100 articles · Government · page 4 of 5
Articles
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
Days after ransomware hit its systems, the second-largest school district in the country opened its doors on schedule. It could, because teaching a class needs very few computers. The hard parts were resetting access for an enormous population and telling families what to do.
Week of 15 August 2022
Why the IRS’s ten-year budget needed a one-year payoff
The Inflation Reduction Act handed the IRS about 80 billion dollars over a decade, and opponents vowed to claw it back from day one. When long-term money can vanish, every year’s spending has to be worth having on its own.
Week of 11 July 2022
988 launched without 911’s plumbing: location, dispatch and a fee
In July 2022 the national crisis line got an easy three-digit number, 988, but none of the hidden machinery that makes 911 work. States inherited three gaps: no caller location, no settled way to send help, and no dedicated funding.
Week of 27 June 2022
A rule’s survival odds belong in the compliance plan
West Virginia v. EPA gave courts a named test for striking down ambitious rules. That turned a rule’s survival into something agencies and regulated organizations must estimate: in writing new rules, defending existing programs and deciding when to spend on compliance.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s promise not to charge good-faith security research made it more likely that outsiders would report flaws. For agencies, that created practical homework: a front door for reports, a route to whoever can fix the problem, and a way to close the loop.
Week of 2 May 2022
Quantum risk is dated by how long your data must stay secret
NSM-10 set 2035 as a national goal. For any single agency system, though, the real deadline comes sooner: how long its data must stay secret, plus how long fixing it will take, measured against when a code-breaking machine might exist.
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
In April 2022, federal agents cleaned up a botnet Russian military intelligence had built from small, forgotten firewalls. The warning for public agencies: an unmanaged edge device can serve someone else’s operations long before it causes a breach of your own.
Week of 31 January 2022
One door is not a service: the IRS selfie reversal
In February 2022 the IRS stepped back from making selfie verification mandatory. The reason matters to any public service: one way of proving identity, however good at stopping fraud, shuts out part of a population that includes almost everyone.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told federal agencies to use logins that phishing cannot defeat. That worked, and it sent attackers somewhere else: to the moments when credentials are issued, replaced and reset, a job run by help desks the memo barely mentioned.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
Dressed as ransomware, WhisperGate simply destroyed data, leaving no key to buy. For US public agencies, it exposed continuity plans that silently counted on paying as a last resort, and recovery times nobody had measured from total loss.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
In December 2021, ransomware knocked a cloud timekeeping service used by cities, transit agencies and public hospitals offline for weeks. The vendor had to rebuild its platform. Each employer still had to pay its people correctly, keep the time record and honor the law.
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s $1 billion cybersecurity grant came with a local share that rose every year. That forced states and localities to decide early what they would keep paying for once the federal money stopped.
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
In November 2021, CISA stopped asking federal agencies to chase every scary-sounding flaw and handed them a short list of the ones attackers were actually using, with a deadline. The real story is what that did to patch teams, system owners and asset inventories.
Week of 4 October 2021
Why a security attestation to government now carries fraud risk
In October 2021 the Justice Department said it would use a fraud law against contractors and grantees whose security promises outran their practice. Overnight, a signature on a security form became a personal and financial risk for whoever signed it.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
In August 2021, big companies pledged at the White House to train hundreds of thousands of people in cybersecurity. For public agencies, the talent shortage had three parts: supply, access and retention. The pledges tackled the first. Agencies held the keys to the other two.
Week of 2 August 2021
The paper card that made Key to NYC’s digital pass work
New York City’s August 2021 vaccination requirement accepted slick digital passes and the humble paper CDC card alike. That paper fallback carried the program through patchy records and untrained door staff, and it is the design choice any agency issuing digital credentials should copy first.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
In July 2021, the White House promised cybersecurity goals for the systems that run infrastructure. But voluntary goals need an owner, a budget and a reason to act. Most small water systems had none, and only local officials could supply them.
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
In June 2021 the Supreme Court decided that looking up records you are allowed to reach, for a bad reason, is generally not a federal computer crime. For agencies holding sensitive records, protection now rests on controls they own: access design, query monitoring and consequences.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
Less than three weeks after Colonial Pipeline, regulators gave critical pipelines twelve hours to report a cyber incident, a named coordinator on call around the clock and thirty days to grade themselves. All three ideas spread across sectors, and each needs different preparation.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order took zero trust, a phrase worn thin by marketing, and turned it into three plain demands any organization can test system by system: verified identity, retained evidence and accountable software.