63 articles · Security & Resilience · page 3 of 4
Articles
Week of 4 July 2022
Rogers: the bank outage that started at someone else’s carrier
One Canadian carrier went dark for most of a day, and debit cards stopped working nationwide, even at banks that had never bought a Rogers line. Telecom dependency hides in places a two-carrier policy cannot reach.
Article · 21 June 2022 · Simon Malian
The Rising Threat of Medical Device Hacking & How Healthcare Organizations Can Prevent It
All attacks on the healthcare industry are vital to address. We believe the most pressing area to mitigate is the hacking of medical devices.
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
In April 2022, a federal advisory described North Korean operators courting crypto-firm engineers with fake job offers and booby-trapped apps. For financial firms, a recruiter’s message reaches the people with the most access through a channel security rarely watches, so assume one will succeed.
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
In April 2022, federal agents cleaned up a botnet Russian military intelligence had built from small, forgotten firewalls. The warning for public agencies: an unmanaged edge device can serve someone else’s operations long before it causes a breach of your own.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
In March 2022, Okta revealed that a support engineer at one of its subcontractors had been compromised. For hospitals that run every clinical login through one identity provider, the real exposure was two months of silence, and the logs they never kept.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
Dressed as ransomware, WhisperGate simply destroyed data, leaving no key to buy. For US public agencies, it exposed continuity plans that silently counted on paying as a last resort, and recovery times nobody had measured from total loss.
Week of 18 October 2021
BlackMatter’s reach was set by the directory, not the malware
The October 2021 BlackMatter advisory described an unglamorous attack: intruders walked in with stolen passwords and simply asked the company directory where everything was. How far one login could travel had been decided years earlier, by how access was designed.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
In July 2021, the White House promised cybersecurity goals for the systems that run infrastructure. But voluntary goals need an owner, a budget and a reason to act. Most small water systems had none, and only local officials could supply them.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
Ireland’s health service is remembered for the morning its hospitals went to paper. The independent review told a less dramatic, more useful story: the outcome was settled during nearly eight unnoticed weeks, across three stages of entry, dwell and response.
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on the threat of publication. Good planning starts by asking which data would hurt whom if released: the workforce, the mission or the public.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again ranked business email compromise as the costliest kind of online fraud. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 1 March 2021
ProxyLogon: the patch was the easy part
Hidden flaws in Microsoft’s email server software set off a race to patch in March 2021. For public agencies, the damage was decided by three gaps no patch could close: seeing what faced the internet, hunting intruders, and owning the retirement decision.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that tells the two apart, safeguards that work whoever is at the controls, and public statements that survive revision.
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
On paper, the banking agencies’ proposed incident notification rule was a simple deadline. The harder work came before the clock started: a named person deciding what counts as a material disruption, and vendor warnings that reach that person in time.
Week of 4 January 2021
Credit for security practice, payable only in arrears
Signed on January 5, 2021, a short HITECH amendment told regulators to go easier on breached organizations with recognized security practices. The catch: it takes a year of practice already running, so the credit is earned only before an incident, with everyday evidence.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The SolarWinds Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are harmless plumbing, and that federal sensors would spot a national-scale intrusion. Only the second was quick to fix.
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
A ransomware attack in Düsseldorf is remembered for a disputed death. Its lasting message for health systems is regional: when one hospital closes its doors to ambulances, the risk moves onto crews and neighboring hospitals that rarely plan for it, or measure it.
Week of 20 July 2020
The control system map most operators did not have
On July 23, 2020, the NSA and CISA urged immediate action to protect the systems that run pumps, chillers and power. Their first and hardest request was an accurate map of what was actually connected, something few utilities, hospitals or data center operators had.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center files through the breach of one small web firm. Each agency had weighed its own modest contract; nobody had weighed the shared platform, the archive piling up on it or everyone who could log in.
Week of 4 May 2020
Password spraying against research labs: an old attack on a new target
In May 2020, US and UK cyber agencies warned that state-backed hackers were guessing common passwords across health and research organizations to reach COVID-19 work. The defenses were familiar; applying them across academic medicine’s tangle of accounts, data and remote access was harder.