354 articles · page 15 of 18
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
The Supreme Court’s June 2021 Van Buren decision took most purpose-based insider misuse out of the federal computer crime law. For agencies holding sensitive records, deterrence now rests on three controls they own: access design, query monitoring and consequences.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
TSA’s first pipeline security directive after Colonial Pipeline imposed a 12-hour reporting deadline, a named coordinator and a 30-day self-assessment. Each became a template that regulators copied across sectors, and each needed a different internal capability.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
The Conti attack on Ireland’s Health Service Executive is remembered for its national scale. Its later independent review showed the outcome was set during nearly eight weeks of undetected access, across three stages: entry, dwell and response.
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order turned a marketing term into three demands any agency can test system by system: verified identity, retained evidence, and accountable software supply chains.
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
Scripps Health spent most of May 2021 without its electronic health record after a ransomware attack. Downtime plans written for hours failed over weeks on three separate fronts: clinical continuity, revenue continuity and workforce endurance.
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on disclosure. Planning had to start from which data would hurt whom if published: the workforce, the mission, or the public.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted banks’, hospitals’ and agencies’ AI by business process, which put compliance ownership with process owners as much as data scientists.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 agreement to buy Nuance put ambient clinical documentation inside a large cloud platform. For health systems, the decisions that mattered concerned the encounter recording itself, the review workflow around the draft note, and the contract governing both.
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
When the Cures Act information blocking rules applied on April 5, 2021, health systems discovered that compliance was decided by portal settings and release-of-information queues. Three operational questions mattered: what gets released, when, and how a withholding decision is defended.
Week of 29 March 2021
Five regulators’ AI questions read like an exam plan
The March 2021 interagency request for information on AI produced no new rule. Its questions mapped onto four supervisory tests that existing rules already imposed, and that still frame how supervisors look at any model in a bank or credit union.
Week of 22 March 2021
Each Archegos lender already held enough data to act
Archegos is usually told as a story of positions hidden across many prime brokers. The costlier failure sat inside individual banks, in three layers: what each could see of its own exposure, what it could infer about the rest, and whether anyone acted.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again put business email compromise at the top of its loss table. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
Week of 8 March 2021
One-time money, recurring bills: the Rescue Plan’s technology hangover
The American Rescue Plan gave state and local governments $350 billion of flexible, temporary money. Where it paid for subscriptions, the risk sat in three places: the shape of the funds, the shape of the costs, and contracts signed in a hurry.
Week of 1 March 2021
ProxyLogon: the patch was the easy part
The March 2021 Exchange Server zero-days looked like a patching race. For public agencies, the damage was decided by three gaps a patch could not close: knowing what faced the internet, hunting for intruders afterward, and owning the decision to retire the platform.
Week of 22 February 2021
A few hours without Fedwire, and the bank promises with no fallback
The Federal Reserve’s February 24, 2021 outage caused little lasting harm. It still showed how few banks had mapped which customer commitments rest on a single central rail, rehearsed the narrow manual alternatives, or planned for the backlog afterward.
Week of 15 February 2021
Why working from home failed when Texas froze
A year into the pandemic, many continuity plans answered every site outage with remote work. Winter Storm Uri removed power, water, roads and home connectivity together, showing that a single fallback fails when failures are correlated across people, sites, networks and suppliers.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that can tell the two apart, safeguards that work whoever acts, and public statements that survive revision.
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached agencies through an aging file transfer appliance few leaders could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern returned through other products for years.
Week of 25 January 2021
GameStop’s buy button was switched off in the clearinghouse
When retail brokers stopped customers buying GameStop on January 28, 2021, the cause sat in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app are one system, though three teams own them.
Week of 18 January 2021
Vaccine access hinged on open appointments nobody could see
In January 2021, vaccine eligibility widened faster than states could show where doses were. Scheduling failed less from web traffic than from three ownership gaps: eligibility rules, appointment inventory held by partners, and assisted channels treated as overflow.