52 articles
January 2020
Week of 6 January 2020
Travelex’s outage was every white-label bank’s outage
When ransomware took Travelex offline, banks that sold its travel money under their own brands had no service and little to say. White-label dependencies carry the bank’s reputation, so they need the bank’s controls: communication, contract terms and concentration planning.
Week of 13 January 2020
Why a Windows crypto patch was an asset inventory test
CISA gave agencies ten business days to patch a Windows cryptographic flaw, on the day Windows 7 support ended. Applying the fix was the easy step. Knowing which systems needed it, who owned them and how to prove it was the hard one.
Week of 20 January 2020
Citrix gateways: the most exposed system in the hospital
The Citrix flaw exploited in January 2020 showed that the gateway clinicians used to reach the EHR from outside was a hospital’s most exposed system. Hardening it meant ownership, segmentation behind it and a hunt after every patch.
Week of 27 January 2020
A 90-day declaration that ran for three years
The federal public health emergency declared on January 31, 2020, looked like a precaution. Other authorities, new laws and agency systems came to depend on it, so agencies needed to track what rested on it from the start, not when it ended.
February 2020
Week of 3 February 2020
Iowa’s caucus app failed at rollout before it failed in code
The Iowa Democratic caucus app had a coding error, but the public failure came from hard installation, untrained users and a fallback phone line nobody had sized. Every agency launch carries the same three operational risks.
Week of 10 February 2020
What the Equifax indictment changed for banks, and what it did not
The Justice Department charged four Chinese military officers over the 2017 Equifax breach. For banks, the indictment settled who did it and changed nothing that mattered operationally: the data stayed exposed, the entry point stayed ordinary and accountability stayed with the data holder.
Week of 17 February 2020
Morgan Stanley and E*Trade: wealth scale is a client-data problem
Morgan Stanley’s deal for E*Trade, months after Schwab agreed to buy TD Ameritrade, bet on joining self-directed, advised and workplace channels. Whether such scale pays depends on three layers of integration, and the client layer comes first for firms of any size.
Week of 24 February 2020
Buildings intact, workforce gone: the scenario continuity plans skipped
As markets fell and federal health officials warned of community spread, most continuity plans still assumed the loss of a building. A pandemic removes people, suppliers and remote capacity at once, and plans had to be rebuilt and tested around those three losses.
March 2020
Week of 2 March 2020
Why the FFIEC’s pandemic statement was an evidence checklist
The FFIEC’s March 6, 2020, statement restated pandemic expectations from the avian flu era. Its value lay in what examiners would later ask institutions to show: staged decisions, critical operations run with fewer people, and service providers coping with the same disruption.
Week of 9 March 2020
Interoperability rules sent patient data beyond HIPAA’s reach
The ONC and CMS rules of March 9, 2020, prohibited information blocking and required standardized patient APIs. Together they moved patient data, at patients’ direction, into apps HIPAA does not cover, so health systems had to govern flows they could no longer refuse.
Week of 16 March 2020
Hairpin traffic, distant data centers and the road to federal zero trust
When OMB told agencies to maximize telework, the binding constraint was a network design that sent remote traffic back through agency data centers and Trusted Internet Connections. Fixing it pushed federal security from location toward identity and device.
Week of 23 March 2020
Forbearance on request: what the CARES Act asked of loan servicers
The CARES Act gave borrowers with federally backed mortgages forbearance on request and told lenders how to report accommodated accounts. Servicing built for case-by-case exceptions had to run intake, credit reporting and exit planning at volume, mostly from home.
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
CMS’s March 30, 2020, waivers let care move to new sites, new staff and video. Every claim and record still had to state where, by whom and how, and the systems that captured those facts had assumed the old answers.
April 2020
Week of 6 April 2020
Paycheck Protection: capital was easy, intake was hard
When the Paycheck Protection Program opened on April 3, 2020, the guarantee and the Fed facility solved funding. Lenders’ capacity was set instead by intake, verification and submission to SBA, and by how fast they could redeploy staff into a standardized process.
Week of 13 April 2020
Why exposure notification apps rose or fell on the back office
Apple and Google’s framework settled the privacy design of exposure notification for health agencies. Whether an app helped depended on what agencies controlled: test verification codes, the advice an alert triggered, and the effort put into adoption.
