52 articles · 2021 · page 3 of 3
Articles
Week of 22 March 2021
Each Archegos lender already held enough data to act
Archegos is usually told as a story of bets hidden across many banks. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again ranked business email compromise as the costliest kind of online fraud. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 8 March 2021
One-time money, recurring bills: the Rescue Plan’s technology hangover
The American Rescue Plan handed state and local governments $350 billion of flexible, temporary money. Where it paid for technology subscriptions, the risk hid in three places: the shape of the funds, the shape of the costs, and contracts signed in a hurry.
Week of 1 March 2021
ProxyLogon: the patch was the easy part
Hidden flaws in Microsoft’s email server software set off a race to patch in March 2021. For public agencies, the damage was decided by three gaps no patch could close: seeing what faced the internet, hunting intruders, and owning the retirement decision.
Week of 22 February 2021
A few hours without Fedwire, and the bank promises with no fallback
Little lasting harm came of the Federal Reserve’s February 24, 2021 outage. It still revealed how few banks had mapped which customer promises rest on a single central payment rail, rehearsed the narrow manual alternatives, or planned for the backlog afterward.
Week of 15 February 2021
Why working from home failed when Texas froze
A year into the pandemic, many continuity plans answered every site outage with “work from home.” Winter Storm Uri took out power, water, roads and home internet together, showing that one fallback fails when people, sites, networks and suppliers all fail at once.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that tells the two apart, safeguards that work whoever is at the controls, and public statements that survive revision.
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached government agencies through an aging file transfer appliance few senior officials could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern kept returning through other products for years.
Week of 25 January 2021
GameStop’s buy button was switched off in the clearinghouse
Retail brokers stopped customers buying GameStop on January 28, 2021, for reasons buried deep in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app work as one system, even though three different teams own them.
Week of 18 January 2021
Vaccine access hinged on open appointments nobody could see
Vaccine eligibility widened in January 2021 faster than states could show where doses were. Booking failed less because of web traffic than because of three ownership gaps: eligibility rules, appointments held in partners’ systems, and phone and community help treated as overflow.
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
On paper, the banking agencies’ proposed incident notification rule was a simple deadline. The harder work came before the clock started: a named person deciding what counts as a material disruption, and vendor warnings that reach that person in time.
Week of 4 January 2021
Credit for security practice, payable only in arrears
Signed on January 5, 2021, a short HITECH amendment told regulators to go easier on breached organizations with recognized security practices. The catch: it takes a year of practice already running, so the credit is earned only before an incident, with everyday evidence.