357 articles · page 8 of 18
Articles
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
Ransomware at the largest US claims clearinghouse left every connected hospital, practice and pharmacy with a hard call, fast. Pulling the plug was easy. Knowing what to unplug, and what proof to demand before plugging back in, took homework few had done.
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
A video call full of familiar, fake faces persuaded one employee to send about US$25 million. The fraud beat a meeting, not a payment system. Banks need controls at the invitation, inside the meeting and at the handoff to money.
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and insurers that receive addiction treatment records handle them much like other health data. The treatment programs that create those records, and the legal teams that answer subpoenas, ended up carrying more obligation than before.
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were written down; people decided who made it: who could approve cutting staff off, who could rebuild the devices, and each agency’s place in a contractor’s queue.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Russian state hackers read Microsoft executives’ email by way of a forgotten test account and an old app with too much power. Any “non-production” identity deserves three tests: who can log in to it, what it can reach and who would notice.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s first standards, published in January 2024, turned the question of when a tech outage is serious enough to report into a calculation over clients, transactions, downtime, data and cost. Banks that couldn’t feed the numbers couldn’t classify in time.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The fake bitcoin ETF post from the SEC’s X account landed one day before the real approval, when markets would believe it. Agencies whose words move markets or behavior should guard official accounts as privileged credentials, by the calendar and for the audience.
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
On January 1, 2024, FinCEN opened beneficial ownership filing to tens of millions of small companies while the law faced a constitutional challenge. A public obligation at that scale has four design problems, and the last one, how it shrinks, is rarely planned.
Week of 25 December 2023
Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers
Banks, health systems and agencies were not parties to The New York Times’s December 2023 lawsuit against OpenAI and Microsoft. It still reached them in three ways: through the vendor promises they relied on, the content they published and the prompts their vendors kept.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
In December 2023 the FBI disrupted the ALPHV ransomware gang and handed hundreds of victims a free decryption tool. Taking that help well meant three things few agencies plan for: checking the offer is real, using the tool safely and keeping legal deadlines.
Week of 11 December 2023
For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms
In December 2023, a federal health IT rule made electronic record vendors explain the predictive tools they supply. For models a hospital built itself or bought elsewhere, the record system only had to hold the information, and the hospital had to produce it.
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
In December 2023, HHS sketched a cybersecurity baseline for hospitals, two ways to make it binding and incentives that needed Congress. Rules could arrive on the agency’s own timetable; the money could not. Hospitals had to plan for that gap.
Week of 27 November 2023
Ardent took one network offline, and emergency departments in six states had to answer for it
Over Thanksgiving 2023, Ardent Health took its network offline to fight ransomware. The decision was made centrally but felt locally, in hospitals carrying partners’ names across six states. Multi-state operators need those lines of authority settled before the next holiday weekend.
Week of 20 November 2023
Why the useful response to OpenAI’s board crisis was a days-to-switch number
No vendor questionnaire could have predicted OpenAI’s November 2023 boardroom upheaval. What regulated buyers could control was how costly it would be to move away from any one AI provider, and that came down to contracts, architecture and fallbacks.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
In November 2023 a ransomware gang reported its own victim, MeridianLink, to the SEC. The vendor’s bank and credit union customers then faced their own notification deadlines with little more than an attacker’s boast and a vendor statement to go on.
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
Ransomware hit ICBC’s U.S. broker-dealer in November 2023, and Treasury trades still had to settle that day. Every firm in the market could have been sitting in any of three seats, and each seat needed its own plan, written well before the crisis.
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance told agencies that AI affecting people’s rights or safety must meet minimum practices by a deadline or be switched off. The hardest cases were systems already running, many hidden inside vendor products.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers inside Okta’s support system reused live sign-in tokens found in files customers had uploaded for troubleshooting. Health systems send vendors logs and screenshots daily, and each one’s risk depends on what it contains, what HIPAA says it is, and how long it stays usable.
Week of 16 October 2023
Free, measured and always on: the open banking interface the CFPB proposed and banks could not price
The CFPB’s October 2023 open banking proposal turned a bank’s data connection into a measured, always-on service it could not charge for. Banks and credit unions had to work out what they must deliver, what they could not recover, and what they still controlled.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
A flaw in the web’s plumbing, disclosed in October 2023, produced record-breaking floods of traffic that the biggest providers absorbed unseen. Whether an agency’s public services were safe depended on which of three groups each fell into: rented protection, self-hosted, or unknown.