63 articles · Security & Resilience · page 2 of 4
Articles
Week of 22 July 2024
Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security
KnowBe4 hired a remote engineer who turned out to be a North Korean IT worker. The scheme worked by slipping through four hand-offs owned by different teams. It fails when one verified identity follows the hire from interview to daily work.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal with no second login check, about sixteen months after the deal closed. For health care buyers, inherited internet-facing doors belong in the deal terms, the first weeks after closing and the boardroom.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
In March 2024, the White House and EPA wrote to every governor about attacks on water systems, inviting each state’s environmental, health and homeland security secretaries. That guest list was the story: one problem, three offices, and rarely anyone in charge of all three.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
Ransomware at the largest US claims clearinghouse left every connected hospital, practice and pharmacy with a hard call, fast. Pulling the plug was easy. Knowing what to unplug, and what proof to demand before plugging back in, took homework few had done.
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
A video call full of familiar, fake faces persuaded one employee to send about US$25 million. The fraud beat a meeting, not a payment system. Banks need controls at the invitation, inside the meeting and at the handoff to money.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The fake bitcoin ETF post from the SEC’s X account landed one day before the real approval, when markets would believe it. Agencies whose words move markets or behavior should guard official accounts as privileged credentials, by the calendar and for the audience.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
In December 2023 the FBI disrupted the ALPHV ransomware gang and handed hundreds of victims a free decryption tool. Taking that help well meant three things few agencies plan for: checking the offer is real, using the tool safely and keeping legal deadlines.
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
Ransomware hit ICBC’s U.S. broker-dealer in November 2023, and Treasury trades still had to settle that day. Every firm in the market could have been sitting in any of three seats, and each seat needed its own plan, written well before the crisis.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers inside Okta’s support system reused live sign-in tokens found in files customers had uploaded for troubleshooting. Health systems send vendors logs and screenshots daily, and each one’s risk depends on what it contains, what HIPAA says it is, and how long it stays usable.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks began with phone calls to help desks and ended with control of identity systems. What mattered for banks was a handful of powerful accounts: how they are recovered, who may recover them, and how a takeover would be spotted.
Week of 4 September 2023
Storm-0558’s post-mortem described three key failures every agency development team can repeat
Microsoft’s September 2023 post-mortem told a story of a signing key it believed slipped out in diagnostic data, tokens trusted far beyond their purpose, and a key that lived for years. Agencies that build their own software carry all three risks themselves.
Week of 5 June 2023
Most MOVEit victims never ran MOVEit
MOVEit reached thousands of organizations through the payroll, pension and contractor firms that ran it for them. Those clients had nothing to patch. What mattered was how fast they found affected vendors, who notified whom, and how much data they had handed over.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
In May 2023 officials described a state-backed intruder inside US infrastructure that used everyday admin tools and hijacked home routers instead of malware. Catching it meant knowing what normal looks like, owning the network edge, and planning to run without a trustworthy network.
Week of 6 February 2023
One console, every server: what ESXiArgs exposed about the hypervisor
ESXiArgs used a flaw fixed two years earlier, but the damage came from where it struck. Hit the software that runs all your servers, and one break-in can lock every machine, slip past most security tools and reach the backups too.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
Ransomware at ION’s cleared derivatives unit took the same back-office tool away from firms across the market on the same day. The risk sat with a specialist vendor few boards had heard of, and every firm has some.
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s covert takedown of the Hive ransomware group spared many victims, hospitals among them, from paying. But it removed one criminal brand. The hired attackers, their methods and the hospital weaknesses they exploited were untouched, and each needed a different response.
Week of 14 November 2022
What Hive’s victims gained by calling the FBI early
The FBI had held Hive ransomware’s decryption keys for months when federal agencies warned health care about the gang, and victims who reported got them. Health systems should decide now when to call, what to share and how reporting fits their other deadlines.
Week of 31 October 2022
How hospitals spent the OpenSSL week waiting for ‘not affected’
A week’s warning of a critical OpenSSL flaw should have made the answer easy. For health systems, it hinged on suppliers saying their products were not affected, and few hospitals could get that reassurance quickly, in usable form, or at all.
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s online government services was after public embarrassment, not ransom. When disruption itself is the goal, agencies must keep a basic service visible, push back on the attacker’s version of events, and know who decides whether to name the culprit.
Week of 22 August 2022
LastPass and the first-draft problem in vendor breach notices
In August 2022, LastPass said thieves had taken source code but no customer data. The attacker’s next move was already under way. The real test for customers was reading that first notice for what it made possible, and being ready to change every password.