354 articles · page 11 of 18
Week of 5 December 2022
Rackspace kept running old Exchange for clients, and kept its old risks
The Rackspace ransomware incident showed that paying a provider to run an aging platform transfers the work, not the platform’s exposure. Customers needed three things the contract rarely described: a patch path, an exit path and a recovery path they controlled.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking technologies created no new rule. It exposed a governance gap: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls that applied to every other system touching patient data.
Week of 21 November 2022
Banned from the market, still on the wall: the FCC’s equipment order and the installed base
The FCC’s November 2022 order stopped new authorizations for Huawei, ZTE and, for security uses, Hikvision, Dahua and Hytera gear. It said nothing about devices already installed, so the agency’s inventory, not the market, became the enforcement point.
Week of 14 November 2022
What Hive’s victims gained by calling the FBI early
When federal agencies warned health care about Hive ransomware, the FBI had secretly held the group’s decryption keys for months. Victims who reported got them. Health systems should settle when to call, what to share and how reporting fits other clocks.
Week of 7 November 2022
Who checked the people who moved FTX’s money
FTX’s banks, investors and partners had studied its growth. Few had asked three plain governance questions: who can move the money, who checks them, and whose money it is. Financial institutions can ask those questions of every fast-growing counterparty.
Week of 31 October 2022
How hospitals spent the OpenSSL week waiting for ‘not affected’
A week’s warning of a critical OpenSSL flaw should have made the answer easy. For health systems, it depended on suppliers saying their products were not affected, and few could get that statement quickly, in usable form, or at all.
Week of 24 October 2022
For credit unions, the 1033 outline was a question for the core processor
The CFPB’s first open banking outline opened a small business review. For small banks and credit unions, compliance would arrive as a product from their core and digital banking vendors, so their decisions were about coverage, cost and contracts.
Week of 17 October 2022
If the CFPB’s funding fell, the statutes would still stand
A federal appeals court called the consumer bureau’s funding unconstitutional, and for eighteen months every CFPB rule carried a question mark. Compliance teams had to sort the bureau’s past orders, current rules and pending rules, because each faced a different risk.
Week of 10 October 2022
In a merged health system, the network decides which hospitals go to paper
CommonSpirit’s ransomware attack hit hospitals in several states while others in the same system carried on. In merged health systems, the blast radius is set by shared identity, shared networks and who can order a precautionary shutdown for everyone.
Week of 3 October 2022
Five principles, three committees: the AI blueprint inside a hospital
The White House’s nonbinding AI blueprint read like new governance. For health systems, most of it described work existing clinical committees already knew how to do. Extending those committees to algorithms beat building a separate AI bureaucracy.
Week of 26 September 2022
Recordkeeping fails where the approved channel is slower than a text
The SEC and CFTC fined large Wall Street firms over employees’ business texts on personal phones. The rules were old and capture tools existed. The failures came from convenience, and fixing them meant channels, supervision and capture assurance moving together.
Week of 19 September 2022
What a stolen license number proves, and what banks treated it as proving
The Optus breach put millions of identity document numbers in criminals’ hands. Banks had used those numbers as proof of identity at account opening, in the contact center and in their own files. Each use needed a different fix.
Week of 12 September 2022
M-22-18 asked producers to sign; agencies first had to know who they were
OMB’s secure software memo made a producer’s signed attestation a condition of federal use. The form drew the attention. The work that lasted was the producer-level inventory behind it and the judgment needed to use what came back.
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s e-government services aimed at public embarrassment, not ransom. When disruption is the goal, agencies have to defend a minimum visible service, contest the attacker’s story, and know who decides on attribution.
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
The second-largest U.S. school district opened on schedule days after ransomware hit its systems. That was possible because classroom teaching depends on few systems. The hard parts were resetting access for an enormous population and telling families what to do.
Week of 22 August 2022
LastPass and the first-draft problem in vendor breach notices
LastPass’s August 2022 notice reported stolen source code and safe customer data. The attacker’s next stage was already under way. Customers needed to read the notice for what it enabled, know what their vaults exposed, and be ready to rotate.
Week of 15 August 2022
Why the IRS’s ten-year budget needed a one-year payoff
The Inflation Reduction Act gave the IRS about 80 billion dollars over a decade, and opponents promised to cut it from the first day. Multiyear money that can be reversed has to be spent in an order where every tranche stands on its own.
Week of 8 August 2022
Tornado Cash and the transfers nobody asked for
Sanctioning a mixer’s smart contracts meant sanctioned funds could arrive uninvited, and the parties a bank would normally screen did not exist. Sanctions programs touching crypto had to handle unsolicited receipts, exposure several hops away, and a designation under legal attack.
Week of 1 August 2022
Why buying the same software as your neighbors removes your fallback
Ransomware at one NHS supplier took urgent care systems offline across many providers at once. Peers could not cover for each other because they ran the same product. U.S. health systems buying shared SaaS face the same exposure, and procurement holds the levers.
Week of 25 July 2022
Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s
The CHIPS and Science Act passed while switches and servers sat on back order. It addressed where chips would be made in the 2030s. IT leaders needed separate answers, on separate clocks, for the backlog, the refresh plan and provenance.