53 articles · 2024 · page 3 of 3
Articles
Week of 25 March 2024
Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record
OMB’s final AI memo kept the hard deadline: make risky AI safe or switch it off. It also made every way out, whether a determination, a waiver or an extension, carry a named signer, written evidence and a record others would read.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
In March 2024, the White House and EPA wrote to every governor about attacks on water systems, inviting each state’s environmental, health and homeland security secretaries. That guest list was the story: one problem, three offices, and rarely anyone in charge of all three.
Week of 11 March 2024
Why the AI Act left bank credit models with the supervisor they already had
Europe’s new AI law did not hand bank credit models to a new regulator. It routed them through the banking supervisor banks already knew, and let existing governance count for some duties. The real work was finding what model risk management never covered.
Week of 4 March 2024
Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage
Two weeks into the Change Healthcare outage, the federal response was about money. For providers that were never hacked, survival came down to three questions: how long could they last, who would lend to them, and who would finally pay for the loss.
Week of 26 February 2024
CSF 2.0’s biggest addition was the one a security team could not deliver
NIST’s refreshed cybersecurity framework added a new function called Govern. It looked like a technical update. In fact it hands work to executives, HR, procurement and the board, and organizations that left it to the security chief missed what had changed.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
Ransomware at the largest US claims clearinghouse left every connected hospital, practice and pharmacy with a hard call, fast. Pulling the plug was easy. Knowing what to unplug, and what proof to demand before plugging back in, took homework few had done.
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
A video call full of familiar, fake faces persuaded one employee to send about US$25 million. The fraud beat a meeting, not a payment system. Banks need controls at the invitation, inside the meeting and at the handoff to money.
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and insurers that receive addiction treatment records handle them much like other health data. The treatment programs that create those records, and the legal teams that answer subpoenas, ended up carrying more obligation than before.
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were written down; people decided who made it: who could approve cutting staff off, who could rebuild the devices, and each agency’s place in a contractor’s queue.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Russian state hackers read Microsoft executives’ email by way of a forgotten test account and an old app with too much power. Any “non-production” identity deserves three tests: who can log in to it, what it can reach and who would notice.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s first standards, published in January 2024, turned the question of when a tech outage is serious enough to report into a calculation over clients, transactions, downtime, data and cost. Banks that couldn’t feed the numbers couldn’t classify in time.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The fake bitcoin ETF post from the SEC’s X account landed one day before the real approval, when markets would believe it. Agencies whose words move markets or behavior should guard official accounts as privileged credentials, by the calendar and for the audience.
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
On January 1, 2024, FinCEN opened beneficial ownership filing to tens of millions of small companies while the law faced a constitutional challenge. A public obligation at that scale has four design problems, and the last one, how it shrinks, is rarely planned.