52 articles · 2023 · page 1 of 3
Articles
Week of 25 December 2023
Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers
Banks, health systems and agencies were not parties to The New York Times’s December 2023 lawsuit against OpenAI and Microsoft. It still reached them in three ways: through the vendor promises they relied on, the content they published and the prompts their vendors kept.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
In December 2023 the FBI disrupted the ALPHV ransomware gang and handed hundreds of victims a free decryption tool. Taking that help well meant three things few agencies plan for: checking the offer is real, using the tool safely and keeping legal deadlines.
Week of 11 December 2023
For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms
In December 2023, a federal health IT rule made electronic record vendors explain the predictive tools they supply. For models a hospital built itself or bought elsewhere, the record system only had to hold the information, and the hospital had to produce it.
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
In December 2023, HHS sketched a cybersecurity baseline for hospitals, two ways to make it binding and incentives that needed Congress. Rules could arrive on the agency’s own timetable; the money could not. Hospitals had to plan for that gap.
Week of 27 November 2023
Ardent took one network offline, and emergency departments in six states had to answer for it
Over Thanksgiving 2023, Ardent Health took its network offline to fight ransomware. The decision was made centrally but felt locally, in hospitals carrying partners’ names across six states. Multi-state operators need those lines of authority settled before the next holiday weekend.
Week of 20 November 2023
Why the useful response to OpenAI’s board crisis was a days-to-switch number
No vendor questionnaire could have predicted OpenAI’s November 2023 boardroom upheaval. What regulated buyers could control was how costly it would be to move away from any one AI provider, and that came down to contracts, architecture and fallbacks.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
In November 2023 a ransomware gang reported its own victim, MeridianLink, to the SEC. The vendor’s bank and credit union customers then faced their own notification deadlines with little more than an attacker’s boast and a vendor statement to go on.
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
Ransomware hit ICBC’s U.S. broker-dealer in November 2023, and Treasury trades still had to settle that day. Every firm in the market could have been sitting in any of three seats, and each seat needed its own plan, written well before the crisis.
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance told agencies that AI affecting people’s rights or safety must meet minimum practices by a deadline or be switched off. The hardest cases were systems already running, many hidden inside vendor products.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers inside Okta’s support system reused live sign-in tokens found in files customers had uploaded for troubleshooting. Health systems send vendors logs and screenshots daily, and each one’s risk depends on what it contains, what HIPAA says it is, and how long it stays usable.
Week of 16 October 2023
Free, measured and always on: the open banking interface the CFPB proposed and banks could not price
The CFPB’s October 2023 open banking proposal turned a bank’s data connection into a measured, always-on service it could not charge for. Banks and credit unions had to work out what they must deliver, what they could not recover, and what they still controlled.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
A flaw in the web’s plumbing, disclosed in October 2023, produced record-breaking floods of traffic that the biggest providers absorbed unseen. Whether an agency’s public services were safe depended on which of three groups each fell into: rented protection, self-hosted, or unknown.
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers walked into a sliver of 23andMe accounts and, through a feature that connects relatives, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change hands.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still made agencies write plans for a funding lapse. Those plans counted people. But agency technology also depended on how each contract was paid for, what would expire mid-lapse, and how systems would restart afterward.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A major security logging platform changing hands exposed where the real lock-in sits: years of logs the rules require you to keep, detection rules written in one vendor’s language, and the wiring around them. Each can be freed before the next deal.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks began with phone calls to help desks and ended with control of identity systems. What mattered for banks was a handful of powerful accounts: how they are recovered, who may recover them, and how a takeover would be spotted.
Week of 4 September 2023
Storm-0558’s post-mortem described three key failures every agency development team can repeat
Microsoft’s September 2023 post-mortem told a story of a signing key it believed slipped out in diagnostic data, tokens trusted far beyond their purpose, and a key that lived for years. Agencies that build their own software carry all three risks themselves.
Week of 28 August 2023
Medicare’s negotiated prices would reach hospital pharmacies as refunds, and refunds have float
Medicare named its first ten drugs for price negotiation in August 2023. Hospitals with their own pharmacies inherited three problems with three different owners: the cash a refund ties up, the tangle with 340B, and the reconciliation systems both depend on.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The SEC’s private fund adviser rules, adopted in August 2023, were struck down ten months later. Firms that sorted the work into what investors would demand, what existing law already required and what only the rule required wasted very little.
Week of 14 August 2023
A weekend of public red-teaming showed agencies that AI testing never finishes
In August 2023, members of the public spent a weekend at DEF CON trying to make leading chatbots misbehave. It was a demonstration, not a certification. For agencies buying AI, testing is ongoing work before award, before deployment and in operation, limited by staff.