357 articles · page 7 of 18
Articles
Week of 8 July 2024
A credit union’s promises in an outage are set by its architecture, years before the attack
When ransomware took Patelco’s digital banking offline, members asked four simple questions: can I use my money, what happened to my data, how do I get back in, and who pays. Most of the answers had been decided years earlier.
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
In five days, four Supreme Court decisions ended deference on what statutes mean, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
After 2022, hospitals built script reviews to stop patient data leaking out through tracking tags. Polyfill.io exposed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it means checking the source, the content and the response.
Week of 17 June 2024
Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies dropped Kaspersky years ago. The June 2024 Commerce decision reached counties, school districts, utilities and contractors, with a hard deadline. It showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
Week of 10 June 2024
Why banking-as-a-service margins never covered the cost of knowing whose money it was
The Fed’s order against Evolve exposed a mismatch built into banking-as-a-service. Sponsor banks earned more as balances grew, but the cost of reconciliation, oversight and partner failure grew with every new program. Banks that priced only the revenue ended up carrying the costs.
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
Ransomware at Synnovis showed south-east London what consolidating pathology really costs. Pooling a region’s labs into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. No contract, budget or insurance policy carried the loss.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 attacks on Snowflake customers broke nothing in the platform itself. They used passwords stolen from infected computers, often contractors’, and walked out with bulk data. Every step, from theft to login to extraction, was a lock the customer held.
Week of 20 May 2024
How Windows Recall put a possible public record where no records officer could reach it
Microsoft answered Recall’s security critics by keeping screen snapshots on the laptop, locked to the user and set to expire. Those same three choices put the snapshots beyond the search, hold and retention tools agencies rely on for public records and lawsuits.
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments promised customers breach notice within 30 days and required service providers to warn firms within 72 hours. For brokers and advisers whose client data lives mostly with vendors, that second clock decides how well the first one works.
Week of 6 May 2024
Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once
In a big health system, hospitals cover for each other with beds, staff and shared services. When ransomware knocked out Ascension’s shared platforms across its markets, that safety net failed everywhere at once, and help had to come from outside.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal with no second login check, about sixteen months after the deal closed. For health care buyers, inherited internet-facing doors belong in the deal terms, the first weeks after closing and the boardroom.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of why they wanted certain records. That moved paperwork onto requesters, but left hospitals with judgments no form could make, under a rule a court struck down in 2025.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
In April 2024, Palo Alto withdrew its own workaround within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery themselves did not need to wait for the next revision.
Week of 8 April 2024
How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never became law. Its most distinctive idea, letting individuals act directly through requests, automatic opt-out signals and lawsuits, is arriving anyway through the states, and that is where privacy programs are now judged.
Week of 1 April 2024
Agencies buy a cloud provider’s security culture whether or not the contract mentions it
A federal review board blamed the 2023 Exchange Online intrusion on Microsoft’s security culture. No agency can audit a culture, but the report showed three places it leaves evidence a buyer can demand: secrets, disclosure and defaults.
Week of 25 March 2024
Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record
OMB’s final AI memo kept the hard deadline: make risky AI safe or switch it off. It also made every way out, whether a determination, a waiver or an extension, carry a named signer, written evidence and a record others would read.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
In March 2024, the White House and EPA wrote to every governor about attacks on water systems, inviting each state’s environmental, health and homeland security secretaries. That guest list was the story: one problem, three offices, and rarely anyone in charge of all three.
Week of 11 March 2024
Why the AI Act left bank credit models with the supervisor they already had
Europe’s new AI law did not hand bank credit models to a new regulator. It routed them through the banking supervisor banks already knew, and let existing governance count for some duties. The real work was finding what model risk management never covered.
Week of 4 March 2024
Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage
Two weeks into the Change Healthcare outage, the federal response was about money. For providers that were never hacked, survival came down to three questions: how long could they last, who would lend to them, and who would finally pay for the loss.
Week of 26 February 2024
CSF 2.0’s biggest addition was the one a security team could not deliver
NIST’s refreshed cybersecurity framework added a new function called Govern. It looked like a technical update. In fact it hands work to executives, HR, procurement and the board, and organizations that left it to the security chief missed what had changed.