357 articles · page 12 of 18
Articles
Week of 8 August 2022
Tornado Cash and the transfers nobody asked for
Treasury’s sanctions on Tornado Cash targeted software, not a person. Forbidden money could land in anyone’s wallet uninvited, the usual parties to screen did not exist, and the rule itself was soon under legal attack. Banks had to comply anyway.
Week of 1 August 2022
Why buying the same software as your neighbors removes your fallback
Ransomware at one NHS software supplier knocked urgent care systems offline across many providers at once, and neighbors could not cover for each other because they ran the same product. U.S. health systems buying shared software face the same exposure.
Week of 25 July 2022
Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s
The CHIPS and Science Act passed while network switches and servers sat on back order. It was about where chips would be made in the 2030s. IT leaders needed separate answers, on separate timescales, for the backlog, the refresh plan and provenance.
Week of 18 July 2022
Necessary and proportionate: the ADPPA test that outlived the bill
A federal privacy bill cleared committee 53 to 2 and then stalled before a floor vote. Its central idea, collect only what you genuinely need, outlived it, and banks and hospitals were more exposed to that idea than their sector exemptions suggested.
Week of 11 July 2022
988 launched without 911’s plumbing: location, dispatch and a fee
In July 2022 the national crisis line got an easy three-digit number, 988, but none of the hidden machinery that makes 911 work. States inherited three gaps: no caller location, no settled way to send help, and no dedicated funding.
Week of 4 July 2022
Rogers: the bank outage that started at someone else’s carrier
One Canadian carrier went dark for most of a day, and debit cards stopped working nationwide, even at banks that had never bought a Rogers line. Telecom dependency hides in places a two-carrier policy cannot reach.
Week of 27 June 2022
A rule’s survival odds belong in the compliance plan
West Virginia v. EPA gave courts a named test for striking down ambitious rules. That turned a rule’s survival into something agencies and regulated organizations must estimate: in writing new rules, defending existing programs and deciding when to spend on compliance.
Article · 21 June 2022 · Simon Malian
The Rising Threat of Medical Device Hacking & How Healthcare Organizations Can Prevent It
All attacks on the healthcare industry are vital to address. We believe the most pressing area to mitigate is the hacking of medical devices.
Week of 20 June 2022
Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went first to medical records, where HIPAA already set rules. The bigger exposure for health systems lay at their own digital edges, and in consumer data they never held but patients assumed was protected.
Week of 13 June 2022
Internet Explorer retired; its clinical applications did not
Internet Explorer was retired, but hospitals’ old clinical web applications were not. A compatibility mode in Edge kept them running, and the list it required became a ready-made map of legacy risk, best worked down by who could fix each site.
Week of 6 June 2022
Your carrier’s routers belong in your threat model
A joint US advisory described state hackers getting inside the telecom companies that carry everyone’s traffic. For the businesses that buy those services, the message was blunt: treat the carrier’s network as untrusted, its engineers as privileged users, and its silence as a blind spot.
Week of 30 May 2022
No patch yet: Follina and Confluence tested who may switch things off
Two security holes were being exploited before any fix existed, leaving health systems with workarounds only. What decided the outcome was organizational: who could authorize switching something off, who could actually do it everywhere, and who checked that it worked.
Week of 23 May 2022
An acquisition announcement is a free option on your exit plan
Broadcom’s deal to buy VMware gave customers eighteen months before anything changed. The organizations that fared best treated that time as a cheap option: they priced a way out, kept it alive with small investments, and used it, on evidence, at renewal.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s promise not to charge good-faith security research made it more likely that outsiders would report flaws. For agencies, that created practical homework: a front door for reports, a route to whoever can fix the problem, and a way to close the loop.
Week of 9 May 2022
Stable is a claim: what TerraUSD asked of bank front lines
Few banks held TerraUSD, yet its collapse still walked through their doors with their customers: scammers preying on the losses, disputes over transfers people had approved themselves, and real confusion about which products near a deposit were actually protected.
Week of 2 May 2022
Quantum risk is dated by how long your data must stay secret
NSM-10 set 2035 as a national goal. For any single agency system, though, the real deadline comes sooner: how long its data must stay secret, plus how long fixing it will take, measured against when a code-breaking machine might exist.
Week of 25 April 2022
Why the CFPB’s dormant authority put fintech partners on the exam calendar
The CFPB dusted off a rarely used power to supervise nonbanks whose conduct puts consumers at risk, and exam readiness stopped being a problem for later. Fintechs had to build it before they scaled, and their sponsor banks had to check it.
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
In April 2022, a federal advisory described North Korean operators courting crypto-firm engineers with fake job offers and booby-trapped apps. For financial firms, a recruiter’s message reaches the people with the most access through a channel security rarely watches, so assume one will succeed.
Week of 11 April 2022
Ninety days at a time: telehealth’s stack of temporary permissions
In April 2022, another 90-day renewal of the public health emergency kept telehealth running on borrowed time. Patients saw one service. Underneath, health systems had to manage separate permissions with different owners and end dates, and tell patients which one their visit relied on.
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
In April 2022, federal agents cleaned up a botnet Russian military intelligence had built from small, forgotten firewalls. The warning for public agencies: an unmanaged edge device can serve someone else’s operations long before it causes a breach of your own.