354 articles · page 7 of 18
Week of 17 June 2024
Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies had dropped Kaspersky years earlier. The June 2024 Commerce determination reached counties, school districts, utilities and contractors with a fixed date, and showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
Week of 10 June 2024
Why banking-as-a-service margins never covered the cost of knowing whose money it was
The Fed’s order against Evolve showed that sponsor-bank revenue grew with balances while the costs of reconciliation, oversight and partner failure grew with the number of programs. Banks that priced only the first side carried the second.
Week of 3 June 2024
Synnovis put a price on pathology consolidation that no contract carried
The ransomware attack on Synnovis showed that consolidating a region’s pathology into one partner saves money every year and concentrates a rare, very large loss. The business case counted the savings. Nobody’s contract, budget or insurance carried the loss.
Week of 27 May 2024
Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter
The 2024 campaign against Snowflake customers broke no platform. It used passwords stolen from infected machines, often contractors’, and walked out with bulk data. Each stage, from theft to login to extraction, was a control point the customer owned.
Week of 20 May 2024
How Windows Recall put a possible public record where no records officer could reach it
Recall’s redesign answered the security objections by keeping screen snapshots local, sealed to the user and self-expiring. Those same three properties put the snapshots outside the search, hold and retention tools agencies use to meet public records and discovery duties.
Week of 13 May 2024
The vendor clock: amended Regulation S-P rests on a 72-hour promise someone else makes
The SEC’s 2024 Regulation S-P amendments gave customers a 30-day breach notice and required service providers to report within 72 hours. For broker-dealers and advisers whose customer data sits mostly with vendors, that second clock decides how well the first one works.
Week of 6 May 2024
Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once
A large system’s hospitals normally cover for each other with beds, staff and shared services. When ransomware took Ascension’s shared platforms down across its markets, that internal mutual aid failed together, and the help had to come from outside.
Week of 29 April 2024
Why Change Healthcare’s missing MFA was a deal-integration failure
UnitedHealth’s testimony traced the Change Healthcare attack to a remote-access portal without MFA, about sixteen months after the acquisition closed. Health care buyers should treat inherited internet-facing access as a closing condition, an interim-period control set and a board-level exception list.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of purpose. That shifted paperwork onto requesters but left hospitals with judgments no form could make, under a rule a court vacated in 2025.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
Palo Alto withdrew a mitigation within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery for themselves did not have to wait for the vendor’s next revision.
Week of 8 April 2024
How the APRA draft moved privacy compliance to the customer’s side of the counter
The American Privacy Rights Act draft never passed. Its distinctive features let individuals act directly, through requests, machine-readable opt-out signals and lawsuits. Those three channels, already arriving through state law, are where regulated organizations’ privacy programs are now judged.
Week of 1 April 2024
Agencies buy a cloud provider’s security culture whether or not the contract mentions it
The Cyber Safety Review Board blamed the 2023 Exchange Online intrusion on Microsoft’s security culture. Agencies cannot audit a culture, but the report showed three places it leaves evidence a buyer can demand: secrets, disclosure and defaults.
Week of 25 March 2024
Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record
The final OMB memo kept the draft’s comply-or-stop deadline and added something sharper. Every way out of it, whether a determination, a waiver or an extension, now needed a named signer, documented evidence and a public or OMB-reviewed record.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
The March 2024 White House and EPA letter invited each state’s environmental, health and homeland security secretaries. That list was the finding: water cybersecurity in a state sits with a regulator, a funder and a responder, and few governors had named anyone to join them.
Week of 11 March 2024
Why the AI Act left bank credit models with the supervisor they already had
The AI Act text adopted in March 2024 routed high-risk credit scoring through banking supervision and let existing governance satisfy some duties. For banks, the work was separating what model risk management already met from what it never covered.
Week of 4 March 2024
Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage
Two weeks into the Change Healthcare outage, the federal response was about money. For providers that were never attacked, survival turned on three financial questions: how long they could last, who would lend to them, and who would finally bear the loss.
Week of 26 February 2024
CSF 2.0’s biggest addition was the one a security team could not deliver
NIST’s new Govern function looked like a security framework update. Its six categories assign work to executives, HR, procurement and boards. Organizations that treated it as a mapping exercise for the CISO missed what had changed.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
When ransomware hit the largest US claims clearinghouse, every connected provider faced the same call. Cutting the connection was quick. Knowing what to cut, and what proof to demand before reconnecting, depended on preparation few had done.
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
The deepfaked video call that moved about US$25 million beat a meeting, not a payment system. Most firms let staff treat a face on screen as identity. Banks need controls at the invitation, inside the meeting, and at the handoff to money.
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and payers that receive substance use disorder records treat them almost like other health data. The treatment programs that create them, and the legal teams that answer subpoenas, carried more obligation than before.