354 articles · page 8 of 18
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were documented. What decided who met the deadline was who could authorize cutting remote access, who could rebuild the devices, and where agencies sat in their contractors’ queues.
Week of 22 January 2024
Test tenants are production when their apps can reach production
Midnight Blizzard reached Microsoft’s executive mailboxes through a test tenant account and an old OAuth app. Whether any non-production identity is a production risk turns on three properties: who can log in to it, what it can reach, and who would notice it acting.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s January 2024 standards defined a major ICT incident as a calculation over clients, transactions, downtime, data and cost. Banks that left those inputs outside their incident tooling could not classify on time, however good their playbooks.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The false bitcoin ETF post from the SEC’s X account came one day before the actual approval, when markets were primed to believe it. Agencies whose announcements move markets or behavior should secure official accounts as privileged credentials, by the calendar, and for the audience.
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
FinCEN opened beneficial ownership filing on January 1, 2024 to tens of millions of small companies while the law faced constitutional challenge. A public obligation at that scale has four design problems, and the last, how it narrows, is rarely planned.
Week of 25 December 2023
Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers
Banks, health systems and agencies were not parties to The New York Times’s December 2023 suit against OpenAI and Microsoft. It still reached them three ways: through the indemnities they relied on, the content they published, and the prompts their vendors kept.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
The December 2023 ALPHV disruption gave hundreds of victims a free decryption tool. Accepting that help well required three things agencies rarely plan for: confirming the offer is real, using the tool without making recovery worse, and keeping legal duties on their own clock.
Week of 11 December 2023
For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms
ONC’s December 2023 rule required certified health IT developers to disclose source attributes for the predictive tools they supply. For models a hospital built itself or bought from someone else, the EHR only had to hold the information, and the hospital had to produce it.
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
HHS’s December 2023 concept paper set out a voluntary baseline, two regulatory routes to make it binding, and incentives that depended on legislation. Requirements could arrive by rulemaking. Money could not, and hospitals had to plan for that gap.
Week of 27 November 2023
Ardent took one network offline, and emergency departments in six states had to answer for it
Ardent’s Thanksgiving 2023 ransomware response was decided centrally and felt locally, in hospitals that carried partners’ names and answered to different state systems. Multi-state operators need the central decision, local authority and partner obligations settled before a holiday weekend.
Week of 20 November 2023
Why the useful response to OpenAI’s board crisis was a days-to-switch number
No third-party risk questionnaire could have predicted OpenAI’s November 2023 board crisis. What regulated buyers controlled was the cost of moving away from any one model provider, set by three things: their contracts, their architecture and their fallbacks.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
When ALPHV publicized its SEC complaint against MeridianLink in November 2023, the vendor’s bank and credit union customers faced their own notification questions with only an attacker’s claim and a vendor statement to go on. Their work split into facts, regulators and customers.
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
When LockBit hit ICBC’s U.S. broker-dealer in November 2023, Treasury trades still had to settle. Every market participant could have been in any of three seats, and each seat needed a different plan written before the day.
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance said rights- and safety-impacting AI must meet minimum practices by a deadline or be switched off. The hard cases were systems already in production, many of them inside vendor products.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers in Okta’s support system replayed session tokens from files customers had uploaded. For health systems, which send vendors logs and screenshots daily, each support artifact’s exposure depends on what it contains, what it is under HIPAA, and how long it stays usable.
Week of 16 October 2023
Free, measured and always on: the open banking interface the CFPB proposed and banks could not price
The October 2023 Section 1033 proposal turned a bank’s data interface into a service with performance targets and no access fees. For banks and credit unions, the questions were what they had to deliver, what they could not recover, and what they still controlled.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
The HTTP/2 flaw disclosed in October 2023 produced record denial-of-service attacks that large providers absorbed at their edge. Agency exposure depended on which group each public service fell into: rented edge, self-hosted, or unknown.
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers signed in to a sliver of 23andMe accounts and, through a relative-matching feature, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change with its holder.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still forced agencies to write lapse plans. Those plans were built around excepted staff, while agency technology also depended on how each contract was funded, what would expire mid-lapse and how systems would restart.
Week of 18 September 2023
Cisco’s Splunk deal and the case for owning your security logs outside the SIEM
A SIEM changing owners exposed where lock-in actually sits: years of logs that retention rules require, detection rules written in one vendor’s query language, and the integrations around them. Each can be moved out of the platform’s exclusive control before the next deal.