53 articles
January 2024
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
FinCEN opened beneficial ownership filing on January 1, 2024 to tens of millions of small companies while the law faced constitutional challenge. A public obligation at that scale has four design problems, and the last, how it narrows, is rarely planned.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The false bitcoin ETF post from the SEC’s X account came one day before the actual approval, when markets were primed to believe it. Agencies whose announcements move markets or behavior should secure official accounts as privileged credentials, by the calendar, and for the audience.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s January 2024 standards defined a major ICT incident as a calculation over clients, transactions, downtime, data and cost. Banks that left those inputs outside their incident tooling could not classify on time, however good their playbooks.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Midnight Blizzard reached Microsoft’s executive mailboxes through a test tenant account and an old OAuth app. Whether any non-production identity is a production risk turns on three properties: who can log in to it, what it can reach, and who would notice it acting.
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were documented. What decided who met the deadline was who could authorize cutting remote access, who could rebuild the devices, and where agencies sat in their contractors’ queues.
February 2024
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and payers that receive substance use disorder records treat them almost like other health data. The treatment programs that create them, and the legal teams that answer subpoenas, carried more obligation than before.
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
The deepfaked video call that moved about US$25 million beat a meeting, not a payment system. Most firms let staff treat a face on screen as identity. Banks need controls at the invitation, inside the meeting, and at the handoff to money.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
When ransomware hit the largest US claims clearinghouse, every connected provider faced the same call. Cutting the connection was quick. Knowing what to cut, and what proof to demand before reconnecting, depended on preparation few had done.
Week of 26 February 2024
CSF 2.0’s biggest addition was the one a security team could not deliver
NIST’s new Govern function looked like a security framework update. Its six categories assign work to executives, HR, procurement and boards. Organizations that treated it as a mapping exercise for the CISO missed what had changed.
March 2024
Week of 4 March 2024
Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage
Two weeks into the Change Healthcare outage, the federal response was about money. For providers that were never attacked, survival turned on three financial questions: how long they could last, who would lend to them, and who would finally bear the loss.
Week of 11 March 2024
Why the AI Act left bank credit models with the supervisor they already had
The AI Act text adopted in March 2024 routed high-risk credit scoring through banking supervision and let existing governance satisfy some duties. For banks, the work was separating what model risk management already met from what it never covered.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
The March 2024 White House and EPA letter invited each state’s environmental, health and homeland security secretaries. That list was the finding: water cybersecurity in a state sits with a regulator, a funder and a responder, and few governors had named anyone to join them.
Week of 25 March 2024
Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record
The final OMB memo kept the draft’s comply-or-stop deadline and added something sharper. Every way out of it, whether a determination, a waiver or an extension, now needed a named signer, documented evidence and a public or OMB-reviewed record.
April 2024
Week of 1 April 2024
Agencies buy a cloud provider’s security culture whether or not the contract mentions it
The Cyber Safety Review Board blamed the 2023 Exchange Online intrusion on Microsoft’s security culture. Agencies cannot audit a culture, but the report showed three places it leaves evidence a buyer can demand: secrets, disclosure and defaults.
Week of 8 April 2024
How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never passed. Its distinctive features let individuals act directly, through requests, machine-readable opt-out signals and lawsuits. Those three channels, already arriving through state law, are where regulated organizations’ privacy programs are now judged.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
Palo Alto withdrew a mitigation within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery for themselves did not have to wait for the vendor’s next revision.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of purpose. That shifted paperwork onto requesters but left hospitals with judgments no form could make, under a rule a court vacated in 2025.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal without MFA, about sixteen months after the acquisition closed. Health care buyers should treat inherited internet-facing access as a closing condition, an interim-period control set and a board-level exception list.
May 2024
Week of 6 May 2024
Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once
A large system’s hospitals normally cover for each other with beds, staff and shared services. When ransomware took Ascension’s shared platforms down across its markets, that internal mutual aid failed together, and the help had to come from outside.
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments gave customers a 30-day breach notice and required service providers to report within 72 hours. For broker-dealers and advisers whose customer data sits mostly with vendors, that second clock decides how well the first one works.
Week of 20 May 2024
How Windows Recall put a possible public record where no records officer could reach it
Recall’s redesign answered the security objections by keeping screen snapshots local, sealed to the user and self-expiring. Those same three properties put the snapshots outside the search, hold and retention tools agencies use to meet public records and discovery duties.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 campaign against Snowflake customers broke no platform. It used passwords stolen from infected machines, often contractors’, and walked out with bulk data. Each stage, from theft to login to extraction, was a control point the customer owned.
June 2024
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
The ransomware attack on Synnovis showed that consolidating a region’s pathology into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. Nobody’s contract, budget or insurance carried the loss.
Week of 10 June 2024
Why banking-as-a-service margins never covered the cost of knowing whose money it was
The Fed’s order against Evolve showed that sponsor-bank revenue grew with balances while the costs of reconciliation, oversight and partner failure grew with the number of programs. Banks that priced only the first side carried the second.
Week of 17 June 2024
Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies had dropped Kaspersky years earlier. The June 2024 Commerce determination reached counties, school districts, utilities and contractors with a fixed date, and showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
Week of 24 June 2024
How polyfill.io slipped past hospital tag reviews that checked each script only once
Hospital script reviews were built after 2022 to stop patient data leaving through tracking tags. Polyfill.io showed the opposite risk: approved code that changed after approval and sent patients elsewhere. Managing it takes checks on the source, the content and the response.
July 2024
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
Four Supreme Court decisions in five days ended deference on statutory meaning, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 8 July 2024
A credit union’s promises in an outage are set by its architecture, years before the attack
Patelco’s members met its ransomware attack as four questions: can I use my money, what happened to my data, how do I get back in, who pays. Each answer was largely fixed by design and policy choices made long before June 2024.
