357 articles · page 17 of 18
Articles
Week of 14 September 2020
Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files
In one September week, FinCEN asked what an effective anti-money laundering program really is, and leaked reports showed banks filing dutifully while flagged money kept moving. The gap between filing, usefulness and action was a data and decision problem that compliance metrics hid.
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
A ransomware attack in Düsseldorf is remembered for a disputed death. Its lasting message for health systems is regional: when one hospital closes its doors to ambulances, the risk moves onto crews and neighboring hospitals that rarely plan for it, or measure it.
Week of 31 August 2020
Blackbaud’s breach exposed patient data that fundraising never needed
The Blackbaud ransomware attack reached hospitals through their fundraising foundations. It revealed donor databases holding more patient information, for longer, than fundraising needed, and showed why keeping less data is the one safeguard that still works after the others fail.
Week of 24 August 2020
Low for long: the rate forecast hidden in bank technology budgets
The Fed signaled in August 2020 that rates would stay near zero for years. Many bank technology plans assumed the same without saying so: in deposit forecasts, in how digital channels were judged and in contract terms that later came due.
Week of 17 August 2020
Why the Postal Service slowdown belonged on agency risk registers
The August 2020 mail slowdown was covered as an election story. For agencies that mail notices, payments and medicines, it revealed something less visible: a critical dependency with legal deadlines attached and nobody inside the agency watching it.
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
NIST’s zero trust guide is remembered for its diagrams. Its real legacy was a less visible list of things an agency has to know about itself first: its devices, its people, its data and its signals. No vendor could sell those.
Week of 3 August 2020
Capital One’s cloud penalty was a verdict on sequencing
The $80 million penalty against Capital One judged a bank that moved critical systems faster than it could describe, test and watch the risks it was taking on. It passed no verdict on the cloud itself.
Week of 27 July 2020
Lifespan’s stolen laptop and the home office risk analyses missed
A laptop stolen from an employee’s car cost Lifespan $1,040,000. The July 2020 settlement turned on missing encryption, a weak device inventory and absent agreements, landing just as health care’s office staff moved home, beyond the reach of risk analyses written for hospital buildings.
Week of 20 July 2020
The control system map most operators did not have
On July 23, 2020, the NSA and CISA urged immediate action to protect the systems that run pumps, chillers and power. Their first and hardest request was an accurate map of what was actually connected, something few utilities, hospitals or data center operators had.
Week of 13 July 2020
Schrems II and the case for deciding where data lives first
On July 16, 2020, Europe’s highest court struck down Privacy Shield and made the remaining contracts depend on case-by-case checks. Organizations that first decided where their data lived, and who held the keys, found the paperwork easier and rode out later swings in the law.
Week of 6 July 2020
Why hospital COVID reporting turned out to be infrastructure
In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and use a new HHS route instead. The switch revealed reporting as real infrastructure, and hospitals still counting by hand paid for every change.
Week of 29 June 2020
Why Form CRS was the easy part of Regulation Best Interest
On June 30, 2020, brokers became bound to act in their retail customers’ best interest. Writing the plain-language summary, Form CRS, was the manageable part. Proving each recommendation met the standard, and that conflicts were controlled, took data most firms never captured.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center files through the breach of one small web firm. Each agency had weighed its own modest contract; nobody had weighed the shared platform, the archive piling up on it or everyone who could log in.
Week of 15 June 2020
What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, yet €1.9 billion of its cash probably never existed. Its partners learned that three checks cannot be handed to anyone else: where the money comes from, whether customer funds are visible, and how to leave.
Week of 8 June 2020
When vendors set facial recognition policy before agencies did
Within days in June 2020, IBM, Amazon and Microsoft stepped back from selling facial recognition to police. Agencies discovered their suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.
Week of 1 June 2020
UCSF’s ransom decision was shaped long before the attack
Ransomware hit servers at UCSF’s School of Medicine in June 2020, and the university chose to pay. The decision looked like a crisis call but was largely settled in advance, by backups, where data lived, insurance terms and which advisers were already on retainer.
Week of 25 May 2020
Why valid when made left bank-fintech lenders two open questions
The OCC’s May 29, 2020, rule said a national bank loan’s permissible interest survives its sale. That settled one big question for bank-fintech lending. Two harder ones remained: who is really the lender, and can the bank prove it is in charge?
Week of 18 May 2020
Small-dollar loans, alternative data and the governance attached
In May 2020, four federal regulators invited banks and credit unions back into small loans and welcomed new data and technology for deciding who qualifies. Using bank-account data well took consented data access, careful model oversight and fair lending controls for automated decisions.
Week of 11 May 2020
Every unemployment fraud control had a cost to real claimants
In May 2020, federal warnings about organized fraud against state unemployment systems pushed agencies to add identity checks to services already buckling under demand. Wherever they placed those checks, at application, before payment or after, someone legitimate paid part of the price.
Week of 4 May 2020
Password spraying against research labs: an old attack on a new target
In May 2020, US and UK cyber agencies warned that state-backed hackers were guessing common passwords across health and research organizations to reach COVID-19 work. The defenses were familiar; applying them across academic medicine’s tangle of accounts, data and remote access was harder.