52 articles · 2021 · page 1 of 3
Articles
Week of 27 December 2021
Why good-faith estimates weighed most on the therapist’s office
From January 1, 2022, every state-licensed provider owed uninsured and self-pay patients a written price estimate before scheduled care. Hospitals had billing teams to absorb it. Therapists and small practices, where self-pay is common and treatment has no fixed end, mostly did not.
Week of 20 December 2021
Oracle bought Cerner, and Cerner customers inherited a cloud strategy
Oracle’s December 2021 deal to buy Cerner gave hospitals running Cerner’s records a new owner with its own database, cloud and priorities. What mattered next was roadmap, hosting and contract terms, and when to act on each.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
In December 2021, ransomware knocked a cloud timekeeping service used by cities, transit agencies and public hospitals offline for weeks. The vendor had to rebuild its platform. Each employer still had to pay its people correctly, keep the time record and honor the law.
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw of December 2021 was easy to exploit and easy to fix. The real crisis was finding it, and that hunt looked very different for software an organization builds, software it buys and software it rents as a service.
Week of 29 November 2021
Inflation’s first casualty in bank IT was the change budget
Bank and credit union technology budgets took an inflation squeeze after the Fed dropped “transitory” in late November 2021. Running costs rose on their own through contracts, wages and usage pricing, and modernization money paid the difference.
Week of 22 November 2021
Omicron’s scarcest resource was staff, and few hospitals could count them in real time
When Omicron arrived in late November 2021, hospitals braced for a flood of patients. What actually ran out that winter was staff able to work, and every hard decision hinged on how fast leaders could piece together who was available from scattered systems.
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s $1 billion cybersecurity grant came with a local share that rose every year. That forced states and localities to decide early what they would keep paying for once the federal money stopped.
Week of 8 November 2021
Robinhood’s phone-call breach argues for support access sized to one customer
In November 2021, one phone call to one support employee gave an attacker reach into millions of Robinhood customer records. The fix lives in three places: the person on the phone, the tools on their screen, and what customers are taught to trust.
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
In November 2021, CISA stopped asking federal agencies to chase every scary-sounding flaw and handed them a short list of the ones attackers were actually using, with a deadline. The real story is what that did to patch teams, system owners and asset inventories.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
In October 2021 the FTC gave mortgage brokers, auto dealers, finance companies and tax preparers specific, bank-style security rules. The bigger shift was who answers for them: one named person, a written report to the board, and proof the program works.
Week of 18 October 2021
BlackMatter’s reach was set by the directory, not the malware
The October 2021 BlackMatter advisory described an unglamorous attack: intruders walked in with stolen passwords and simply asked the company directory where everything was. How far one login could travel had been decided years earlier, by how access was designed.
Week of 11 October 2021
FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
In October 2021, FinCEN used banks’ suspicious activity reports to sketch the money trail behind ransomware. It worked only where filers had recorded details like wallet addresses clearly. That same choice decides how useful the data is inside the bank.
Week of 4 October 2021
Why a security attestation to government now carries fraud risk
In October 2021 the Justice Department said it would use a fraud law against contractors and grantees whose security promises outran their practice. Overnight, a signature on a security form became a personal and financial risk for whoever signed it.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
On September 30, 2021, a widely used root certificate expired. The websites were fine; the old software talking to them broke. In hospitals, the trouble hid in devices and integrations whose trust lists nobody owned or even knew about.
Week of 20 September 2021
What sanctioning SUEX changed for banks that serve crypto firms
Treasury’s September 2021 sanctions on the crypto exchange SUEX went after the place where ransom money gets cashed out. Because SUEX hid inside other exchanges, banks serving crypto businesses had to decide how deep to look, and what that would cost.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
In September 2021 the FTC said a health app that shares users’ data without permission has suffered a breach. That moved breach prevention out of the security team and into three business decisions: what code ships, what partners receive, what users agreed to.
Week of 6 September 2021
Vaccination status was the easy record; exemptions were the hard one
President Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. It demanded three things: status records, weekly testing and exemption decisions. The third carried the lasting legal risk, and most organizations built it last and least.
Week of 30 August 2021
Hurricane Ida and the IT dependencies that sit under the EHR
Hurricane Ida knocked out Louisiana’s grid and phone networks, and hospitals ran on generators for days. The week tested three layers hidden beneath the electronic health record, each owned by a different team: power, connectivity and hosting.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
In August 2021, big companies pledged at the White House to train hundreds of thousands of people in cybersecurity. For public agencies, the talent shortage had three parts: supply, access and retention. The pledges tackled the first. Agencies held the keys to the other two.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to keep data inside China. Storing it there was the easy half. Personal information still left through three routes no data center map shows: copies, remote views and the reports built from it.