357 articles · page 9 of 18
Articles
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers walked into a sliver of 23andMe accounts and, through a feature that connects relatives, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change hands.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still made agencies write plans for a funding lapse. Those plans counted people. But agency technology also depended on how each contract was paid for, what would expire mid-lapse, and how systems would restart afterward.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A major security logging platform changing hands exposed where the real lock-in sits: years of logs the rules require you to keep, detection rules written in one vendor’s language, and the wiring around them. Each can be freed before the next deal.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks began with phone calls to help desks and ended with control of identity systems. What mattered for banks was a handful of powerful accounts: how they are recovered, who may recover them, and how a takeover would be spotted.
Week of 4 September 2023
Storm-0558’s post-mortem described three key failures every agency development team can repeat
Microsoft’s September 2023 post-mortem told a story of a signing key it believed slipped out in diagnostic data, tokens trusted far beyond their purpose, and a key that lived for years. Agencies that build their own software carry all three risks themselves.
Week of 28 August 2023
Medicare’s negotiated prices would reach hospital pharmacies as refunds, and refunds have float
Medicare named its first ten drugs for price negotiation in August 2023. Hospitals with their own pharmacies inherited three problems with three different owners: the cash a refund ties up, the tangle with 340B, and the reconciliation systems both depend on.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The SEC’s private fund adviser rules, adopted in August 2023, were struck down ten months later. Firms that sorted the work into what investors would demand, what existing law already required and what only the rule required wasted very little.
Week of 14 August 2023
A weekend of public red-teaming showed agencies that AI testing never finishes
In August 2023, members of the public spent a weekend at DEF CON trying to make leading chatbots misbehave. It was a demonstration, not a certification. For agencies buying AI, testing is ongoing work before award, before deployment and in operation, limited by staff.
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 downgrades confirmed that the spring’s bank stress would become a long earnings squeeze. Regional bank technology budgets now had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for thinner margins.
Week of 31 July 2023
Prospect Medical’s ransomware attack ended up on the table in a hospital sale
Ransomware hit Prospect Medical Holdings in August 2023, striking an operator already short of money and midway through selling three Connecticut hospitals. For operators like that, cyber resilience becomes a balance-sheet and deal term, priced by buyers, lenders and state approvers.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
In July 2023 the SEC gave public companies four business days to disclose a material cyber incident, counted from when they decide it is material. So the decision itself needs governing: who makes it, what record it leaves, how it fits other deadlines.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining depended on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came not from its clinical systems but from storage used to format patient emails. Outreach data looks harmless field by field, yet together it is protected health information and deserves the same care as the medical record.
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s hiring-tool law made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder first step was finding every tool that scores candidates, deciding which were covered, and naming an owner for each.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
In one week, Colorado and Connecticut switched on their privacy laws and a California court paused new rules a day before enforcement. When deadlines move like that, the steadier approach is to build four lasting capabilities and map each new law onto them.
Week of 19 June 2023
Why a stolen DMV file weakened identity checks at agencies that were never breached
The MOVEit hack exposed the license records of most drivers in two states, and license numbers and issue dates stopped being secrets. Every agency that used them to check who residents were online inherited the breach, whether or not it ran MOVEit.
Week of 12 June 2023
Why the AI Act’s obligations follow your role, not your sector
The European Parliament’s June 2023 AI Act vote made headlines for generative AI. For banks, health systems and agencies, the lasting point was simpler: duties depend on whether you build an AI system, use one, or build on a general-purpose model. Many do all three.
Week of 5 June 2023
Most MOVEit victims never ran MOVEit
MOVEit reached thousands of organizations through the payroll, pension and contractor firms that ran it for them. Those clients had nothing to patch. What mattered was how fast they found affected vendors, who notified whom, and how much data they had handed over.
Week of 29 May 2023
Flat caps, rising subscriptions: how the debt deal squeezed federal IT from the inside
The 2023 debt deal held nondefense spending roughly flat for two years. Federal IT budgets did not shrink evenly: subscriptions and cloud bills grew on their own, modernization slipped by default, and technical staff thinned through attrition. Each needed its own control.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
In May 2023 officials described a state-backed intruder inside US infrastructure that used everyday admin tools and hijacked home routers instead of malware. Catching it meant knowing what normal looks like, owning the network edge, and planning to run without a trustworthy network.