Cross-sector · Platforms & Architecture
Articles in this selection, newest first. Change the filters, or clear them to see every article.
14 articles · Cross-sector · Platforms & Architecture
Articles
Week of 10 August 2026
Post-quantum signatures are still being chosen, so build PKI to switch twice
Digital signatures had moved up the post-quantum to-do list, yet two years after NIST’s first standards the choice of signature scheme was still open. Sort signatures by how long they must stay trustworthy, and design each group to change twice.
Week of 15 June 2026
The client-certificate deadline that moved, and the certificate authorities that didn’t wait
Chrome pushed back its deadline for using public web certificates to prove a client’s identity, to March 2027. Certificate authorities kept their own, earlier schedules. For any system-to-system link that relies on one, the real deadline belongs to whoever issues the certificate.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft began inside a vendor, not inside any customer’s Salesforce. Approving an integration hands that vendor a standing key to your data, and most vendor reviews never asked how the key was kept.
Week of 14 April 2025
How the CVE contract scare exposed the public plumbing under every patching policy
For one day in April 2025, the program that gives every software flaw its name looked set to switch off. The scare showed that patching policies and audit evidence rest on three public layers, each with its own way of failing.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a phone app, a developer service and freely downloadable files running on U.S. clouds. Blanket bans treated them as one risk. They were three, each owned by a different team.
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards settled what to move to. Deciding what to move first is harder, and for banks, health systems and agencies the answer sits in a surprising place: the records retention schedule.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Russian state hackers read Microsoft executives’ email by way of a forgotten test account and an old app with too much power. Any “non-production” identity deserves three tests: who can log in to it, what it can reach and who would notice.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A major security logging platform changing hands exposed where the real lock-in sits: years of logs the rules require you to keep, detection rules written in one vendor’s language, and the wiring around them. Each can be freed before the next deal.
Week of 5 December 2022
Rackspace kept running old Exchange for clients, and kept its old risks
Ransomware at Rackspace’s hosted Exchange email showed customers that paying someone to run aging software hands over the work, not the risk. They needed three things their contracts rarely spelled out: a way to patch, a way out and a way back.
Week of 6 June 2022
Your carrier’s routers belong in your threat model
A joint US advisory described state hackers getting inside the telecom companies that carry everyone’s traffic. For the businesses that buy those services, the message was blunt: treat the carrier’s network as untrusted, its engineers as privileged users, and its silence as a blind spot.
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw of December 2021 was easy to exploit and easy to fix. The real crisis was finding it, and that hunt looked very different for software an organization builds, software it buys and software it rents as a service.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to keep data inside China. Storing it there was the easy half. Personal information still left through three routes no data center map shows: copies, remote views and the reports built from it.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the very tools their IT providers used to look after them. The clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
Week of 13 July 2020
Schrems II and the case for deciding where data lives first
On July 16, 2020, Europe’s highest court struck down Privacy Shield and made the remaining contracts depend on case-by-case checks. Organizations that first decided where their data lived, and who held the keys, found the paperwork easier and rode out later swings in the law.