357 articles · page 13 of 18
Articles
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
Four months after Log4Shell, a Java flaw with a similar nickname set off fresh alarm, and early reports mixed it up with another bug. Its narrow conditions tested whether tired hospital IT teams could size a response in hours.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
In March 2022, Okta revealed that a support engineer at one of its subcontractors had been compromised. For hospitals that run every clinical login through one identity provider, the real exposure was two months of silence, and the logs they never kept.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 set two deadlines in statute and left who is covered to a rulemaking that would take years. The decisions those deadlines force, inside a hospital’s incident command, never depended on the rule’s details.
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day clock on reporting cyber incidents. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and those words would become a standard others could test.
Week of 28 February 2022
Russia’s sanctions tested banks’ ownership data more than their name lists
From late February 2022, sanctions on Russia arrived in fast waves, from several governments, against sprawling corporate groups. Checking names against lists caught the obvious cases. The real exposure hid in unnamed subsidiaries, changing dates and differing national rules: all data problems.
Week of 21 February 2022
Shields Up had no end date, so vigilance needed a staffing plan
Russia’s invasion of Ukraine brought a request from CISA for every US organization to raise its guard, with no date to lower it. Staying alert for months turned out to be a management problem: who watches, who decides, and what work stops.
Week of 14 February 2022
In Ukraine’s bank DDoS, the rumor outran the outage
In February 2022, attackers knocked Ukrainian state banks offline for a few hours while fake texts claimed ATMs had failed. The outage was brief; the fear was the point. Staying available in a crisis includes what customers believe about their money.
Week of 7 February 2022
Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 all the way to a $3.6 billion seizure in 2022, because the ledger never forgets. The decisive links sat at regulated firms, so banks need records of crypto-linked activity that still make sense years later.
Week of 31 January 2022
One door is not a service: the IRS selfie reversal
In February 2022 the IRS stepped back from making selfie verification mandatory. The reason matters to any public service: one way of proving identity, however good at stopping fraud, shuts out part of a population that includes almost everyone.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told federal agencies to use logins that phishing cannot defeat. That worked, and it sent attackers somewhere else: to the moments when credentials are issued, replaced and reset, a job run by help desks the memo barely mentioned.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
Dressed as ransomware, WhisperGate simply destroyed data, leaving no key to buy. For US public agencies, it exposed continuity plans that silently counted on paying as a last resort, and recovery times nobody had measured from total loss.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, the test became: could a hospital show a surveyor everyone who counted as staff, including contractors, students and practitioners it didn’t employ? Few had a single list that reached past the payroll.
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
In January 2022 the FTC told companies that leaving Log4j unfixed could break the law. Regulators judge “reasonable” security after the fact, from records, so the work that counted most was writing down the response as it happened.
Week of 27 December 2021
Why good-faith estimates weighed most on the therapist’s office
From January 1, 2022, every state-licensed provider owed uninsured and self-pay patients a written price estimate before scheduled care. Hospitals had billing teams to absorb it. Therapists and small practices, where self-pay is common and treatment has no fixed end, mostly did not.
Week of 20 December 2021
Oracle bought Cerner, and Cerner customers inherited a cloud strategy
Oracle’s December 2021 deal to buy Cerner gave hospitals running Cerner’s records a new owner with its own database, cloud and priorities. What mattered next was roadmap, hosting and contract terms, and when to act on each.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
In December 2021, ransomware knocked a cloud timekeeping service used by cities, transit agencies and public hospitals offline for weeks. The vendor had to rebuild its platform. Each employer still had to pay its people correctly, keep the time record and honor the law.
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw of December 2021 was easy to exploit and easy to fix. The real crisis was finding it, and that hunt looked very different for software an organization builds, software it buys and software it rents as a service.
Week of 29 November 2021
Inflation’s first casualty in bank IT was the change budget
Bank and credit union technology budgets took an inflation squeeze after the Fed dropped “transitory” in late November 2021. Running costs rose on their own through contracts, wages and usage pricing, and modernization money paid the difference.
Week of 22 November 2021
Omicron’s scarcest resource was staff, and few hospitals could count them in real time
When Omicron arrived in late November 2021, hospitals braced for a flood of patients. What actually ran out that winter was staff able to work, and every hard decision hinged on how fast leaders could piece together who was available from scattered systems.
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s $1 billion cybersecurity grant came with a local share that rose every year. That forced states and localities to decide early what they would keep paying for once the federal money stopped.