52 articles
January 2023
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
The January 2023 joint statement was read as a verdict on what banks could do with crypto. Its sharper warning was about exposure banks already had through depositors, partners and customers, which most could not measure from their own data.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s NOTAM outage was blamed on an aging system, but the trigger was routine database maintenance that damaged both the primary and the backup. For agencies running old mission systems, procedure, people and recovery design deserve attention before replacement does.
Week of 16 January 2023
DORA’s two-year runway, measured in contract renewals
DORA gave EU financial firms two years to comply, with no carve-out for existing ICT contracts. For most firms the binding constraint was not policy writing or testing but the calendar on which they could reopen agreements with technology providers.
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s disruption of Hive spared many victims, hospitals among them, from paying. It removed one ransomware brand. The affiliates, techniques and hospital weaknesses that made the attacks work were untouched, and those needed different responses.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
The ransomware attack on ION’s cleared derivatives software showed that sector-wide disruption often starts at specialized post-trade vendors that many firms share and few rank as critical. Finding them, grading them and rehearsing life without them are three separate jobs.
February 2023
Week of 6 February 2023
One console, every server: what ESXiArgs exposed about the hypervisor
ESXiArgs exploited a flaw patched two years earlier, but its damage came from where it struck. At the virtualization layer, one compromise encrypts every server, sits below most security tooling, and can take the backups with it.
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through a file-transfer product most health systems treated as plumbing. Managed file transfer is a data tier with its own exposure, retention and accountability, and it needs the discipline applied to any system of record.
Week of 20 February 2023
Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
When large banks restricted ChatGPT, the stated worry was confidential data leaving the firm. That problem yielded to contracts within a year. The obligations to keep and supervise records, and to explain decisions, set the slower pace of adoption.
Week of 27 February 2023
BetterHelp’s intake form was a privacy promise the ad stack broke
The FTC’s BetterHelp case concerned a company outside HIPAA, but it reached every health organization with a digital front door. What patients are told when they sign up is a commitment, and the measurement tools behind the page must be built to keep it.
March 2023
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank is remembered as a liquidity and supervision failure. For the fintechs, broker-dealers and companies that banked there, it was a supplier failure: cash, payment flows and dependent services all ran through one provider nobody had assessed as critical.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
Amid the bank failures, the SEC proposed a cyber rule for market entities, amendments to Regulation S-P and a wider Regulation SCI on one day. Each answered a different audience: the regulator, the customer and the market. Only the customer rule was adopted.
Week of 20 March 2023
A chatbot’s history sidebar is a records system with someone else’s retention policy
OpenAI’s March 2023 bug was minor as breaches go. It showed health systems that staff conversations with AI assistants are stored data held by a vendor. HIPAA’s questions follow: what goes in, how long it stays, who sees it.
Week of 27 March 2023
Why the spyware order put the burden on acquisition staff
Executive Order 14093 did not ban commercial spyware. It barred operational use of tools that posed security risks or had been misused abroad, which made classification, vendor diligence and post-award oversight inside agencies the places where the policy would succeed or fail.
April 2023
Week of 3 April 2023
Eligible but unreachable: Medicaid unwinding ran on contact data
When continuous enrollment ended, states had about a year to redetermine eligibility for tens of millions of people. Outcomes turned less on eligibility rules than on whether agencies could renew people from data they held, reach the rest, and process their replies.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
The documents posted on Discord were taken by a junior IT specialist whose clearance and systems access were valid, but who had no need for the material. Agencies that hold any sensitive data need separate controls for administrative access, its monitoring and its supervision.
Week of 17 April 2023
HIPAA’s reproductive health proposal asked records to know what they hold
OCR’s April 2023 proposal turned on why information was requested, not what it was. Any version of it, and the state laws that followed, assumed a health system could find sensitive data in a record and keep it labeled. Few could.
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no rules. By saying existing lending, employment, housing and consumer protection law already reached automated systems, it made the organization using a model answerable for its data, its opacity and its use, whoever built it.
