53 articles · 2024 · page 2 of 3
Articles
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards settled what to move to. Deciding what to move first is harder, and for banks, health systems and agencies the answer sits in a surprising place: the records retention schedule.
Week of 5 August 2024
How the August 2024 selloff found brokerages’ capacity limit before the first trade
As markets tumbled on August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat before the first trade, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could show early that it had contained the attack on its systems. It could not yet show what the stolen data held or whose it was. Each claim needs its own evidence, and borrowing confidence from one to answer the other costs trust.
Week of 22 July 2024
Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security
KnowBe4 hired a remote engineer who turned out to be a North Korean IT worker. The scheme worked by slipping through four hand-offs owned by different teams. It fails when one verified identity follows the hire from interview to daily work.
Week of 15 July 2024
Channel File 291 measured every recovery plan in hands per device
One faulty CrowdStrike update turned millions of remotely managed Windows computers into a hands-on repair job. How fast each organization recovered came down to three things few plans covered: access to recovery keys, people at keyboards, and the order of repair.
Week of 8 July 2024
A credit union’s promises in an outage are set by its architecture, years before the attack
When ransomware took Patelco’s digital banking offline, members asked four simple questions: can I use my money, what happened to my data, how do I get back in, and who pays. Most of the answers had been decided years earlier.
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
In five days, four Supreme Court decisions ended deference on what statutes mean, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
After 2022, hospitals built script reviews to stop patient data leaking out through tracking tags. Polyfill.io exposed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it means checking the source, the content and the response.
Week of 17 June 2024
Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies dropped Kaspersky years ago. The June 2024 Commerce decision reached counties, school districts, utilities and contractors, with a hard deadline. It showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
Week of 10 June 2024
Why banking-as-a-service margins never covered the cost of knowing whose money it was
The Fed’s order against Evolve exposed a mismatch built into banking-as-a-service. Sponsor banks earned more as balances grew, but the cost of reconciliation, oversight and partner failure grew with every new program. Banks that priced only the revenue ended up carrying the costs.
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
Ransomware at Synnovis showed south-east London what consolidating pathology really costs. Pooling a region’s labs into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. No contract, budget or insurance policy carried the loss.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 attacks on Snowflake customers broke nothing in the platform itself. They used passwords stolen from infected computers, often contractors’, and walked out with bulk data. Every step, from theft to login to extraction, was a lock the customer held.
Week of 20 May 2024
How Windows Recall put a possible public record where no records officer could reach it
Microsoft answered Recall’s security critics by keeping screen snapshots on the laptop, locked to the user and set to expire. Those same three choices put the snapshots beyond the search, hold and retention tools agencies rely on for public records and lawsuits.
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments promised customers breach notice within 30 days and required service providers to warn firms within 72 hours. For brokers and advisers whose client data lives mostly with vendors, that second clock decides how well the first one works.
Week of 6 May 2024
Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once
In a big health system, hospitals cover for each other with beds, staff and shared services. When ransomware knocked out Ascension’s shared platforms across its markets, that safety net failed everywhere at once, and help had to come from outside.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal with no second login check, about sixteen months after the deal closed. For health care buyers, inherited internet-facing doors belong in the deal terms, the first weeks after closing and the boardroom.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of why they wanted certain records. That moved paperwork onto requesters, but left hospitals with judgments no form could make, under a rule a court struck down in 2025.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
In April 2024, Palo Alto withdrew its own workaround within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery themselves did not need to wait for the next revision.
Week of 8 April 2024
How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never became law. Its most distinctive idea, letting individuals act directly through requests, automatic opt-out signals and lawsuits, is arriving anyway through the states, and that is where privacy programs are now judged.
Week of 1 April 2024
Agencies buy a cloud provider’s security culture whether or not the contract mentions it
A federal review board blamed the 2023 Exchange Online intrusion on Microsoft’s security culture. No agency can audit a culture, but the report showed three places it leaves evidence a buyer can demand: secrets, disclosure and defaults.