52 articles
January 2021
Week of 4 January 2021
Credit for security practice, payable only in arrears
A short HITECH amendment signed on January 5, 2021 told HHS to weigh recognized security practices when penalizing breaches. The credit requires a year of practice already in place, so it can only be earned before an incident, with evidence produced by daily operations.
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
The banking agencies’ proposed notification rule looked like a deadline. The harder work sat upstream of it: a named judgment about what counts as material disruption, and vendor notices that reach the people making that judgment in time.
Week of 18 January 2021
Vaccine access hinged on open appointments nobody could see
In January 2021, vaccine eligibility widened faster than states could show where doses were. Scheduling failed less from web traffic than from three ownership gaps: eligibility rules, appointment inventory held by partners, and assisted channels treated as overflow.
Week of 25 January 2021
GameStop’s buy button was switched off in the clearinghouse
When retail brokers stopped customers buying GameStop on January 28, 2021, the cause sat in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app are one system, though three teams own them.
February 2021
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached agencies through an aging file transfer appliance few leaders could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern returned through other products for years.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that can tell the two apart, safeguards that work whoever acts, and public statements that survive revision.
Week of 15 February 2021
Why working from home failed when Texas froze
A year into the pandemic, many continuity plans answered every site outage with remote work. Winter Storm Uri removed power, water, roads and home connectivity together, showing that a single fallback fails when failures are correlated across people, sites, networks and suppliers.
Week of 22 February 2021
A few hours without Fedwire, and the bank promises with no fallback
The Federal Reserve’s February 24, 2021 outage caused little lasting harm. It still showed how few banks had mapped which customer commitments rest on a single central rail, rehearsed the narrow manual alternatives, or planned for the backlog afterward.
March 2021
Week of 1 March 2021
ProxyLogon: the patch was the easy part
The March 2021 Exchange Server zero-days looked like a patching race. For public agencies, the damage was decided by three gaps a patch could not close: knowing what faced the internet, hunting for intruders afterward, and owning the decision to retire the platform.
Week of 8 March 2021
One-time money, recurring bills: the Rescue Plan’s technology hangover
The American Rescue Plan gave state and local governments $350 billion of flexible, temporary money. Where it paid for subscriptions, the risk sat in three places: the shape of the funds, the shape of the costs, and contracts signed in a hurry.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again put business email compromise at the top of its loss table. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 22 March 2021
Each Archegos lender already held enough data to act
Archegos is usually told as a story of positions hidden across many prime brokers. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
The March 2021 interagency request for information on AI produced no new rule. Its questions mapped onto four supervisory tests that existing rules already imposed, and that examiners still apply to any model in a bank or credit union.
April 2021
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
When the Cures Act information blocking rules applied on April 5, 2021, health systems discovered that compliance was decided by portal settings and release-of-information queues. Three operational questions mattered: what gets released, when, and how a withholding decision is defended.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 agreement to buy Nuance put ambient clinical documentation inside a large cloud platform. For health systems, the decisions that mattered concerned the encounter recording itself, the review workflow around the draft note, and the contract governing both.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted banks’, hospitals’ and agencies’ AI by business process, which put compliance ownership with process owners as much as data scientists.
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on disclosure. Planning had to start from which data would hurt whom if published: the workforce, the mission, or the public.
May 2021
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
Scripps Health spent most of May 2021 without its electronic health record after a ransomware attack. Downtime plans written for hours failed over weeks on three separate fronts: clinical continuity, revenue continuity and workforce endurance.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order turned a marketing term into three demands any agency can test system by system: verified identity, retained evidence, and accountable software supply chains.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
The Conti attack on Ireland’s Health Service Executive is remembered for its national scale. Its later independent review showed the outcome was set during nearly eight weeks of undetected access, across three stages: entry, dwell and response.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
TSA’s first pipeline security directive after Colonial Pipeline imposed a 12-hour reporting deadline, a named coordinator and a 30-day self-assessment. Each became a template that regulators copied across sectors, and each needed a different internal capability.
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
The Supreme Court’s June 2021 Van Buren decision took most purpose-based insider misuse out of the federal computer crime law. For agencies holding sensitive records, deterrence now rests on three controls they own: access design, query monitoring and consequences.
June 2021
Week of 7 June 2021
Why Basel’s 1,250% risk weight pointed banks toward custody
The Basel Committee’s June 2021 consultation made holding bitcoin on a bank balance sheet prohibitively expensive in capital. That split the bank crypto question into three businesses with different economics, holding, safeguarding and moving value, and only one was priced out.
Week of 14 June 2021
Juneteenth tested how many calendars a bank really runs
Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it showed that a business day is defined in three places, payment rails, customer commitments and the workforce, usually owned by different teams.
Week of 21 June 2021
TransUnion won Ramirez, and name-only matching still lost
The Supreme Court’s June 2021 ruling narrowed who can sue over inaccurate credit file flags. The facts underneath were an entity resolution failure that banks and fintechs share, and the ruling changed none of the three things that govern it.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the tools their IT providers used to manage them. Clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
July 2021
Week of 5 July 2021
Why community banks’ open banking experience sat with their core vendors
The July 2021 competition order pushed the CFPB toward a data access rule. For community banks and credit unions, the customer’s experience of sharing data was already being decided elsewhere: by core and digital banking vendors, in three moments the institution only partly controlled.
Week of 12 July 2021
A permanent telehealth benefit with an in-person clock attached
Medicare’s July 2021 fee schedule proposal made home telehealth for mental health the first permanent post-pandemic benefit. Its conditions turned continuity of care into a records problem: where the patient is, how the visit happens, and when they were last seen in person.
