354 articles · page 12 of 18
Week of 18 July 2022
Necessary and proportionate: the ADPPA test that outlived the bill
The federal privacy bill that cleared committee 53 to 2 never reached the floor. Its minimization test did outlast it, and banks and hospitals were more exposed to that test than their sector carve-outs suggested.
Week of 11 July 2022
988 launched without 911’s plumbing: location, dispatch and a fee
The crisis line got a three-digit number in July 2022, but none of the infrastructure 911 spent decades acquiring. States inherited three gaps: no caller location, no settled way to send help, and no dedicated funding stream.
Week of 4 July 2022
Rogers: the bank outage that started at someone else’s carrier
When one Canadian carrier failed for most of a day, debit payments failed nationwide, including for banks that never bought a Rogers circuit. Telecom dependency hides in three places a bank’s dual-carrier policy does not reach: shared payment utilities, thinly connected channels, and customers’ phones.
Week of 27 June 2022
A rule’s survival odds belong in the compliance plan
West Virginia v. EPA gave courts a named test for striking ambitious rules. That made durability something agencies and the organizations they regulate had to estimate: in how new rules are written, in how existing programs are defended, and in how compliance money is sequenced.
Article · 21 June 2022 · Simon Malian
The Rising Threat of Medical Device Hacking & How Healthcare Organizations Can Prevent It
All attacks on the healthcare industry are vital to address. We believe the most pressing area to mitigate is the hacking of medical devices.
Week of 20 June 2022
Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went to medical records, where HIPAA already set rules. The larger exposure for health systems sat at their own digital edges and in consumer data they never held but patients assumed was protected.
Week of 13 June 2022
Internet Explorer retired; its clinical applications did not
IE mode in Edge let hospitals keep legacy web applications running after the old browser’s retirement. The compatibility list it required was a ready-made inventory of legacy risk, best worked down by who could fix each site: the hospital, its vendors, or outside parties.
Week of 6 June 2022
Your carrier’s routers belong in your threat model
A joint advisory described state actors working through network devices to get inside telecom and network service providers. For enterprises that buy those services, it meant treating the provider’s network as untrusted transport, its administrators as privileged users, and its silence as a monitoring gap.
Week of 30 May 2022
No patch yet: Follina and Confluence tested who may switch things off
Two flaws exploited before fixes existed left health systems with workarounds only. The deciding factor was organizational: who could authorize turning something off, who could carry it out across the edges of the estate, and who confirmed it worked.
Week of 23 May 2022
An acquisition announcement is a free option on your exit plan
Broadcom’s agreement to buy VMware gave customers eighteen months before anything changed. The organizations that came out best treated that window as an option to buy cheaply: a priced exit path, kept alive with small investments, and exercised on evidence at renewal.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s pledge not to charge good-faith security research made outside reports more likely. For agencies, the work it created was operational: a front door for reports, a route to whoever can fix the flaw, and a way to close the loop.
Week of 9 May 2022
Stable is a claim: what TerraUSD asked of bank front lines
Few banks held TerraUSD, but its collapse reached them through customers: scams riding on the losses, disputes over transfers customers had authorized, and confusion about which products near a deposit were actually protected.
Week of 2 May 2022
Quantum risk is dated by how long your data must stay secret
NSM-10 set 2035 as a national goal, but for any given agency system the effective deadline is earlier: how long its data must stay confidential, plus how long migration will take, measured against when a capable machine might exist.
Week of 25 April 2022
Why the CFPB’s dormant authority put fintech partners on the exam calendar
By reviving a rarely used power to supervise nonbanks whose conduct poses risks to consumers, the CFPB made exam readiness something fintechs had to build before scale, and something their sponsor banks had to check.
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
An April 2022 federal advisory described North Korean operators courting crypto-firm engineers with fake recruiting and trojanized apps. For any financial firm, a job approach reaches the people with the most access through a channel security rarely watches, so controls must assume one will succeed.
Week of 11 April 2022
Ninety days at a time: telehealth’s stack of temporary permissions
Another 90-day renewal of the public health emergency in April 2022 kept telehealth running on permissions with different owners and end dates. Patients saw one service. Health systems had to manage each layer separately and show patients, at booking, which rule their visit relied on.
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
The April 2022 court-authorized takedown of the Cyclops Blink botnet showed small firewalls serving Russian military intelligence as relays, often without their owners noticing. For public agencies, an unmanaged edge device is a liability to others before it is a breach of their own.
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
A Java flaw with a Log4Shell-style nickname arrived four months after Log4Shell, amid confusion over which bug was which. Its narrow exploit conditions made it a test of triage, and of whether tired hospital IT teams could avoid a second all-hands scramble.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
The March 2022 Okta disclosure showed that a subcontractor’s support engineer sat inside every customer’s trust boundary. For health systems running clinical access through one identity provider, the exposure was the two months before customers knew, and the logs they did not hold.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 fixed two clocks in statute and left coverage to a rulemaking that would take years. The decisions those clocks force, inside a hospital’s incident command, did not depend on the rule’s details.