354 articles · page 14 of 18
Week of 18 October 2021
BlackMatter’s reach was set by the directory, not the malware
The October 2021 BlackMatter advisory described attackers arriving with stolen credentials and using Active Directory to find everything worth encrypting. How far one credential could travel was decided by identity design made years earlier.
Week of 11 October 2021
FinCEN’s ransomware analysis turned well-written SARs into threat intelligence
FinCEN’s October 2021 trend analysis showed that suspicious activity reports can map a criminal economy, but only when filers record cyber indicators in usable form. That choice, made at the investigator’s desk, decides the data’s value inside the bank too.
Week of 4 October 2021
Why a security attestation to government now carries fraud risk
The Justice Department’s Civil Cyber-Fraud Initiative tied the False Claims Act to the gap between what contractors and grantees say about security and what they do. That moved the risk from the security team to whoever signs.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
When a widely used root certificate expired on September 30, 2021, valid servers stayed up and old clients broke. For health systems, the exposure sat in device and integration trust stores that no team owned or inventoried.
Week of 20 September 2021
What sanctioning SUEX changed for banks that serve crypto firms
Treasury’s September 2021 designation of SUEX moved sanctions pressure from the ransom payment to the cash-out. Because SUEX worked through other exchanges, banks serving crypto businesses had to decide how far down three layers of exposure to look, and pay for it.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
The FTC’s September 2021 policy statement said a health app that shares data without users’ authorization has suffered a breach. That moved breach prevention from the security team to three business decisions: what code ships, what partners receive, and what users agreed to.
Week of 6 September 2021
Vaccination status was the easy record; exemptions were the hard one
Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. Of the three capabilities it demanded, status records, weekly testing and exemption decisions, the third carried the lasting legal risk and was the one most organizations under-built.
Week of 30 August 2021
Hurricane Ida and the IT dependencies that sit under the EHR
After Hurricane Ida, Louisiana hospitals ran for days on generators while the grid and carrier networks were down. A week like that tests three layers beneath clinical applications, each owned by a different team: power, connectivity and hosting.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
Companies at the August 2021 White House cyber summit pledged to train hundreds of thousands of people. For public agencies, the shortage had three parts: supply, access and retention. Pledges addressed the first, while agencies held the levers for the other two.
Week of 16 August 2021
Data stayed in China and still left: PIPL’s remote access problem
China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to store data in-country. Storage was the easy half. Personal information still left through three paths a data center map does not show: copies, remote views and derived outputs.
Week of 9 August 2021
Who counts as a crypto broker mattered less than what brokers could not know
The Senate’s August 2021 fight over the infrastructure bill’s crypto provision was about who counts as a broker. For banks and brokerages, scope was never in doubt. The hard part was three kinds of data they did not hold: cost, movement and counterparties.
Week of 2 August 2021
The paper card that made Key to NYC’s digital pass work
New York City’s August 2021 vaccination requirement accepted digital passes and the paper CDC card alike. That fallback carried the program through weak records and untrained verifiers, and it is the design choice agencies issuing digital credentials should copy first.
Week of 26 July 2021
What a voluntary control systems memo could not give small water utilities
The July 2021 national security memorandum promised cybersecurity goals for infrastructure control systems. Voluntary goals presume an owner, a budget line and a reason to act. Most small public water systems had none, and local officials, not federal agencies, were positioned to supply them.
Week of 19 July 2021
How a bed-count fine repriced hospital price secrecy
CMS’s July 2021 proposal scaled price transparency penalties to hospital size, so the largest systems lost their cheapest option. Compliance then became a standing data product whose most attentive readers were payers, employers and competitors, not patients.
Week of 12 July 2021
A permanent telehealth benefit with an in-person clock attached
Medicare’s July 2021 fee schedule proposal made home telehealth for mental health the first permanent post-pandemic benefit. Its conditions turned continuity of care into a records problem: where the patient is, how the visit happens, and when they were last seen in person.
Week of 5 July 2021
Why community banks’ open banking experience sat with their core vendors
The July 2021 competition order pushed the CFPB toward a data access rule. For community banks and credit unions, the customer’s experience of sharing data was already being decided elsewhere: by core and digital banking vendors, in three moments the institution only partly controlled.
Week of 28 June 2021
Kaseya and the most privileged system nobody on site runs
REvil’s attack through Kaseya VSA reached hundreds of businesses through the tools their IT providers used to manage them. Clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.
Week of 21 June 2021
TransUnion won Ramirez, and name-only matching still lost
The Supreme Court’s June 2021 ruling narrowed who can sue over inaccurate credit file flags. The facts underneath were an entity resolution failure that banks and fintechs share, and the ruling changed none of the three things that govern it.
Week of 14 June 2021
Juneteenth tested how many calendars a bank really runs
Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it showed that a business day is defined in three places, payment rails, customer commitments and the workforce, usually owned by different teams.
Week of 7 June 2021
Why Basel’s 1,250% risk weight pointed banks toward custody
The Basel Committee’s June 2021 consultation made holding bitcoin on a bank balance sheet prohibitively expensive in capital. That split the bank crypto question into three businesses with different economics, holding, safeguarding and moving value, and only one was priced out.