52 articles
January 2022
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
The FTC’s January 2022 warning tied Log4j remediation to its reasonable-security standard. Reasonableness is judged later, from records, so the decisive work was documenting the response while it happened, including what vendors said and when.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, compliance would be tested by state surveyors against a staff list that included contractors, students and practitioners. Most hospitals had no single list that reached past the payroll.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
WhisperGate looked like ransomware but destroyed data with no way back. For US public agencies, it exposed continuity plans that quietly counted on payment as a last resort, and recovery times nobody had measured from total loss.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told agencies to adopt authentication that phishing cannot defeat. Strong authenticators shifted attacker attention to how credentials are issued, replaced and reset, a process run by help desks the memo barely mentioned.
Week of 31 January 2022
One door is not a service: the IRS selfie reversal
The IRS backed away from mandatory selfie verification in February 2022 because a single proofing route, however strong against fraud, locks out part of a universal population. Agencies needed several routes to the same assurance level, measured by who fails.
February 2022
Week of 7 February 2022
Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 to a $3.6 billion seizure in 2022 because the ledger never forgets. The decisive links sat at regulated firms, so banks’ own records of crypto-linked activity need to be built to be read years later.
Week of 14 February 2022
In Ukraine’s bank DDoS, the rumor outran the outage
The February 2022 denial-of-service attacks on Ukrainian state banks caused short disruptions, paired with false texts saying ATMs had failed. A bank’s availability in a crisis includes what customers believe about their money, so communication and alternative channels belong in the resilience plan.
Week of 21 February 2022
Shields Up had no end date, so vigilance needed a staffing plan
When Russia invaded Ukraine, CISA asked every US organization to raise its guard, with no date to lower it. Sustaining a heightened posture for months was a management problem: who watches, who decides, and what work stops to pay for it.
Week of 28 February 2022
Russia’s sanctions tested banks’ ownership data more than their name lists
The sanctions on Russia from late February 2022 came in fast waves, from several governments, against sprawling corporate groups. Screening names against lists caught the obvious cases. Exposure sat in unnamed subsidiaries, effective dates and jurisdiction-specific rules, all of them data problems.
March 2022
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day incident clock. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and that text would become a standard others could test.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 fixed two clocks in statute and left coverage to a rulemaking that would take years. The decisions those clocks force, inside a hospital’s incident command, did not depend on the rule’s details.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
The March 2022 Okta disclosure showed that a subcontractor’s support engineer sat inside every customer’s trust boundary. For health systems running clinical access through one identity provider, the exposure was the two months before customers knew, and the logs they did not hold.
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
A Java flaw with a Log4Shell-style nickname arrived four months after Log4Shell, amid confusion over which bug was which. Its narrow exploit conditions made it a test of triage, and of whether tired hospital IT teams could avoid a second all-hands scramble.
April 2022
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
The April 2022 court-authorized takedown of the Cyclops Blink botnet showed small firewalls serving Russian military intelligence as relays, often without their owners noticing. For public agencies, an unmanaged edge device is a liability to others before it is a breach of their own.
Week of 11 April 2022
Ninety days at a time: telehealth’s stack of temporary permissions
Another 90-day renewal of the public health emergency in April 2022 kept telehealth running on permissions with different owners and end dates. Patients saw one service. Health systems had to manage each layer separately and show patients, at booking, which rule their visit relied on.
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
An April 2022 federal advisory described North Korean operators courting crypto-firm engineers with fake recruiting and trojanized apps. For any financial firm, a job approach reaches the people with the most access through a channel security rarely watches, so controls must assume one will succeed.
Week of 25 April 2022
Why the CFPB’s dormant authority put fintech partners on the exam calendar
By reviving a rarely used power to supervise nonbanks whose conduct poses risks to consumers, the CFPB made exam readiness something fintechs had to build before scale, and something their sponsor banks had to check.
May 2022
Week of 2 May 2022
Quantum risk is dated by how long your data must stay secret
NSM-10 set 2035 as a national goal, but for any given agency system the effective deadline is earlier: how long its data must stay confidential, plus how long migration will take, measured against when a capable machine might exist.