Week of 15 July 2024
Channel File 291 measured every recovery plan in hands per device
The faulty CrowdStrike update turned remotely managed Windows estates into a field-service job. Recovery speed came down to three constraints most plans never modeled: access to recovery secrets, people at keyboards, and the order of repair.
Week of 22 July 2024
Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security
KnowBe4’s account of hiring a North Korean IT worker showed a scheme built to pass four hand-offs, each owned by a different team. Controls work when one identity is carried from interview to offer, onboarding, device and daily work.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could prove it had contained the attack on its systems. It could not yet prove what the stolen data held or whom it exposed. Each claim needs its own evidence, and borrowing from the first to answer the second costs trust.
August 2024
Week of 5 August 2024
How the August 2024 selloff found brokerages’ capacity limit before the first trade
On August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat in the pre-trade path, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards said what to migrate to. For banks, health systems and agencies, the order of migration is set by how long data must stay secret, which makes the retention schedule the first planning document.
Week of 19 August 2024
National Public Data turned the Social Security number into a lookup key
Once a single broker dataset linked names, addresses, birth dates and Social Security numbers, those facts could still find a customer’s record but could no longer prove who was asking. Enrollment, recovery and high-risk changes each needed a different fix.
Week of 26 August 2024
Sea-Tac’s handwritten bag tags were a staffing plan in disguise
When ransomware took down Port of Seattle systems, the airport kept moving on paper. “Revert to manual” is a promise about people: which work has a paper version, who does it, how long they can sustain it, and who re-keys it afterward.
September 2024
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
The Council of Europe convention covers AI used by public authorities and by private actors acting on their behalf. That means an agency’s duties follow the service into its contractors, and the boundary of “on their behalf” is where governance gaps will open.
Week of 9 September 2024
Why o1’s reasoning summaries added work for clinical AI committees
OpenAI’s o1 narrated its reasoning just as federal rules on decision support transparency were taking hold. A fluent explanation answers a clinician’s question, not the vendor or the regulator’s, and health systems had to supply three different kinds of transparency themselves.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas’s settlement with Pieces Technologies applied an old consumer protection statute to a generative AI error rate. Health system buyers can test any such number on three dimensions: what it counts, where it was measured, and how it stays true after updates.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Continuity plans for local agencies are written for the loss of a building or a system. Helene removed people, connectivity and decision authority across a whole region at once, and each of the three needs its own preparation with its own lead time.
Week of 30 September 2024
Saline exposed the risk that hides in a hospital’s cheapest line items
One flooded Baxter plant put IV fluids on allocation nationwide. Low-cost essentials concentrate supply because price pressure rewards scale, so health systems need to manage them by clinical criticality, through four levers that spend-based purchasing ignores.
October 2024
Week of 7 October 2024
At American Water, containment was the part customers saw
The largest U.S. water utility kept water flowing after a cyberattack, but switching off its billing portal was the incident as the public experienced it. For utilities and agencies, the customer-facing response is four decisions, and most can be made in advance.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no requirements. Because Part 500 already demands an annual compliance certification signed by the CEO and CISO, it turned four AI risks into evidence those signers must be able to produce.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s Section 1033 rule was sued the day it was issued. Banks could not wait out the litigation or comply blindly. The workable approach was to split the program into no-regret work, rule-specific work and work hinging on the contested terms.
Week of 28 October 2024
Telehealth’s three policy clocks all ran down in December, so virtual care needed an annual cycle
After the 2025 fee schedule, a Medicare virtual visit still depended on CMS rulemaking, a congressional extension and a DEA rule. What had looked like a post-emergency transition was a standing condition, with all three clocks converging at year-end, best run as a yearly cycle.
November 2024
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best predictor of which obligations would last was the instrument behind them: statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 11 November 2024
FinCEN’s deepfake alert was a job-design problem for three groups of staff
FinCEN’s November 2024 alert read like a list of red flags for compliance teams. Its harder implication was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new decision rights, incentives and escalation paths.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The larger-participant rule gave federal examiners access to big payment apps and lasted under six months. With Synapse’s collapse fresh, the more durable exposure sat elsewhere: in the law apps already owed and in the banks holding their customers’ funds.
Week of 25 November 2024
Blue Yonder put process-running vendors at the top of the risk register
The Blue Yonder ransomware attack disrupted staff scheduling and pay at major retailers. Vendor risk programs built around data protection miss suppliers whose failure stops work, and classifying vendors by what their failure costs changes diligence, contracts and contingency spending.
December 2024
Week of 2 December 2024
The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit
The proposal to treat many data brokers as consumer reporting agencies was withdrawn within six months. Its underlying question, where personal data came from and what it may be used for, applies to data entering, leaving and being repurposed inside every AI program.
Week of 9 December 2024
In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
When attackers breached the vendor-run RIBridges benefits system, the state carried public accountability while the vendor held the systems, logs and forensic work. Contracts for such systems must settle visibility, decision rights, costs and exit before an incident, not during one.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After the Salt Typhoon telecom intrusions, CISA told targeted people to use end-to-end encrypted messaging, just as off-channel penalties weighed on broker-dealers. The two demands conflict only on channels the firm does not control. An approved channel must be encrypted, captured and usable.
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS’s proposed overhaul turned flexible safeguards into specific requirements. Sorted by difficulty, most were controls hospitals already had or evidence they could build. Recovery within 72 hours was different: it needed clinical sequencing, tested capacity and money few systems had budgeted.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers reached Treasury workstations with a stolen key that secured a vendor’s cloud remote support service. Remote support is privileged access by another name, and governing it takes four controls along the path from vendor to endpoint, most of which agencies only partly had.