Week of 19 July 2021
How a bed-count fine repriced hospital price secrecy
CMS’s July 2021 proposal scaled price transparency penalties to hospital size, so the largest systems lost their cheapest option. Compliance then became a standing data product whose most attentive readers were payers, employers and competitors, not patients.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
The July 2021 national security memorandum promised cybersecurity goals for infrastructure control systems. Voluntary goals presume an owner, a budget line and a reason to act. Most small public water systems had none, and local officials, not federal agencies, were positioned to supply them.
August 2021
Week of 2 August 2021
The paper card that made Key to NYC’s digital pass work
New York City’s August 2021 vaccination requirement accepted digital passes and the paper CDC card alike. That fallback carried the program through weak records and untrained verifiers, and it is the design choice agencies issuing digital credentials should copy first.
Week of 9 August 2021
Who counts as a crypto broker mattered less than what brokers could not know
The Senate’s August 2021 fight over the infrastructure bill’s crypto provision was about who counts as a broker. For banks and brokerages, scope was never in doubt. The hard part was three kinds of data they did not hold: cost, movement and counterparties.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to store data in-country. Storage was the easy half. Personal information still left through three paths a data center map does not show: copies, remote views and derived outputs.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
Companies at the August 2021 White House cyber summit pledged to train hundreds of thousands of people. For public agencies, the shortage had three parts: supply, access and retention. Pledges addressed the first, while agencies held the levers for the other two.
Week of 30 August 2021
Hurricane Ida and the IT dependencies that sit under the EHR
After Hurricane Ida, Louisiana hospitals ran for days on generators while the grid and carrier networks were down. A week like that tests three layers beneath clinical applications, each owned by a different team: power, connectivity and hosting.
September 2021
Week of 6 September 2021
Vaccination status was the easy record; exemptions were the hard one
Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. Of the three capabilities it demanded, status records, weekly testing and exemption decisions, the third carried the lasting legal risk and was the one most organizations under-built.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
The FTC’s September 2021 policy statement said a health app that shares data without users’ authorization has suffered a breach. That moved breach prevention from the security team to three business decisions: what code ships, what partners receive, and what users agreed to.
Week of 20 September 2021
What sanctioning SUEX changed for banks that serve crypto firms
Treasury’s September 2021 designation of SUEX moved sanctions pressure from the ransom payment to the cash-out. Because SUEX worked through other exchanges, banks serving crypto businesses had to decide how far down three layers of exposure to look, and pay for it.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
When a widely used root certificate expired on September 30, 2021, valid servers stayed up and old clients broke. For health systems, the exposure sat in device and integration trust stores that no team owned or inventoried.
October 2021
Week of 4 October 2021
Why a security attestation to government now carries fraud risk
The Justice Department’s Civil Cyber-Fraud Initiative tied the False Claims Act to the gap between what contractors and grantees say about security and what they do. That moved the risk from the security team to whoever signs.
Week of 11 October 2021
FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
FinCEN’s October 2021 trend analysis showed that suspicious activity reports can map a criminal economy, but only when filers record cyber indicators in usable form. That choice, made at the investigator’s desk, decides the data’s value inside the bank too.
Week of 18 October 2021
BlackMatter’s reach was set by the directory, not the malware
The October 2021 BlackMatter advisory described attackers arriving with stolen credentials and using Active Directory to find everything worth encrypting. How far one credential could travel was decided by identity design made years earlier.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
The FTC’s amended Safeguards Rule gave mortgage brokers, auto dealers, finance companies and tax preparers specific security controls. The harder change was governance: one qualified individual, a written report to the board, and evidence that the program ran.
November 2021
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
CISA’s Binding Operational Directive 22-01 replaced severity scores with a short, evidence-based list and a federal deadline. Its biggest effect was on how agency patch teams spent their week, argued with system owners, and exposed weak asset inventories.
Week of 8 November 2021
Robinhood’s phone-call breach argues for support access sized to one customer
In November 2021, one socially engineered support employee gave an attacker reach into millions of customer records at a retail brokerage. The fix sits in three places: the agent on the phone, the tools behind them, and what customers are taught to trust.
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s State and Local Cybersecurity Grant Program paired $1 billion with a cost share that grew every year. That design asked states and localities what they would keep paying for once the federal money stopped.
Week of 22 November 2021
Omicron’s scarcest resource was staff, and few hospitals could count them in real time
When WHO named Omicron a variant of concern in late November 2021, hospitals braced for patients. The binding constraint that winter was staff able to work, and the speed of every decision depended on joining data scattered across HR, scheduling and occupational health.
Week of 29 November 2021
Inflation’s first casualty in bank IT was the change budget
When the Fed dropped “transitory” in late November 2021, bank and credit union technology budgets faced a quiet squeeze. Run costs rose automatically through contracts, wages and usage pricing, so the money for modernization absorbed the difference.
December 2021
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw disclosed in December 2021 was easy to exploit and easy to fix. The crisis was finding it, and the difficulty differed for software an organization builds, software it buys and software it consumes as a service.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
When ransomware took a widely used cloud timekeeping service offline in December 2021, cities, transit agencies and public hospitals still had to pay shift workers correctly. The vendor owned the platform. The employer kept the paycheck, the time record and the legal duty.
Week of 20 December 2021
Oracle bought Cerner, and Cerner customers inherited a cloud strategy
Oracle’s December 2021 agreement to buy Cerner gave health systems on that record a new owner with its own database, cloud and priorities. The decisions in front of them were about roadmap, hosting and contract terms, and the timing of each.
Week of 27 December 2021
Why good-faith estimates weighed most on the therapist’s office
From January 1, 2022, every state-licensed provider owed uninsured and self-pay patients a written estimate before scheduled care. Hospitals had revenue cycle teams to absorb it. Therapists and small practices, where self-pay is common and treatment has no fixed end, did not.