357 articles · page 15 of 18
Articles
Week of 21 June 2021
TransUnion won Ramirez, and name-only matching still lost
In June 2021 the Supreme Court narrowed who can sue over inaccurate credit file flags. Underneath was a matching failure that banks and fintechs share, and the ruling changed none of the three things that govern it.
Week of 14 June 2021
Juneteenth tested how many calendars a bank really runs
Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it revealed something surprising: a “business day” is defined in three places, the payment rails, customer commitments and the workforce, usually owned by three different teams.
Week of 7 June 2021
Why Basel’s 1,250% risk weight pointed banks toward custody
In June 2021, global bank regulators proposed rules that made owning bitcoin outright ruinously expensive in capital. Read closely, they split the bank crypto question into three different businesses, holding, safeguarding and moving value, and priced out only one of them.
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
In June 2021 the Supreme Court decided that looking up records you are allowed to reach, for a bad reason, is generally not a federal computer crime. For agencies holding sensitive records, protection now rests on controls they own: access design, query monitoring and consequences.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
Less than three weeks after Colonial Pipeline, regulators gave critical pipelines twelve hours to report a cyber incident, a named coordinator on call around the clock and thirty days to grade themselves. All three ideas spread across sectors, and each needs different preparation.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
Ireland’s health service is remembered for the morning its hospitals went to paper. The independent review told a less dramatic, more useful story: the outcome was settled during nearly eight unnoticed weeks, across three stages of entry, dwell and response.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order took zero trust, a phrase worn thin by marketing, and turned it into three plain demands any organization can test system by system: verified identity, retained evidence and accountable software.
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
After a ransomware attack, Scripps Health spent most of May 2021 without its electronic health record. Downtime plans written for hours failed over weeks on three separate fronts: keeping care safe, keeping revenue flowing and keeping staff going.
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on the threat of publication. Good planning starts by asking which data would hurt whom if released: the workforce, the mission or the public.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted the AI in banks, hospitals and agencies by business process, so compliance belonged to process owners as much as to data scientists.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 deal for Nuance put software that listens to doctor visits inside a giant cloud platform. For health systems, the decisions that mattered concerned the recording itself, who checks the draft note, and the contract governing both.
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
The federal ban on information blocking took effect on April 5, 2021, and health systems found that compliance was decided less by policy than by portal settings and records queues. Three questions mattered: what gets released, when, and how withholding is defended.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
In March 2021, five federal agencies asked banks and credit unions how they use AI. No new rule followed. But the questions mapped onto four tests existing rules already imposed, and those tests still frame how supervisors look at any model.
Week of 22 March 2021
Each Archegos lender already held enough data to act
Archegos is usually told as a story of bets hidden across many banks. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again ranked business email compromise as the costliest kind of online fraud. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 8 March 2021
One-time money, recurring bills: the Rescue Plan’s technology hangover
The American Rescue Plan handed state and local governments $350 billion of flexible, temporary money. Where it paid for technology subscriptions, the risk hid in three places: the shape of the funds, the shape of the costs, and contracts signed in a hurry.
Week of 1 March 2021
ProxyLogon: the patch was the easy part
Hidden flaws in Microsoft’s email server software set off a race to patch in March 2021. For public agencies, the damage was decided by three gaps no patch could close: seeing what faced the internet, hunting intruders, and owning the retirement decision.
Week of 22 February 2021
A few hours without Fedwire, and the bank promises with no fallback
Little lasting harm came of the Federal Reserve’s February 24, 2021 outage. It still revealed how few banks had mapped which customer promises rest on a single central payment rail, rehearsed the narrow manual alternatives, or planned for the backlog afterward.
Week of 15 February 2021
Why working from home failed when Texas froze
A year into the pandemic, many continuity plans answered every site outage with “work from home.” Winter Storm Uri took out power, water, roads and home internet together, showing that one fallback fails when people, sites, networks and suppliers all fail at once.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that tells the two apart, safeguards that work whoever is at the controls, and public statements that survive revision.