63 articles · Security & Resilience · page 1 of 4
Articles
Week of 12 October 2026
Ivanti’s October zero-day was a directory incident that came in through the VPN
CISA gave agencies three days to patch and triage Ivanti Connect Secure. The attacker left no implant on the gateway and used its directory account to hunt for administrator passwords and BitLocker keys. Permissions set long before decided how far that reached.
Week of 7 September 2026
Europe’s 24-hour vulnerability clock reports to regulators first and customers second
From September 11, 2026, Europe’s Cyber Resilience Act gave manufacturers 24 hours to warn authorities when attackers exploit a flaw in their products. Customers must be told too, but on no fixed clock, so buyers still need their own way to hear about it.
Week of 31 August 2026
Bank cyber gaps now arrive as observations the board never has to see
Two bank regulators narrowed formal findings to problems that threaten material financial harm, a year after a shared cyber checklist was retired. Many cyber weaknesses will now arrive as informal observations, so banks must decide for themselves what reaches the board.
Week of 8 June 2026
Why World Cup cyber risk sat in the city services residents use every day
The stadiums had federal, state and venue security teams. The cyber risk host cities owned sat somewhere less obvious: in the everyday services around the matches, from parking sites and traffic signals to 911 dispatch and the vendors neighboring cities share.
Week of 18 May 2026
Searching by balance: how bribed bank insiders choose their targets
Bank insider cases prosecuted in 2026 show bribed employees selling three things: the search that finds wealthy customers, the screens that expose them, and the overrides that open doors. A bank can control all three without first catching the insider.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
New research in spring 2026 lowered estimates of what a quantum computer would need to break today’s digital locks. For agencies, the urgent part was proof of identity rather than secrecy: certificates, smart cards and device keys take longest to replace.
Week of 6 April 2026
When AI made flaws cheap to find, banks’ patch queues set the pace
An AI model that could find serious software flaws prompted a meeting with bank chief executives, yet most banks could not use it. Their test was how fast they could install the fixes that would follow.
Week of 9 March 2026
Stryker’s wipe made a supplier’s admin console a hospital supply risk
The attack on Stryker reportedly turned the company’s own device-management tools into an eraser, with no ransom and no patient data at stake. It reached hospitals through orders and shipments, a dependency most vendor risk reviews never look at.
Week of 2 March 2026
Iran’s war tested banks’ decision rights more than their defenses
After the strikes on Iran, the cyber warnings named old tricks banks already knew how to stop. The harder test was judgment under pressure: what to fix first, who could override a change freeze, and what to ask of the providers banks depend on.
Week of 6 October 2025
Cl0p’s Oracle campaign: an attack on the systems security teams did not run
Cl0p’s Oracle E-Business Suite extortion wave worked because the finance system sat with finance, not security. Closing that gap takes three decisions: who can pull the plug in an emergency, what faces the internet, and how much old data the system keeps.
Week of 22 September 2025
Persistence below the patch: what ED 25-03 asked agencies to prove about their firewalls
CISA’s Emergency Directive 25-03 described attackers who hid inside the startup code of Cisco firewalls, surviving restarts and upgrades. Applying a fix was no longer enough. Agencies had to prove each device could be trusted, and that the fix was the right one.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was really three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each needs a different owner, a different clock and a different fix.
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
A hacking group known for working through one industry at a time reached U.S. insurers in June 2025, and a warning became a deadline. Financial firms needed a pre-agreed surge mode: a clear trigger, tighter help-desk rules and containment planned around stolen identities.
Week of 7 April 2025
Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess
The OCC’s email breach showed that a bank’s most candid account of its own weaknesses sits with a regulator it can neither audit nor replace. Banks still control what they write, how it travels and how they respond when the holder is breached.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa warning read like a shopping list of the remote-access tools hospitals and clinics rely on every day. Stopping attacks like it means governing those tools at three moments: getting in, moving around and switching off defenses.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record beat a multi-person approval process without breaking it: attackers simply changed what the approvers saw on screen. Any bank approving payments through software carries the same risk at four points, from how the screen is built to recovery.
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Set the politics aside and the fight over access to Treasury’s payment systems becomes a rare public lesson in who can touch the money. It came down to four separate controls, and to whether each could be proved rather than simply asserted.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers walked into Treasury workstations using a stolen key from a vendor’s cloud remote-support service, a key the agency never held. Remote support is powerful insider access by another name, and governing it takes four controls most organizations only partly have.
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS proposed turning HIPAA’s flexible security safeguards into firm requirements. Most were controls hospitals already had or paperwork they could build. One was different: being able to restore key systems within 72 hours, which needed clinical planning, tested capacity and real money.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no new rules. Because the CEO and security chief already sign a yearly compliance certification, though, it turned four AI risks into evidence those executives must be able to show.