357 articles · page 5 of 18
Articles
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For one day in April 2025, the program that gives every software flaw its name looked set to switch off. The scare showed that patching policies and audit evidence rest on three public layers, each with its own way of failing.
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s most candid account of its own weaknesses sits with a regulator it can neither audit nor replace. Banks still control what they write, how it travels and how they respond when the holder is breached.
Week of 31 March 2025
Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos lightened internal AI process but asked contracts to carry more of the weight. Agencies that treated every stage of a contract as a governance tool kept bargaining power that review boards alone could not give them.
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist added to a chat of senior officials made the headlines. For agencies at every level, the lasting failure was an approved channel that could not set content limits, confirm who was present and keep the record, all at once.
Week of 17 March 2025
23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe filed for Chapter 11, its privacy promises stopped being fine print and became a condition that courts, states and bidders had to put a price on. Anyone holding or sharing health-related data should write contracts with that ending in mind.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa warning read like a shopping list of the remote-access tools hospitals and clinics rely on every day. Stopping attacks like it means governing those tools at three moments: getting in, moving around and switching off defenses.
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By dropping the Richardson Waiver, HHS stopped asking for public comment where the law did not require it. The lost warning fell unevenly: hardest on grant recipients, less on contractors and least on Medicare providers, whose own statute still requires comment.
Week of 24 February 2025
The House budget vote signaled Medicaid churn, a cost hospitals pay at the front desk
A narrow February 2025 House vote set Medicaid on the path to big changes. Beyond lost revenue, more frequent eligibility checks and work requirements would make it costlier to know who is covered, at the front desk, in enrollment help and in billing.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record beat a multi-person approval process without breaking it: attackers simply changed what the approvers saw on screen. Any bank approving payments through software carries the same risk at four points, from how the screen is built to recovery.
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The CFPB was told to stop work in February 2025, but consumer law stayed the same. What vanished were three outside nudges firms relied on: exam deadlines, published lessons from peers and federal follow-up on complaints. Each had to be rebuilt in-house.
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Set the politics aside and the fight over access to Treasury’s payment systems becomes a rare public lesson in who can touch the money. It came down to four separate controls, and to whether each could be proved rather than simply asserted.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a phone app, a developer service and freely downloadable files running on U.S. clouds. Blanket bans treated them as one risk. They were three, each owned by a different team.
Week of 20 January 2025
Revoking the AI executive order could not revoke the AI inventory, because Congress had written it
On inauguration day the 2023 AI executive order was revoked, and replacement guidance was weeks away. Agency AI programs could sort their work by what held it up: the order alone, OMB memos awaiting revision, or laws Congress had passed that still applied.
Week of 13 January 2025
DORA’s register of information made every bank a data supplier to EU oversight of its vendors
DORA’s register of technology suppliers looked like paperwork. In fact it was a dataset supervisors would pool to spot concentration and pick critical providers, and its quality depended on three data problems most vendor programs had never solved: identity, dependency and depth.
Week of 6 January 2025
Under FDA’s change-control model, the AI device a hospital validates will not stay the one it runs
FDA’s January 2025 draft on AI devices, read with its December change-control guidance, assumes the software keeps changing after a hospital buys it. Three kinds of change follow: pre-approved updates, updates needing fresh review, and shifts in the hospital itself.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers walked into Treasury workstations using a stolen key from a vendor’s cloud remote-support service, a key the agency never held. Remote support is powerful insider access by another name, and governing it takes four controls most organizations only partly have.
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS proposed turning HIPAA’s flexible security safeguards into firm requirements. Most were controls hospitals already had or paperwork they could build. One was different: being able to restore key systems within 72 hours, which needed clinical planning, tested capacity and real money.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After hackers burrowed into U.S. phone networks, CISA urged targeted people to switch to encrypted messaging, just as regulators were fining brokers over unrecorded chats. The two demands meet on one answer: a firm-controlled channel that is encrypted, recorded and easy to use.
Week of 9 December 2024
In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
Attackers breached Rhode Island’s vendor-run benefits system, and the public held the state accountable while the vendor held the systems, logs and investigation. The fix is a contract that settles visibility, decisions, costs and exit before anything goes wrong.
Week of 2 December 2024
The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit
A federal plan to regulate many data brokers like credit bureaus was withdrawn within six months. The question it asked, where did this personal data come from and what may we do with it, now follows every AI program.