May 2023
Week of 1 May 2023
First Republic’s white-glove service had no answer for an uninsured balance
First Republic’s clients were loyal until the question became whether money above the insurance limit was safe. In a confidence crisis, client experience means three capabilities most banks lacked: seeing each client’s insured position, changing it fast, and saying something specific.
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency’s end unwound telehealth flexibilities on separate schedules set by Congress, the DEA, OCR and the states. Each schedule governed a different workforce question: what clinicians may prescribe remotely, where they may practice from, and which tools they may use.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
The FTC had already said health apps outside HIPAA owe breach notice for unauthorized sharing. Its May 2023 proposal mattered for its definitions, which showed that one patient’s data can change regulators as it moves between a hospital, a consumer product and an app.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
The May 2023 disclosures described a state actor inside US infrastructure using built-in tools and hijacked routers, not malware. Agencies and utilities had to know normal administrator behavior, own their network edge, and plan to run without a trustworthy network.
Week of 29 May 2023
Flat caps, rising subscriptions: how the debt deal squeezed federal IT from the inside
The Fiscal Responsibility Act held nondefense spending roughly flat for two years. Federal IT budgets did not shrink evenly. Subscriptions and cloud bills grew on their own, modernization was deferred by default, and technical staff thinned through attrition. Each needed its own control.
June 2023
Week of 5 June 2023
Most MOVEit victims never ran MOVEit
MOVEit reached thousands of organizations through payroll, pension and contractor firms that ran the software for them. Those clients had nothing to patch. Their exposure turned on finding affected vendors fast, settling who notified whom, and how much data they had sent.
Week of 12 June 2023
Why the AI Act’s obligations follow your role, not your sector
The European Parliament’s June 2023 position drew headlines for generative AI. Its durable feature for banks, health systems and agencies was structure: duties attach to whether an organization builds a system, deploys one, or builds on a general-purpose model, and many hold all three roles.
Week of 19 June 2023
Why a stolen DMV file weakened identity checks at agencies that were never breached
When MOVEit exposed the license records of most drivers in two states, license numbers and issue dates stopped being secrets. Every agency that used them to verify residents online inherited the breach, whether or not it ran MOVEit.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
Colorado and Connecticut switched on their privacy laws while a California court paused new regulations a day before enforcement. When effective dates move this much, a privacy program should be organized around four standing capabilities, with each new law mapped onto them.
July 2023
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s Local Law 144 made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder prerequisite was finding every tool that scores candidates, deciding which were in scope, and naming an owner for each.
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came from storage used to format patient emails, not from clinical systems. Outreach data looks harmless one field at a time, but together it is protected health information and needs EHR-grade ownership, inventory and minimization.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining turned on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
The SEC’s July 2023 rule started its four-business-day clock at the materiality determination, not at discovery. That made the determination itself the thing to govern: who makes it, what record it leaves, and how it lines up with every other notification clock.
Week of 31 July 2023
Prospect Medical’s ransomware attack ended up on the table in a hospital sale
The August 2023 attack on Prospect Medical Holdings hit an operator that was already financially stretched and mid-way through selling three Connecticut hospitals. For such operators, cyber resilience is a balance-sheet and deal term, priced by buyers, lenders and state approvers.
August 2023
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 rating actions confirmed that the spring’s bank stress would become a lasting earnings squeeze. Regional bank technology budgets had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for a smaller margin.
Week of 14 August 2023
A weekend of public red-teaming showed agencies that AI testing never finishes
The White House-backed red-teaming of chatbots at DEF CON in August 2023 was a demonstration, not a certification. For agencies buying AI, testing is a standing workload at three stages, before award, before deployment and in operation, and the binding constraint is staff.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The private fund adviser rules adopted in August 2023 were vacated ten months later. Advisers that sorted the work into what investors would demand, what existing law already required and what only the rule required spent little that was wasted.
