357 articles · page 14 of 18
Articles
Week of 8 November 2021
Robinhood’s phone-call breach argues for support access sized to one customer
In November 2021, one phone call to one support employee gave an attacker reach into millions of Robinhood customer records. The fix lives in three places: the person on the phone, the tools on their screen, and what customers are taught to trust.
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
In November 2021, CISA stopped asking federal agencies to chase every scary-sounding flaw and handed them a short list of the ones attackers were actually using, with a deadline. The real story is what that did to patch teams, system owners and asset inventories.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
In October 2021 the FTC gave mortgage brokers, auto dealers, finance companies and tax preparers specific, bank-style security rules. The bigger shift was who answers for them: one named person, a written report to the board, and proof the program works.
Week of 18 October 2021
BlackMatter’s reach was set by the directory, not the malware
The October 2021 BlackMatter advisory described an unglamorous attack: intruders walked in with stolen passwords and simply asked the company directory where everything was. How far one login could travel had been decided years earlier, by how access was designed.
Week of 11 October 2021
FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
In October 2021, FinCEN used banks’ suspicious activity reports to sketch the money trail behind ransomware. It worked only where filers had recorded details like wallet addresses clearly. That same choice decides how useful the data is inside the bank.
Week of 4 October 2021
Why a security attestation to government now carries fraud risk
In October 2021 the Justice Department said it would use a fraud law against contractors and grantees whose security promises outran their practice. Overnight, a signature on a security form became a personal and financial risk for whoever signed it.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
On September 30, 2021, a widely used root certificate expired. The websites were fine; the old software talking to them broke. In hospitals, the trouble hid in devices and integrations whose trust lists nobody owned or even knew about.
Week of 20 September 2021
What sanctioning SUEX changed for banks that serve crypto firms
Treasury’s September 2021 sanctions on the crypto exchange SUEX went after the place where ransom money gets cashed out. Because SUEX hid inside other exchanges, banks serving crypto businesses had to decide how deep to look, and what that would cost.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
In September 2021 the FTC said a health app that shares users’ data without permission has suffered a breach. That moved breach prevention out of the security team and into three business decisions: what code ships, what partners receive, what users agreed to.
Week of 6 September 2021
Vaccination status was the easy record; exemptions were the hard one
President Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. It demanded three things: status records, weekly testing and exemption decisions. The third carried the lasting legal risk, and most organizations built it last and least.
Week of 30 August 2021
Hurricane Ida and the IT dependencies that sit under the EHR
Hurricane Ida knocked out Louisiana’s grid and phone networks, and hospitals ran on generators for days. The week tested three layers hidden beneath the electronic health record, each owned by a different team: power, connectivity and hosting.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
In August 2021, big companies pledged at the White House to train hundreds of thousands of people in cybersecurity. For public agencies, the talent shortage had three parts: supply, access and retention. The pledges tackled the first. Agencies held the keys to the other two.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to keep data inside China. Storing it there was the easy half. Personal information still left through three routes no data center map shows: copies, remote views and the reports built from it.
Week of 9 August 2021
Who counts as a crypto broker mattered less than what brokers could not know
In August 2021, the Senate fought over who should count as a crypto “broker.” Banks and brokerages were clearly in. Their real problem was three kinds of data they did not have: what customers paid, where assets had been, and who sent them.
Week of 2 August 2021
The paper card that made Key to NYC’s digital pass work
New York City’s August 2021 vaccination requirement accepted slick digital passes and the humble paper CDC card alike. That paper fallback carried the program through patchy records and untrained door staff, and it is the design choice any agency issuing digital credentials should copy first.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
In July 2021, the White House promised cybersecurity goals for the systems that run infrastructure. But voluntary goals need an owner, a budget and a reason to act. Most small water systems had none, and only local officials could supply them.
Week of 19 July 2021
How a bed-count fine repriced hospital price secrecy
In July 2021, CMS proposed tying hospital price transparency fines to bed count, so the biggest systems could no longer cheaply pay to keep their rates hidden. Compliance became a permanent data product, read most closely by payers, employers and competitors rather than patients.
Week of 12 July 2021
A permanent telehealth benefit with an in-person clock attached
Medicare’s July 2021 proposal made home telehealth for mental health the first permanent post-pandemic benefit. Its conditions turned continuity of care into a record-keeping task: where the patient is, how the visit happens, and when they were last seen in person.
Week of 5 July 2021
Why community banks’ open banking experience sat with their core vendors
The July 2021 competition order nudged the CFPB toward a rule on sharing bank data. For community banks and credit unions, the customer’s experience of that sharing was already shaped elsewhere: by core and digital banking vendors, in three moments they only partly controlled.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the very tools their IT providers used to look after them. The clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.