56 articles · Cross-sector · page 2 of 3
Articles
Week of 8 April 2024
How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never became law. Its most distinctive idea, letting individuals act directly through requests, automatic opt-out signals and lawsuits, is arriving anyway through the states, and that is where privacy programs are now judged.
Week of 26 February 2024
CSF 2.0’s biggest addition was the one a security team could not deliver
NIST’s refreshed cybersecurity framework added a new function called Govern. It looked like a technical update. In fact it hands work to executives, HR, procurement and the board, and organizations that left it to the security chief missed what had changed.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Russian state hackers read Microsoft executives’ email by way of a forgotten test account and an old app with too much power. Any “non-production” identity deserves three tests: who can log in to it, what it can reach and who would notice.
Week of 25 December 2023
Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers
Banks, health systems and agencies were not parties to The New York Times’s December 2023 lawsuit against OpenAI and Microsoft. It still reached them in three ways: through the vendor promises they relied on, the content they published and the prompts their vendors kept.
Week of 20 November 2023
Why the useful response to OpenAI’s board crisis was a days-to-switch number
No vendor questionnaire could have predicted OpenAI’s November 2023 boardroom upheaval. What regulated buyers could control was how costly it would be to move away from any one AI provider, and that came down to contracts, architecture and fallbacks.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A major security logging platform changing hands exposed where the real lock-in sits: years of logs the rules require you to keep, detection rules written in one vendor’s language, and the wiring around them. Each can be freed before the next deal.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
In July 2023 the SEC gave public companies four business days to disclose a material cyber incident, counted from when they decide it is material. So the decision itself needs governing: who makes it, what record it leaves, how it fits other deadlines.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
In one week, Colorado and Connecticut switched on their privacy laws and a California court paused new rules a day before enforcement. When deadlines move like that, the steadier approach is to build four lasting capabilities and map each new law onto them.
Week of 12 June 2023
Why the AI Act’s obligations follow your role, not your sector
The European Parliament’s June 2023 AI Act vote made headlines for generative AI. For banks, health systems and agencies, the lasting point was simpler: duties depend on whether you build an AI system, use one, or build on a general-purpose model. Many do all three.
Week of 5 June 2023
Most MOVEit victims never ran MOVEit
MOVEit reached thousands of organizations through the payroll, pension and contractor firms that ran it for them. Those clients had nothing to patch. What mattered was how fast they found affected vendors, who notified whom, and how much data they had handed over.
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no new rules. It simply said existing lending, employment, housing and consumer protection law already reached automated systems, which made the organization using a model answerable for its data, its opacity and its use, whoever built it.
Week of 6 February 2023
One console, every server: what ESXiArgs exposed about the hypervisor
ESXiArgs used a flaw fixed two years earlier, but the damage came from where it struck. Hit the software that runs all your servers, and one break-in can lock every machine, slip past most security tools and reach the backups too.
Week of 5 December 2022
Rackspace kept running old Exchange for clients, and kept its old risks
Ransomware at Rackspace’s hosted Exchange email showed customers that paying someone to run aging software hands over the work, not the risk. They needed three things their contracts rarely spelled out: a way to patch, a way out and a way back.
Week of 22 August 2022
LastPass and the first-draft problem in vendor breach notices
In August 2022, LastPass said thieves had taken source code but no customer data. The attacker’s next move was already under way. The real test for customers was reading that first notice for what it made possible, and being ready to change every password.
Week of 25 July 2022
Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s
The CHIPS and Science Act passed while network switches and servers sat on back order. It was about where chips would be made in the 2030s. IT leaders needed separate answers, on separate timescales, for the backlog, the refresh plan and provenance.
Week of 18 July 2022
Necessary and proportionate: the ADPPA test that outlived the bill
A federal privacy bill cleared committee 53 to 2 and then stalled before a floor vote. Its central idea, collect only what you genuinely need, outlived it, and banks and hospitals were more exposed to that idea than their sector exemptions suggested.
Week of 6 June 2022
Your carrier’s routers belong in your threat model
A joint US advisory described state hackers getting inside the telecom companies that carry everyone’s traffic. For the businesses that buy those services, the message was blunt: treat the carrier’s network as untrusted, its engineers as privileged users, and its silence as a blind spot.
Week of 23 May 2022
An acquisition announcement is a free option on your exit plan
Broadcom’s deal to buy VMware gave customers eighteen months before anything changed. The organizations that fared best treated that time as a cheap option: they priced a way out, kept it alive with small investments, and used it, on evidence, at renewal.
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day clock on reporting cyber incidents. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and those words would become a standard others could test.
Week of 21 February 2022
Shields Up had no end date, so vigilance needed a staffing plan
Russia’s invasion of Ukraine brought a request from CISA for every US organization to raise its guard, with no date to lower it. Staying alert for months turned out to be a management problem: who watches, who decides, and what work stops.