Week of 9 May 2022
Stable is a claim: what TerraUSD asked of bank front lines
Few banks held TerraUSD, but its collapse reached them through customers: scams riding on the losses, disputes over transfers customers had authorized, and confusion about which products near a deposit were actually protected.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s pledge not to charge good-faith security research made outside reports more likely. For agencies, the work it created was operational: a front door for reports, a route to whoever can fix the flaw, and a way to close the loop.
Week of 23 May 2022
An acquisition announcement is a free option on your exit plan
Broadcom’s agreement to buy VMware gave customers eighteen months before anything changed. The organizations that came out best treated that window as an option to buy cheaply: a priced exit path, kept alive with small investments, and exercised on evidence at renewal.
Week of 30 May 2022
No patch yet: Follina and Confluence tested who may switch things off
Two flaws exploited before fixes existed left health systems with workarounds only. The deciding factor was organizational: who could authorize turning something off, who could carry it out across the edges of the estate, and who confirmed it worked.
June 2022
Week of 6 June 2022
Your carrier’s routers belong in your threat model
A joint advisory described state actors working through network devices to get inside telecom and network service providers. For enterprises that buy those services, it meant treating the provider’s network as untrusted transport, its administrators as privileged users, and its silence as a monitoring gap.
Week of 13 June 2022
Internet Explorer retired; its clinical applications did not
IE mode in Edge let hospitals keep legacy web applications running after the old browser’s retirement. The compatibility list it required was a ready-made inventory of legacy risk, best worked down by who could fix each site: the hospital, its vendors, or outside parties.
Week of 20 June 2022
Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went to medical records, where HIPAA already set rules. The larger exposure for health systems sat at their own digital edges and in consumer data they never held but patients assumed was protected.
Week of 27 June 2022
A rule’s survival odds belong in the compliance plan
West Virginia v. EPA gave courts a named test for striking ambitious rules. That made durability something agencies and the organizations they regulate had to estimate: in how new rules are written, in how existing programs are defended, and in how compliance money is sequenced.
July 2022
Week of 4 July 2022
Rogers: the bank outage that started at someone else’s carrier
When one Canadian carrier failed for most of a day, debit payments failed nationwide, including for banks that never bought a Rogers circuit. Telecom dependency hides in three places a bank’s dual-carrier policy does not reach: shared payment utilities, thinly connected channels, and customers’ phones.
Week of 11 July 2022
988 launched without 911’s plumbing: location, dispatch and a fee
The crisis line got a three-digit number in July 2022, but none of the infrastructure 911 spent decades acquiring. States inherited three gaps: no caller location, no settled way to send help, and no dedicated funding stream.
Week of 18 July 2022
Necessary and proportionate: the ADPPA test that outlived the bill
The federal privacy bill that cleared committee 53 to 2 never reached the floor. Its minimization test did outlast it, and banks and hospitals were more exposed to that test than their sector carve-outs suggested.
Week of 25 July 2022
Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s
The CHIPS and Science Act passed while switches and servers sat on back order. It addressed where chips would be made in the 2030s. IT leaders needed separate answers, on separate clocks, for the backlog, the refresh plan and provenance.
August 2022
Week of 1 August 2022
Why buying the same software as your neighbors removes your fallback
Ransomware at one NHS supplier took urgent care systems offline across many providers at once. Peers could not cover for each other because they ran the same product. U.S. health systems buying shared SaaS face the same exposure, and procurement holds the levers.
Week of 8 August 2022
Tornado Cash and the transfers nobody asked for
Sanctioning a mixer’s smart contracts meant sanctioned funds could arrive uninvited, and the parties a bank would normally screen did not exist. Sanctions programs touching crypto had to handle unsolicited receipts, exposure several hops away, and a designation under legal attack.
Week of 15 August 2022
Why the IRS’s ten-year budget needed a one-year payoff
The Inflation Reduction Act gave the IRS about 80 billion dollars over a decade, and opponents promised to cut it from the first day. Multiyear money that can be reversed has to be spent in an order where every tranche stands on its own.
Week of 22 August 2022
LastPass and the first-draft problem in vendor breach notices
LastPass’s August 2022 notice reported stolen source code and safe customer data. The attacker’s next stage was already under way. Customers needed to read the notice for what it enabled, know what their vaults exposed, and be ready to rotate.
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
The second-largest U.S. school district opened on schedule days after ransomware hit its systems. That was possible because classroom teaching depends on few systems. The hard parts were resetting access for an enormous population and telling families what to do.
