questions
The OCC’s May 29, 2020, rule said a national bank loan’s permissible interest survives its sale. That settled one big question for bank-fintech lending. Two harder ones remained: who is really the lender, and can the bank prove it is in charge?
Week of 18 May 2020
Small-dollar loans, alternative data and the governance attached
In May 2020, four federal regulators invited banks and credit unions back into small loans and welcomed new data and technology for deciding who qualifies. Using bank-account data well took consented data access, careful model oversight and fair lending controls for automated decisions.
Week of 11 May 2020
Every unemployment fraud control had a cost to real claimants
In May 2020, federal warnings about organized fraud against state unemployment systems pushed agencies to add identity checks to services already buckling under demand. Wherever they placed those checks, at application, before payment or after, someone legitimate paid part of the price.
Week of 4 May 2020
Password spraying against research labs: an old attack on a new target
In May 2020, US and UK cyber agencies warned that state-backed hackers were guessing common passwords across health and research organizations to reach COVID-19 work. The defenses were familiar; applying them across academic medicine’s tangle of accounts, data and remote access was harder.
Week of 27 April 2020
For many Medicare patients, telehealth meant a phone call
Pandemic telehealth is remembered as video. For many older, rural and low-income Medicare patients it was a phone call, and a CMS rule on April 30, 2020, paid for those calls like office visits. Health systems then had to run the phone properly.
Week of 20 April 2020
Zoom 5.0 fixed the vendor layer; configuration and records stayed yours
Zoom 5.0, released in April 2020, fixed real problems in its own product. For banks, hospitals and agencies, the bigger risks lived in two places no vendor could fix for them: how the tool was set up, and what its meetings left behind.
Week of 13 April 2020
Why exposure notification apps rose or fell on the back office
Apple and Google settled the privacy design of exposure notification for health agencies. Whether an app helped came down to what agencies controlled: how fast positive tests produced codes, what alerts told people to do, and getting residents to switch it on.
Week of 6 April 2020
Paycheck Protection: capital was easy, intake was hard
The Paycheck Protection Program opened on April 3, 2020, with a federal guarantee and a Fed facility taking care of the money. What limited lenders was taking in, checking and submitting applications, and how fast they could turn staff into an assembly line.
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
On March 30, 2020, Medicare’s waivers let care move into tents, surgery centers, new hands and video screens. Every claim and medical record still had to say where, by whom and how, and the systems recording those facts assumed the old answers.