53 articles · 2022 · page 3 of 3
Articles
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
Four months after Log4Shell, a Java flaw with a similar nickname set off fresh alarm, and early reports mixed it up with another bug. Its narrow conditions tested whether tired hospital IT teams could size a response in hours.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
In March 2022, Okta revealed that a support engineer at one of its subcontractors had been compromised. For hospitals that run every clinical login through one identity provider, the real exposure was two months of silence, and the logs they never kept.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 set two deadlines in statute and left who is covered to a rulemaking that would take years. The decisions those deadlines force, inside a hospital’s incident command, never depended on the rule’s details.
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day clock on reporting cyber incidents. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and those words would become a standard others could test.
Week of 28 February 2022
Russia’s sanctions tested banks’ ownership data more than their name lists
From late February 2022, sanctions on Russia arrived in fast waves, from several governments, against sprawling corporate groups. Checking names against lists caught the obvious cases. The real exposure hid in unnamed subsidiaries, changing dates and differing national rules: all data problems.
Week of 21 February 2022
Shields Up had no end date, so vigilance needed a staffing plan
Russia’s invasion of Ukraine brought a request from CISA for every US organization to raise its guard, with no date to lower it. Staying alert for months turned out to be a management problem: who watches, who decides, and what work stops.
Week of 14 February 2022
In Ukraine’s bank DDoS, the rumor outran the outage
In February 2022, attackers knocked Ukrainian state banks offline for a few hours while fake texts claimed ATMs had failed. The outage was brief; the fear was the point. Staying available in a crisis includes what customers believe about their money.
Week of 7 February 2022
Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 all the way to a $3.6 billion seizure in 2022, because the ledger never forgets. The decisive links sat at regulated firms, so banks need records of crypto-linked activity that still make sense years later.
Week of 31 January 2022
One door is not a service: the IRS selfie reversal
In February 2022 the IRS stepped back from making selfie verification mandatory. The reason matters to any public service: one way of proving identity, however good at stopping fraud, shuts out part of a population that includes almost everyone.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told federal agencies to use logins that phishing cannot defeat. That worked, and it sent attackers somewhere else: to the moments when credentials are issued, replaced and reset, a job run by help desks the memo barely mentioned.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
Dressed as ransomware, WhisperGate simply destroyed data, leaving no key to buy. For US public agencies, it exposed continuity plans that silently counted on paying as a last resort, and recovery times nobody had measured from total loss.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, the test became: could a hospital show a surveyor everyone who counted as staff, including contractors, students and practitioners it didn’t employ? Few had a single list that reached past the payroll.
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
In January 2022 the FTC told companies that leaving Log4j unfixed could break the law. Regulators judge “reasonable” security after the fact, from records, so the work that counted most was writing down the response as it happened.