Government · Security & Resilience
Articles in this selection, newest first. Change the filters, or clear them to see every article.
22 articles · Government · Security & Resilience · page 1 of 2
Articles
Week of 12 October 2026
Ivanti’s October zero-day was a directory incident that came in through the VPN
CISA gave agencies three days to patch and triage Ivanti Connect Secure. The attacker left no implant on the gateway and used its directory account to hunt for administrator passwords and BitLocker keys. Permissions set long before decided how far that reached.
Week of 8 June 2026
Why World Cup cyber risk sat in the city services residents use every day
The stadiums had federal, state and venue security teams. The cyber risk host cities owned sat somewhere less obvious: in the everyday services around the matches, from parking sites and traffic signals to 911 dispatch and the vendors neighboring cities share.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
New research in spring 2026 lowered estimates of what a quantum computer would need to break today’s digital locks. For agencies, the urgent part was proof of identity rather than secrecy: certificates, smart cards and device keys take longest to replace.
Week of 22 September 2025
Persistence below the patch: what ED 25-03 asked agencies to prove about their firewalls
CISA’s Emergency Directive 25-03 described attackers who hid inside the startup code of Cisco firewalls, surviving restarts and upgrades. Applying a fix was no longer enough. Agencies had to prove each device could be trusted, and that the fix was the right one.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was really three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each needs a different owner, a different clock and a different fix.
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Set the politics aside and the fight over access to Treasury’s payment systems becomes a rare public lesson in who can touch the money. It came down to four separate controls, and to whether each could be proved rather than simply asserted.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers walked into Treasury workstations using a stolen key from a vendor’s cloud remote-support service, a key the agency never held. Remote support is powerful insider access by another name, and governing it takes four controls most organizations only partly have.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
In March 2024, the White House and EPA wrote to every governor about attacks on water systems, inviting each state’s environmental, health and homeland security secretaries. That guest list was the story: one problem, three offices, and rarely anyone in charge of all three.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The fake bitcoin ETF post from the SEC’s X account landed one day before the real approval, when markets would believe it. Agencies whose words move markets or behavior should guard official accounts as privileged credentials, by the calendar and for the audience.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
In December 2023 the FBI disrupted the ALPHV ransomware gang and handed hundreds of victims a free decryption tool. Taking that help well meant three things few agencies plan for: checking the offer is real, using the tool safely and keeping legal deadlines.
Week of 4 September 2023
Storm-0558’s post-mortem described three key failures every agency development team can repeat
Microsoft’s September 2023 post-mortem told a story of a signing key it believed slipped out in diagnostic data, tokens trusted far beyond their purpose, and a key that lived for years. Agencies that build their own software carry all three risks themselves.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
In May 2023 officials described a state-backed intruder inside US infrastructure that used everyday admin tools and hijacked home routers instead of malware. Catching it meant knowing what normal looks like, owning the network edge, and planning to run without a trustworthy network.
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s online government services was after public embarrassment, not ransom. When disruption itself is the goal, agencies must keep a basic service visible, push back on the attacker’s version of events, and know who decides whether to name the culprit.
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
In April 2022, federal agents cleaned up a botnet Russian military intelligence had built from small, forgotten firewalls. The warning for public agencies: an unmanaged edge device can serve someone else’s operations long before it causes a breach of your own.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
Dressed as ransomware, WhisperGate simply destroyed data, leaving no key to buy. For US public agencies, it exposed continuity plans that silently counted on paying as a last resort, and recovery times nobody had measured from total loss.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
In July 2021, the White House promised cybersecurity goals for the systems that run infrastructure. But voluntary goals need an owner, a budget and a reason to act. Most small water systems had none, and only local officials could supply them.
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on the threat of publication. Good planning starts by asking which data would hurt whom if released: the workforce, the mission or the public.
Week of 1 March 2021
ProxyLogon: the patch was the easy part
Hidden flaws in Microsoft’s email server software set off a race to patch in March 2021. For public agencies, the damage was decided by three gaps no patch could close: seeing what faced the internet, hunting intruders, and owning the retirement decision.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that tells the two apart, safeguards that work whoever is at the controls, and public statements that survive revision.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The SolarWinds Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are harmless plumbing, and that federal sensors would spot a national-scale intrusion. Only the second was quick to fix.