Week of 20 April 2020
Zoom 5.0 fixed the vendor layer; configuration and records stayed yours
Zoom’s April 2020 release improved encryption and tightened defaults after weeks of scrutiny. For banks, health systems and agencies, most compliance risk sat in two layers no vendor release could fix: how the platform was configured, and what meeting content had to be kept.
Week of 27 April 2020
For many Medicare patients, telehealth meant a phone call
CMS’s April 30, 2020, rule paid audio-only visits at levels comparable to office visits. For many older, rural and low-income patients the phone was the only telehealth that worked, so it needed its own workflow and controls.
May 2020
Week of 4 May 2020
Password spraying against research labs: an old attack on a new target
The May 5, 2020, CISA and NCSC advisory warned that state-backed groups were spraying passwords at health and research organizations to reach COVID-19 research. The defenses were familiar; applying them across academic medicine’s split identities, data stores and remote access was the hard part.
Week of 11 May 2020
Every unemployment fraud control had a cost to real claimants
In May 2020, federal warnings about organized fraud against state unemployment systems pushed agencies to add identity checks to overloaded services. Each control point, at application, before payment or after it, shifted cost onto legitimate claimants in a different way.
Week of 18 May 2020
Small-dollar loans, alternative data and the governance attached
The May 2020 interagency principles invited banks and credit unions back into small-dollar lending and accepted new data and technology in underwriting. Using cash-flow data responsibly required three disciplines: consented data access, model risk management and fair lending controls for automated decisions.
Week of 25 May 2020
Why valid when made left bank-fintech lenders two open questions
The OCC’s May 29, 2020, rule said a national bank loan’s permissible interest survives its sale. That settled one question for bank-fintech lending. It left open who the true lender is, and how the bank proves it oversees the program.
June 2020
Week of 1 June 2020
UCSF’s ransom decision was shaped long before the attack
The NetWalker attack on servers at UCSF’s School of Medicine, and the university’s decision to pay, show that a ransom choice is largely settled in advance. Backups, data placement, insurance terms and advisers on retainer decide how much room leaders have.
Week of 8 June 2020
When vendors set facial recognition policy before agencies did
IBM, Amazon and Microsoft stepped back from selling facial recognition to police within days in June 2020. Agencies discovered that suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.
Week of 15 June 2020
What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, and €1.9 billion of its cash probably never existed. Partners relying on those signals learned that three checks cannot be delegated: where the money comes from, whether customer funds are visible, and how to leave.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center documents through the compromise of one web development firm. Each agency had judged a small contract; nobody had judged the shared platform, its accumulated archive or its sprawling user base.
Week of 29 June 2020
Why Form CRS was the easy part of Regulation Best Interest
Broker-dealers had to comply with Regulation Best Interest and deliver Form CRS from June 30, 2020. The disclosure document was a contained project. Showing that each recommendation met the standard, and that conflicts were controlled, required data most firms did not capture.
July 2020
Week of 6 July 2020
Why hospital COVID reporting turned out to be infrastructure
In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and report through a new HHS pathway. The switch showed that reporting depends on definitions, pipelines and governance, and that hospitals relying on manual counts paid for every change.
Week of 13 July 2020
Schrems II and the case for deciding where data lives first
The EU’s highest court invalidated the EU-US Privacy Shield on July 16, 2020, and made standard contractual clauses depend on case-by-case assessment. Organizations that settled data location and key control first found the legal paperwork easier, and survived later swings in the law.
Week of 20 July 2020
The control system map most operators did not have
The NSA and CISA alert of July 23, 2020, urged immediate action to protect control systems. Its first and hardest request was an accurate map of what was actually connected, which municipal utilities, hospitals and data center operators rarely had.
Week of 27 July 2020
Lifespan’s stolen laptop and the home office risk analyses missed
OCR’s July 2020 settlement with Lifespan turned on an unencrypted laptop, a weak device inventory and missing agreements. It landed as health care’s administrative staff settled in at home, where HIPAA risk analyses written for hospital buildings had not followed them.
August 2020
Week of 3 August 2020
Capital One’s cloud penalty was a verdict on sequencing
The OCC’s $80 million penalty did not say the cloud was unsafe. It said a bank moved critical operations before its risk management could describe, test and monitor them, and it priced that gap.
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
SP 800-207 is remembered for its architecture diagrams. Its lasting effect was a list of prerequisites, about assets, identities, data and telemetry, that most agencies could not yet meet and no product could supply.
