354 articles · page 10 of 18
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no rules. By saying existing lending, employment, housing and consumer protection law already reached automated systems, it made the organization using a model answerable for its data, its opacity and its use, whoever built it.
Week of 17 April 2023
HIPAA’s reproductive health proposal asked records to know what they hold
OCR’s April 2023 proposal turned on why information was requested, not what it was. Any version of it, and the state laws that followed, assumed a health system could find sensitive data in a record and keep it labeled. Few could.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
The documents posted on Discord were taken by a junior IT specialist whose clearance and systems access were valid, but who had no need for the material. Agencies that hold any sensitive data need separate controls for administrative access, its monitoring and its supervision.
Week of 3 April 2023
Eligible but unreachable: Medicaid unwinding ran on contact data
When continuous enrollment ended, states had about a year to redetermine eligibility for tens of millions of people. Outcomes turned less on eligibility rules than on whether agencies could renew people from data they held, reach the rest, and process their replies.
Week of 27 March 2023
Why the spyware order put the burden on acquisition staff
Executive Order 14093 did not ban commercial spyware. It barred operational use of tools that posed security risks or had been misused abroad, which made classification, vendor diligence and post-award oversight inside agencies the places where the policy would succeed or fail.
Week of 20 March 2023
A chatbot’s history sidebar is a records system with someone else’s retention policy
OpenAI’s March 2023 bug was minor as breaches go. It showed health systems that staff conversations with AI assistants are stored data held by a vendor. HIPAA’s questions follow: what goes in, how long it stays, who sees it.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
Amid the bank failures, the SEC proposed a cyber rule for market entities, amendments to Regulation S-P and a wider Regulation SCI on one day. Each answered a different audience: the regulator, the customer and the market. Only the customer rule was adopted.
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank is remembered as a liquidity and supervision failure. For the fintechs, broker-dealers and companies that banked there, it was a supplier failure: cash, payment flows and dependent services all ran through one provider nobody had assessed as critical.
Week of 27 February 2023
BetterHelp’s intake form was a privacy promise the ad stack broke
The FTC’s BetterHelp case concerned a company outside HIPAA, but it reached every health organization with a digital front door. What patients are told when they sign up is a commitment, and the measurement tools behind the page must be built to keep it.
Week of 20 February 2023
Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
When large banks restricted ChatGPT, the stated worry was confidential data leaving the firm. That problem yielded to contracts within a year. The obligations to keep and supervise records, and to explain decisions, set the slower pace of adoption.
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through a file-transfer product most health systems treated as plumbing. Managed file transfer is a data tier with its own exposure, retention and accountability, and it needs the discipline applied to any system of record.
Week of 6 February 2023
One console, every server: what ESXiArgs exposed about the hypervisor
ESXiArgs exploited a flaw patched two years earlier, but its damage came from where it struck. At the virtualization layer, one compromise encrypts every server, sits below most security tooling, and can take the backups with it.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
The ransomware attack on ION’s cleared derivatives software showed that sector-wide disruption often starts at specialized post-trade vendors that many firms share and few rank as critical. Finding them, grading them and rehearsing life without them are three separate jobs.
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s disruption of Hive spared many victims, hospitals among them, from paying. It removed one ransomware brand. The affiliates, techniques and hospital weaknesses that made the attacks work were untouched, and those needed different responses.
Week of 16 January 2023
DORA’s two-year runway, measured in contract renewals
DORA gave EU financial firms two years to comply, with no carve-out for existing ICT contracts. For most firms the binding constraint was not policy writing or testing but the calendar on which they could reopen agreements with technology providers.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s NOTAM outage was blamed on an aging system, but the trigger was routine database maintenance that damaged both the primary and the backup. For agencies running old mission systems, procedure, people and recovery design deserve attention before replacement does.
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
The January 2023 joint statement was read as a verdict on what banks could do with crypto. Its sharper warning was about exposure banks already had through depositors, partners and customers, which most could not measure from their own data.
Week of 26 December 2022
Section 524B gave hospitals a baseline to buy against
The device cybersecurity provisions in the December 2022 spending law regulated manufacturers, not hospitals. Their value to health systems was a federal baseline they could cite in selection and contracts, while leaving the installed base exactly where it was.
Week of 19 December 2022
The quantum law asked for a price tag agencies could only get from their vendors
The Quantum Computing Cybersecurity Preparedness Act asked OMB for a funding estimate. Most of the cost sat in products agencies did not build, so the honest answer depended on vendor roadmaps, contract terms and refresh cycles.
Week of 12 December 2022
FTX’s favored account was a setting in the code, and banks have settings too
The FTX charges described control failures that regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run their own controls the same way.