52 articles · 2023 · page 3 of 3
Articles
Week of 20 March 2023
A chatbot’s history sidebar is a records system with someone else’s retention policy
OpenAI’s March 2023 bug was small as breaches go, but it showed health systems that every staff conversation with an AI assistant is stored data held by a vendor. HIPAA’s familiar questions follow: what goes in, how long it stays, who sees it.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
As banks failed in March 2023, the SEC proposed three cybersecurity measures on a single day, to little notice. Each served a different audience: the regulator, the customer and the market. Only the one protecting customers became law.
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank’s failure looked to most people like a banking story. For the companies that kept their cash there, it was something more familiar: a critical supplier collapsing, taking cash, payments and the services built on them down at once.
Week of 27 February 2023
BetterHelp’s intake form was a privacy promise the ad stack broke
The FTC’s BetterHelp case involved a company outside HIPAA, yet it reached every health organization with a website or app. What patients are told at sign-up is a promise, and the tracking tools behind the page must be built to keep it.
Week of 20 February 2023
Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
Big banks restricted ChatGPT in 2023 over the headline worry of confidential data slipping out. Contracts fixed that within a year. The slower, harder limits came from duties to keep and supervise records and to explain decisions.
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through file-transfer software most health systems saw as mere plumbing. In fact it is a store of sensitive data with its own exposure, retention and accountability, and it deserves the care given to any core system.
Week of 6 February 2023
One console, every server: what ESXiArgs exposed about the hypervisor
ESXiArgs used a flaw fixed two years earlier, but the damage came from where it struck. Hit the software that runs all your servers, and one break-in can lock every machine, slip past most security tools and reach the backups too.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
Ransomware at ION’s cleared derivatives unit took the same back-office tool away from firms across the market on the same day. The risk sat with a specialist vendor few boards had heard of, and every firm has some.
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s covert takedown of the Hive ransomware group spared many victims, hospitals among them, from paying. But it removed one criminal brand. The hired attackers, their methods and the hospital weaknesses they exploited were untouched, and each needed a different response.
Week of 16 January 2023
DORA’s two-year runway, measured in contract renewals
Europe’s DORA gave financial firms two years to get their technology houses in order, with no exemption for contracts already signed. The hardest part was rarely writing policies or running tests. It was the calendar for reopening agreements with technology providers.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s pilot-notice system failed in January 2023, and the easy story was an aging system. The trigger was routine database maintenance that damaged both the main copy and the backup. For agencies running old mission systems, procedure, people and recovery design come first.
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
In January 2023, bank regulators warned about crypto. Most readers heard a verdict on whether banks could hold digital assets. The sharper warning concerned risk banks already carried through depositors, partners and customers, which most could not measure from their own data.