Platforms & Architecture
Insights seen through platforms & architecture, across every sector.
46 articles · Platforms & Architecture · page 2 of 3
Articles
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
In April 2024, Palo Alto withdrew its own workaround within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery themselves did not need to wait for the next revision.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Russian state hackers read Microsoft executives’ email by way of a forgotten test account and an old app with too much power. Any “non-production” identity deserves three tests: who can log in to it, what it can reach and who would notice.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
A flaw in the web’s plumbing, disclosed in October 2023, produced record-breaking floods of traffic that the biggest providers absorbed unseen. Whether an agency’s public services were safe depended on which of three groups each fell into: rented protection, self-hosted, or unknown.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A major security logging platform changing hands exposed where the real lock-in sits: years of logs the rules require you to keep, detection rules written in one vendor’s language, and the wiring around them. Each can be freed before the next deal.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining depended on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through file-transfer software most health systems saw as mere plumbing. In fact it is a store of sensitive data with its own exposure, retention and accountability, and it deserves the care given to any core system.
Week of 5 December 2022
Rackspace kept running old Exchange for clients, and kept its old risks
Ransomware at Rackspace’s hosted Exchange email showed customers that paying someone to run aging software hands over the work, not the risk. They needed three things their contracts rarely spelled out: a way to patch, a way out and a way back.
Week of 10 October 2022
In a merged health system, the network decides which hospitals go to paper
Ransomware at CommonSpirit Health in 2022 sent some of its hospitals to paper for weeks while others carried on. In a merged health system, shared logins, shared networks and who can order a shutdown decide how far one attack spreads.
Week of 13 June 2022
Internet Explorer retired; its clinical applications did not
Internet Explorer was retired, but hospitals’ old clinical web applications were not. A compatibility mode in Edge kept them running, and the list it required became a ready-made map of legacy risk, best worked down by who could fix each site.
Week of 6 June 2022
Your carrier’s routers belong in your threat model
A joint US advisory described state hackers getting inside the telecom companies that carry everyone’s traffic. For the businesses that buy those services, the message was blunt: treat the carrier’s network as untrusted, its engineers as privileged users, and its silence as a blind spot.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told federal agencies to use logins that phishing cannot defeat. That worked, and it sent attackers somewhere else: to the moments when credentials are issued, replaced and reset, a job run by help desks the memo barely mentioned.
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw of December 2021 was easy to exploit and easy to fix. The real crisis was finding it, and that hunt looked very different for software an organization builds, software it buys and software it rents as a service.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
On September 30, 2021, a widely used root certificate expired. The websites were fine; the old software talking to them broke. In hospitals, the trouble hid in devices and integrations whose trust lists nobody owned or even knew about.
Week of 30 August 2021
Hurricane Ida and the IT dependencies that sit under the EHR
Hurricane Ida knocked out Louisiana’s grid and phone networks, and hospitals ran on generators for days. The week tested three layers hidden beneath the electronic health record, each owned by a different team: power, connectivity and hosting.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to keep data inside China. Storing it there was the easy half. Personal information still left through three routes no data center map shows: copies, remote views and the reports built from it.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the very tools their IT providers used to look after them. The clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order took zero trust, a phrase worn thin by marketing, and turned it into three plain demands any organization can test system by system: verified identity, retained evidence and accountable software.
Week of 22 February 2021
A few hours without Fedwire, and the bank promises with no fallback
Little lasting harm came of the Federal Reserve’s February 24, 2021 outage. It still revealed how few banks had mapped which customer promises rest on a single central payment rail, rehearsed the narrow manual alternatives, or planned for the backlog afterward.
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached government agencies through an aging file transfer appliance few senior officials could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern kept returning through other products for years.
Week of 25 January 2021
GameStop’s buy button was switched off in the clearinghouse
Retail brokers stopped customers buying GameStop on January 28, 2021, for reasons buried deep in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app work as one system, even though three different teams own them.