53 articles · 2022 · page 1 of 3
Articles
Week of 26 December 2022
Section 524B gave hospitals a baseline to buy against
A spending law signed in December 2022 told medical device makers to build in cybersecurity. It never mentioned hospitals, yet it handed them something they had long lacked: a federal baseline to cite when choosing devices and writing contracts. Older equipment stayed where it was.
Week of 19 December 2022
The quantum law asked for a price tag agencies could only get from their vendors
A December 2022 law asked OMB to tell Congress what protecting federal systems from future quantum computers would cost. Most of that cost sat in products agencies did not build, so an honest answer depended on vendor roadmaps, contracts and replacement cycles.
Week of 12 December 2022
FTX’s favored account was a setting in the code, and banks have settings too
The FTX charges described control failures regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run many of their own controls the same way.
Week of 5 December 2022
Rackspace kept running old Exchange for clients, and kept its old risks
Ransomware at Rackspace’s hosted Exchange email showed customers that paying someone to run aging software hands over the work, not the risk. They needed three things their contracts rarely spelled out: a way to patch, a way out and a way back.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking code created no new rule. What it exposed was a gap in who was in charge: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls protecting every other system holding patient data.
Week of 21 November 2022
Banned from the market, still on the wall: the FCC’s equipment order and the installed base
In November 2022 the FCC stopped approving new equipment from Huawei and ZTE, and security gear from Hikvision, Dahua and Hytera. It left installed devices alone, so the real work moved to each agency’s own inventory.
Week of 14 November 2022
What Hive’s victims gained by calling the FBI early
The FBI had held Hive ransomware’s decryption keys for months when federal agencies warned health care about the gang, and victims who reported got them. Health systems should decide now when to call, what to share and how reporting fits their other deadlines.
Week of 7 November 2022
Who checked the people who moved FTX’s money
FTX’s banks, investors and partners had studied its growth. Few had asked three plain questions: who can move the money, who checks them, and whose money it is. Any financial institution can put those questions to every fast-growing counterparty.
Week of 31 October 2022
How hospitals spent the OpenSSL week waiting for ‘not affected’
A week’s warning of a critical OpenSSL flaw should have made the answer easy. For health systems, it hinged on suppliers saying their products were not affected, and few hospitals could get that reassurance quickly, in usable form, or at all.
Week of 24 October 2022
For credit unions, the 1033 outline was a question for the core processor
The CFPB’s first open banking outline kicked off a review aimed at small institutions. For community banks and credit unions, compliance would arrive as a product from their core and digital banking vendors, so the real decisions were about coverage, cost and contracts.
Week of 17 October 2022
If the CFPB’s funding fell, the statutes would still stand
An appeals court’s 2022 ruling that the consumer bureau’s funding was unconstitutional put a question mark over every CFPB rule for eighteen months. The sensible response was sorting: past orders, current rules and pending rules each carried a different kind of risk.
Week of 10 October 2022
In a merged health system, the network decides which hospitals go to paper
Ransomware at CommonSpirit Health in 2022 sent some of its hospitals to paper for weeks while others carried on. In a merged health system, shared logins, shared networks and who can order a shutdown decide how far one attack spreads.
Week of 3 October 2022
Five principles, three committees: the AI blueprint inside a hospital
In 2022 the White House published five principles for fair, safe AI. They sounded new, but hospitals already practiced most of them under other names. Extending trusted clinical committees to algorithms worked better than building a separate AI bureaucracy.
Week of 26 September 2022
Recordkeeping fails where the approved channel is slower than a text
In 2022 regulators fined major Wall Street firms over business texts sent from personal phones. The rules were old and the tools existed. People simply chose the faster channel, and fixing that took better apps, real supervision and proof that capture works.
Week of 19 September 2022
What a stolen license number proves, and what banks treated it as proving
The Optus breach put millions of driver’s license and passport numbers in criminals’ hands. Banks had treated those numbers as proof of identity when opening accounts, answering calls and keeping files. Each of those habits needed its own fix.
Week of 12 September 2022
M-22-18 asked producers to sign; agencies first had to know who they were
In 2022 the White House told software makers selling to federal agencies to sign their names to how they build it. The form got the headlines. The lasting work was knowing who made your software, and deciding what their promises were worth.
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s online government services was after public embarrassment, not ransom. When disruption itself is the goal, agencies must keep a basic service visible, push back on the attacker’s version of events, and know who decides whether to name the culprit.
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
Days after ransomware hit its systems, the second-largest school district in the country opened its doors on schedule. It could, because teaching a class needs very few computers. The hard parts were resetting access for an enormous population and telling families what to do.
Week of 22 August 2022
LastPass and the first-draft problem in vendor breach notices
In August 2022, LastPass said thieves had taken source code but no customer data. The attacker’s next move was already under way. The real test for customers was reading that first notice for what it made possible, and being ready to change every password.
Week of 15 August 2022
Why the IRS’s ten-year budget needed a one-year payoff
The Inflation Reduction Act handed the IRS about 80 billion dollars over a decade, and opponents vowed to claw it back from day one. When long-term money can vanish, every year’s spending has to be worth having on its own.