Week of 28 August 2023
Medicare’s negotiated prices would reach hospital pharmacies as refunds, and refunds have float
When CMS named the first ten drugs for negotiation in August 2023, health systems with their own pharmacies faced three exposures with different owners: the cash gap a refund creates, the overlap with 340B, and the reconciliation systems neither problem could be managed without.
September 2023
Week of 4 September 2023
Storm-0558’s key escaped through a crash dump, a path every agency development team also has
Microsoft’s September 2023 post-mortem described a signing key that left production in diagnostic data, tokens accepted beyond their scope, and a key that lived for years. Agencies that build their own applications carry all three risks in their own code and contracts.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks used help desk calls to reach identity administrators. For banks, the priority was a small set of control-plane accounts: how they are recovered, who is allowed to recover them, and how a takeover of the identity platform would be spotted.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A SIEM changing owners exposed where lock-in actually sits: years of logs that retention rules require, detection rules written in one vendor’s query language, and the integrations around them. Each can be moved out of the platform’s exclusive control before the next deal.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still forced agencies to write lapse plans. Those plans were built around excepted staff, while agency technology also depended on how each contract was funded, what would expire mid-lapse and how systems would restart.
October 2023
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers signed in to a sliver of 23andMe accounts and, through a relative-matching feature, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change with its holder.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
The HTTP/2 flaw disclosed in October 2023 produced record denial-of-service attacks that large providers absorbed at their edge. Agency exposure depended on which group each public service fell into: rented edge, self-hosted, or unknown.
Week of 16 October 2023
Free, measured and always on: the open banking interface the CFPB proposed and banks could not price
The October 2023 Section 1033 proposal turned a bank’s data interface into a service with performance targets and no access fees. For banks and credit unions, the questions were what they had to deliver, what they could not recover, and what they still controlled.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers in Okta’s support system replayed session tokens from files customers had uploaded. For health systems, which send vendors logs and screenshots daily, each support artifact’s exposure depends on what it contains, what it is under HIPAA, and how long it stays usable.
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance said rights- and safety-impacting AI must meet minimum practices by a deadline or be switched off. The hard cases were systems already in production, many of them inside vendor products.
November 2023
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
When LockBit hit ICBC’s U.S. broker-dealer in November 2023, Treasury trades still had to settle. Every market participant could have been in any of three seats, and each seat needed a different plan written before the day.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
When ALPHV publicized its SEC complaint against MeridianLink in November 2023, the vendor’s bank and credit union customers faced their own notification questions with only an attacker’s claim and a vendor statement to go on. Their work split into facts, regulators and customers.
Week of 20 November 2023
Why the useful response to OpenAI’s board crisis was a days-to-switch number
No third-party risk questionnaire could have predicted OpenAI’s November 2023 board crisis. What regulated buyers controlled was the cost of moving away from any one model provider, set by three things: their contracts, their architecture and their fallbacks.
Week of 27 November 2023
Ardent took one network offline, and emergency departments in six states had to answer for it
Ardent’s Thanksgiving 2023 ransomware response was decided centrally and felt locally, in hospitals that carried partners’ names and answered to different state systems. Multi-state operators need the central decision, local authority and partner obligations settled before a holiday weekend.
December 2023
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
HHS’s December 2023 concept paper set out a voluntary baseline, two regulatory routes to make it binding, and incentives that depended on legislation. Requirements could arrive by rulemaking. Money could not, and hospitals had to plan for that gap.
Week of 11 December 2023
For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms
ONC’s December 2023 rule required certified health IT developers to disclose source attributes for the predictive tools they supply. For models a hospital built itself or bought from someone else, the EHR only had to hold the information, and the hospital had to produce it.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
The December 2023 ALPHV disruption gave hundreds of victims a free decryption tool. Accepting that help well required three things agencies rarely plan for: confirming the offer is real, using the tool without making recovery worse, and keeping legal duties on their own clock.
Week of 25 December 2023
Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers
Banks, health systems and agencies were not parties to The New York Times’s December 2023 suit against OpenAI and Microsoft. It still reached them three ways: through the indemnities they relied on, the content they published, and the prompts their vendors kept.