Government · Platforms & Architecture
Articles in this selection, newest first. Change the filters, or clear them to see every article.
11 articles · Government · Platforms & Architecture
Articles
Week of 13 April 2026
Direct File’s quiet exit made retirement part of service design
The first tax deadline without IRS Direct File showed that switching off a public digital service is a piece of design work in its own right, with duties to returning users, to the states that connected to it, and to the public record.
Week of 16 March 2026
States could build Medicaid work requirements from the statute before the rule arrived
By spring 2026, states had nine months to put Medicaid work requirements into practice and no federal rule yet. The safe path: build what the law already fixed, make adjustable what the rule would decide, and lock in delivery capacity before it ran out.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting on-premises SharePoint in July 2025 stole the keys that let them come back after the patch. For agencies running collaboration servers in-house, the response became three jobs with different owners: patch, evict, and decide whether the server should exist at all.
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan broke in the links between buildings, not in the radar screens. For agencies modernizing systems that cannot stop, the wires, the switchover and the people deserve as much planning as the software.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
In April 2024, Palo Alto withdrew its own workaround within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery themselves did not need to wait for the next revision.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
A flaw in the web’s plumbing, disclosed in October 2023, produced record-breaking floods of traffic that the biggest providers absorbed unseen. Whether an agency’s public services were safe depended on which of three groups each fell into: rented protection, self-hosted, or unknown.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told federal agencies to use logins that phishing cannot defeat. That worked, and it sent attackers somewhere else: to the moments when credentials are issued, replaced and reset, a job run by help desks the memo barely mentioned.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order took zero trust, a phrase worn thin by marketing, and turned it into three plain demands any organization can test system by system: verified identity, retained evidence and accountable software.
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached government agencies through an aging file transfer appliance few senior officials could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern kept returning through other products for years.
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
NIST’s zero trust guide is remembered for its diagrams. Its real legacy was a less visible list of things an agency has to know about itself first: its devices, its people, its data and its signals. No vendor could sell those.
Week of 16 March 2020
Hairpin traffic, distant data centers and the road to federal zero trust
As Washington sent its workforce home in March 2020, the bottleneck was not laptops but a network built to haul every connection back through the office. Fixing it moved federal security away from location and toward who you are and what device you use.