Week of 17 August 2020
Why the Postal Service slowdown belonged on agency risk registers
The August 2020 mail controversy was covered as an election story. For agencies that send notices, payments and medications, it exposed a channel dependency with statutory deadlines attached and no owner inside the agency.
Week of 24 August 2020
Low for long: the rate forecast hidden in bank technology budgets
The Fed’s August 2020 framework change gave banks a credible reason to plan for years of near-zero rates. Many technology business cases quietly assumed it, in deposit forecasts, channel metrics and contract terms that later came due.
Week of 31 August 2020
Blackbaud’s breach exposed patient data that fundraising never needed
The Blackbaud ransomware incident reached health systems through their foundations. It showed that philanthropy databases held more patient information, for longer, than HIPAA’s fundraising permission required, and that minimization is the control that still works after the others fail.
September 2020
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
The Düsseldorf ransomware attack is remembered for a disputed death. Its lasting lesson for health systems is regional: cyber diversion moves clinical risk onto ambulances and neighboring hospitals that rarely plan for it, and rarely measure it.
Week of 14 September 2020
Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files
In one September week, FinCEN asked how to define an effective AML program and leaked reports showed banks filing dutifully while flagged activity continued. The gap between volume, usefulness and action was a data and decision problem that compliance metrics hid.
Week of 21 September 2020
What a nationwide EHR outage at UHS asked of nurses and unit leaders
When Universal Health Services lost systems across its network in September 2020, the downtime binder mattered less than whether staff trained on electronic records could run a unit on paper for days, and then put it all back.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and the firms that help them pay, which moved the decision from the crisis room into a governed, documented compliance process.
October 2020
Week of 5 October 2020
Citi’s orders put data lineage on the safety and soundness agenda
The October 2020 actions against Citigroup treated weak data governance as a safety and soundness failure, alongside risk management and controls. Every bank inherited the expectation that it can show where its important numbers come from and who answers for them.
Week of 12 October 2020
Why one phone call beat Twitter’s login controls
New York’s report on the Twitter hack described a phone call and a fake login page, not an exploit. With staff dispersed, the people who verify callers and reset credentials were a control most organizations had never designed, staffed or measured as one.
Week of 19 October 2020
Antitrust moves in years; vendor dependency is set at signing
The Justice Department’s search case opened a long fight over platform power. For regulated buyers it offered no relief on their own concentration risk, which is decided in contracts, architecture and tested exit plans on a timeline no court can match.
Week of 26 October 2020
Price transparency files: mandated, massive and hard to read
The Transparency in Coverage rule mandated publication of negotiated rates, not their usability. Whether the files were worth anything depended on volume, meaning and accountability, three engineering and governance problems the rule left to plans, employers and intermediaries.
November 2020
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator dedicated to privacy. Banks and health systems that assumed federal law exempted them found that California exempts data governed by GLBA or HIPAA, not institutions, and that the remainder needed operational plumbing.
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. The hardest constraint for public agencies was data: matching people without a national identifier, agreeing who could see records, and onboarding hundreds of new sources in weeks.
Week of 16 November 2020
Permission to donate cybersecurity arrived without the money to run it
New fraud-and-abuse protections let hospitals give cybersecurity to physician practices without cost sharing. The rule removed a legal obstacle; whether anything changed depended on donor economics, recipient capacity and who would operate the tools year after year.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition compressed a process that moves people and their access, records and accounts, and programs already in flight. Each needs its own runbook, prepared by career staff long before any election.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for manufacturers. It set rules for one very large customer. That shifted vulnerability-handling duties onto contractors and exposed an older problem: agencies cannot apply device rules to devices they have not inventoried.
December 2020
Week of 7 December 2020
Patient access is won or lost at the records counter
HHS’s December 2020 proposal to speed up patient access to records stalled, but it named the three places access actually fails: the response clock, the identity check and the delivery path. All three are operational, and none needed a final rule.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are low-risk plumbing, and that federal sensors would catch a national-scale intrusion. Only the second was quick to fix.
Week of 21 December 2020
How the No Surprises Act turned a medical bill into four data handoffs
The No Surprises Act was written as consumer protection. In practice it made the patient’s financial experience depend on four handoffs between schedulers, billing systems, health plans and an arbitration portal, and on whoever owned each one.
Week of 28 December 2020
Why the ownership registry never replaced the bank’s own file
The Anti-Money Laundering Act of 2020 promised banks a federal register of who owns companies. The register was later cut back, the bank’s own due diligence duty stayed, and a new whistleblower channel changed who could report weak programs.