354 articles · page 13 of 18
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day incident clock. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and that text would become a standard others could test.
Week of 28 February 2022
Russia’s sanctions tested banks’ ownership data more than their name lists
The sanctions on Russia from late February 2022 came in fast waves, from several governments, against sprawling corporate groups. Screening names against lists caught the obvious cases. Exposure sat in unnamed subsidiaries, effective dates and jurisdiction-specific rules, all of them data problems.
Week of 21 February 2022
Shields Up had no end date, so vigilance needed a staffing plan
When Russia invaded Ukraine, CISA asked every US organization to raise its guard, with no date to lower it. Sustaining a heightened posture for months was a management problem: who watches, who decides, and what work stops to pay for it.
Week of 14 February 2022
In Ukraine’s bank DDoS, the rumor outran the outage
The February 2022 denial-of-service attacks on Ukrainian state banks caused short disruptions, paired with false texts saying ATMs had failed. A bank’s availability in a crisis includes what customers believe about their money, so communication and alternative channels belong in the resilience plan.
Week of 7 February 2022
Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 to a $3.6 billion seizure in 2022 because the ledger never forgets. The decisive links sat at regulated firms, so banks’ own records of crypto-linked activity need to be built to be read years later.
Week of 31 January 2022
One door is not a service: the IRS selfie reversal
The IRS backed away from mandatory selfie verification in February 2022 because a single proofing route, however strong against fraud, locks out part of a universal population. Agencies needed several routes to the same assurance level, measured by who fails.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told agencies to adopt authentication that phishing cannot defeat. Strong authenticators shifted attacker attention to how credentials are issued, replaced and reset, a process run by help desks the memo barely mentioned.
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
WhisperGate looked like ransomware but destroyed data with no way back. For US public agencies, it exposed continuity plans that quietly counted on payment as a last resort, and recovery times nobody had measured from total loss.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, compliance would be tested by state surveyors against a staff list that included contractors, students and practitioners. Most hospitals had no single list that reached past the payroll.
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
The FTC’s January 2022 warning tied Log4j remediation to its reasonable-security standard. Reasonableness is judged later, from records, so the decisive work was documenting the response while it happened, including what vendors said and when.
Week of 27 December 2021
Why good-faith estimates weighed most on the therapist’s office
From January 1, 2022, every state-licensed provider owed uninsured and self-pay patients a written estimate before scheduled care. Hospitals had revenue cycle teams to absorb it. Therapists and small practices, where self-pay is common and treatment has no fixed end, did not.
Week of 20 December 2021
Oracle bought Cerner, and Cerner customers inherited a cloud strategy
Oracle’s December 2021 agreement to buy Cerner gave health systems on that record a new owner with its own database, cloud and priorities. The decisions in front of them were about roadmap, hosting and contract terms, and the timing of each.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
When ransomware took a widely used cloud timekeeping service offline in December 2021, cities, transit agencies and public hospitals still had to pay shift workers correctly. The vendor owned the platform. The employer kept the paycheck, the time record and the legal duty.
Week of 6 December 2021
Log4Shell was a search problem before it was a patching problem
The Log4j flaw disclosed in December 2021 was easy to exploit and easy to fix. The crisis was finding it, and the difficulty differed for software an organization builds, software it buys and software it consumes as a service.
Week of 29 November 2021
Inflation’s first casualty in bank IT was the change budget
When the Fed dropped “transitory” in late November 2021, bank and credit union technology budgets faced a quiet squeeze. Run costs rose automatically through contracts, wages and usage pricing, so the money for modernization absorbed the difference.
Week of 22 November 2021
Omicron’s scarcest resource was staff, and few hospitals could count them in real time
When WHO named Omicron a variant of concern in late November 2021, hospitals braced for patients. The binding constraint that winter was staff able to work, and the speed of every decision depended on joining data scattered across HR, scheduling and occupational health.
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s State and Local Cybersecurity Grant Program paired $1 billion with a cost share that grew every year. That design asked states and localities what they would keep paying for once the federal money stopped.
Week of 8 November 2021
Robinhood’s phone-call breach argues for support access sized to one customer
In November 2021, one socially engineered support employee gave an attacker reach into millions of customer records at a retail brokerage. The fix sits in three places: the agent on the phone, the tools behind them, and what customers are taught to trust.
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
CISA’s Binding Operational Directive 22-01 replaced severity scores with a short, evidence-based list and a federal deadline. Its biggest effect was on how agency patch teams spent their week, argued with system owners, and exposed weak asset inventories.
Week of 25 October 2021
Non-bank lenders got bank-grade security rules and a named person to answer for them
The FTC’s amended Safeguards Rule gave mortgage brokers, auto dealers, finance companies and tax preparers specific security controls. The harder change was governance: one qualified individual, a written report to the board, and evidence that the program ran.