354 articles · page 17 of 18
Week of 24 August 2020
Low for long: the rate forecast hidden in bank technology budgets
The Fed’s August 2020 framework change gave banks a credible reason to plan for years of near-zero rates. Many technology business cases quietly assumed it, in deposit forecasts, channel metrics and contract terms that later came due.
Week of 17 August 2020
Why the Postal Service slowdown belonged on agency risk registers
The August 2020 mail controversy was covered as an election story. For agencies that send notices, payments and medications, it exposed a channel dependency with statutory deadlines attached and no owner inside the agency.
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
SP 800-207 is remembered for its architecture diagrams. Its lasting effect was a list of prerequisites, about assets, identities, data and telemetry, that most agencies could not yet meet and no product could supply.
Week of 3 August 2020
Capital One’s cloud penalty was a verdict on sequencing
The OCC’s $80 million penalty did not say the cloud was unsafe. It said a bank moved critical operations before its risk management could describe, test and monitor them, and it priced that gap.
Week of 27 July 2020
Lifespan’s stolen laptop and the home office risk analyses missed
OCR’s July 2020 settlement with Lifespan turned on an unencrypted laptop, a weak device inventory and missing agreements. It landed as health care’s administrative staff settled in at home, where HIPAA risk analyses written for hospital buildings had not followed them.
Week of 20 July 2020
The control system map most operators did not have
The NSA and CISA alert of July 23, 2020, urged immediate action to protect control systems. Its first and hardest request was an accurate map of what was actually connected, which municipal utilities, hospitals and data center operators rarely had.
Week of 13 July 2020
Schrems II and the case for deciding where data lives first
The EU’s highest court invalidated the EU-US Privacy Shield on July 16, 2020, and made standard contractual clauses depend on case-by-case assessment. Organizations that settled data location and key control first found the legal paperwork easier, and survived later swings in the law.
Week of 6 July 2020
Why hospital COVID reporting turned out to be infrastructure
In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and report through a new HHS pathway. The switch showed that reporting depends on definitions, pipelines and governance, and that hospitals relying on manual counts paid for every change.
Week of 29 June 2020
Why Form CRS was the easy part of Regulation Best Interest
Broker-dealers had to comply with Regulation Best Interest and deliver Form CRS from June 30, 2020. The disclosure document was a contained project. Showing that each recommendation met the standard, and that conflicts were controlled, required data most firms did not capture.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center documents through the compromise of one web development firm. Each agency had judged a small contract; nobody had judged the shared platform, its accumulated archive or its sprawling user base.
Week of 15 June 2020
What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, and €1.9 billion of its cash probably never existed. Partners relying on those signals learned that three checks cannot be delegated: where the money comes from, whether customer funds are visible, and how to leave.
Week of 8 June 2020
When vendors set facial recognition policy before agencies did
IBM, Amazon and Microsoft stepped back from selling facial recognition to police within days in June 2020. Agencies discovered that suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.
Week of 1 June 2020
UCSF’s ransom decision was shaped long before the attack
The NetWalker attack on servers at UCSF’s School of Medicine, and the university’s decision to pay, show that a ransom choice is largely settled in advance. Backups, data placement, insurance terms and advisers on retainer decide how much room leaders have.
Week of 25 May 2020
Why valid when made left bank-fintech lenders two open questions
The OCC’s May 29, 2020, rule said a national bank loan’s permissible interest survives its sale. That settled one question for bank-fintech lending. It left open who the true lender is, and how the bank proves it oversees the program.
Week of 18 May 2020
Small-dollar loans, alternative data and the governance attached
The May 2020 interagency principles invited banks and credit unions back into small-dollar lending and accepted new data and technology in underwriting. Using cash-flow data responsibly required three disciplines: consented data access, model risk management and fair lending controls for automated decisions.
Week of 11 May 2020
Every unemployment fraud control had a cost to real claimants
In May 2020, federal warnings about organized fraud against state unemployment systems pushed agencies to add identity checks to overloaded services. Each control point, at application, before payment or after it, shifted cost onto legitimate claimants in a different way.
Week of 4 May 2020
Password spraying against research labs: an old attack on a new target
The May 5, 2020, CISA and NCSC advisory warned that state-backed groups were spraying passwords at health and research organizations to reach COVID-19 research. The defenses were familiar; applying them across academic medicine’s split identities, data stores and remote access was the hard part.
Week of 27 April 2020
For many Medicare patients, telehealth meant a phone call
CMS’s April 30, 2020, rule paid audio-only visits at levels comparable to office visits. For many older, rural and low-income patients the phone was the only telehealth that worked, so it needed its own workflow and controls.
Week of 20 April 2020
Zoom 5.0 fixed the vendor layer; configuration and records stayed yours
Zoom’s April 2020 release improved encryption and tightened defaults after weeks of scrutiny. For banks, health systems and agencies, most compliance risk sat in two layers no vendor release could fix: how the platform was configured, and what meeting content had to be kept.
Week of 13 April 2020
Why exposure notification apps rose or fell on the back office
Apple and Google’s framework settled the privacy design of exposure notification for health agencies. Whether an app helped depended on what agencies controlled: test verification codes, the advice an alert triggered, and the effort put into adoption.