September 2022
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s e-government services aimed at public embarrassment, not ransom. When disruption is the goal, agencies have to defend a minimum visible service, contest the attacker’s story, and know who decides on attribution.
Week of 12 September 2022
M-22-18 asked producers to sign; agencies first had to know who they were
OMB’s secure software memo made a producer’s signed attestation a condition of federal use. The form drew the attention. The work that lasted was the producer-level inventory behind it and the judgment needed to use what came back.
Week of 19 September 2022
What a stolen license number proves, and what banks treated it as proving
The Optus breach put millions of identity document numbers in criminals’ hands. Banks had used those numbers as proof of identity at account opening, in the contact center and in their own files. Each use needed a different fix.
Week of 26 September 2022
Recordkeeping fails where the approved channel is slower than a text
The SEC and CFTC fined large Wall Street firms over employees’ business texts on personal phones. The rules were old and capture tools existed. The failures came from convenience, and fixing them meant channels, supervision and capture assurance moving together.
October 2022
Week of 3 October 2022
Five principles, three committees: the AI blueprint inside a hospital
The White House’s nonbinding AI blueprint read like new governance. For health systems, most of it described work existing clinical committees already knew how to do. Extending those committees to algorithms beat building a separate AI bureaucracy.
Week of 10 October 2022
In a merged health system, the network decides which hospitals go to paper
CommonSpirit’s ransomware attack hit hospitals in several states while others in the same system carried on. In merged health systems, the blast radius is set by shared identity, shared networks and who can order a precautionary shutdown for everyone.
Week of 17 October 2022
If the CFPB’s funding fell, the statutes would still stand
A federal appeals court called the consumer bureau’s funding unconstitutional, and for eighteen months every CFPB rule carried a question mark. Compliance teams had to sort the bureau’s past orders, current rules and pending rules, because each faced a different risk.
Week of 24 October 2022
For credit unions, the 1033 outline was a question for the core processor
The CFPB’s first open banking outline opened a small business review. For small banks and credit unions, compliance would arrive as a product from their core and digital banking vendors, so their decisions were about coverage, cost and contracts.
Week of 31 October 2022
How hospitals spent the OpenSSL week waiting for ‘not affected’
A week’s warning of a critical OpenSSL flaw should have made the answer easy. For health systems, it depended on suppliers saying their products were not affected, and few could get that statement quickly, in usable form, or at all.
November 2022
Week of 7 November 2022
Who checked the people who moved FTX’s money
FTX’s banks, investors and partners had studied its growth. Few had asked three plain governance questions: who can move the money, who checks them, and whose money it is. Financial institutions can ask those questions of every fast-growing counterparty.
Week of 14 November 2022
What Hive’s victims gained by calling the FBI early
When federal agencies warned health care about Hive ransomware, the FBI had secretly held the group’s decryption keys for months. Victims who reported got them. Health systems should settle when to call, what to share and how reporting fits other clocks.
Week of 21 November 2022
Banned from the market, still on the wall: the FCC’s equipment order and the installed base
The FCC’s November 2022 order stopped new authorizations for Huawei, ZTE and, for security uses, Hikvision, Dahua and Hytera gear. It said nothing about devices already installed, so the agency’s inventory, not the market, became the enforcement point.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking technologies created no new rule. It exposed a governance gap: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls that applied to every other system touching patient data.
December 2022
Week of 5 December 2022
Rackspace kept running old Exchange for clients, and kept its old risks
The Rackspace ransomware incident showed that paying a provider to run an aging platform transfers the work, not the platform’s exposure. Customers needed three things the contract rarely described: a patch path, an exit path and a recovery path they controlled.
Week of 12 December 2022
FTX’s favored account was a setting in the code, and banks have settings too
The FTX charges described control failures that regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run their own controls the same way.
Week of 19 December 2022
The quantum law asked for a price tag agencies could only get from their vendors
The Quantum Computing Cybersecurity Preparedness Act asked OMB for a funding estimate. Most of the cost sat in products agencies did not build, so the honest answer depended on vendor roadmaps, contract terms and refresh cycles.
Week of 26 December 2022
Section 524B gave hospitals a baseline to buy against
The device cybersecurity provisions in the December 2022 spending law regulated manufacturers, not hospitals. Their value to health systems was a federal baseline they could cite in selection and contracts, while leaving the installed base exactly where it was.