354 articles · page 9 of 18
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks used help desk calls to reach identity administrators. For banks, the priority was a small set of control-plane accounts: how they are recovered, who is allowed to recover them, and how a takeover of the identity platform would be spotted.
Week of 4 September 2023
Storm-0558’s post-mortem described three key failures every agency development team can repeat
Microsoft’s September 2023 post-mortem described a signing key it believed had left production in diagnostic data, tokens accepted beyond their scope, and a key that lived for years. Agencies that build their own applications carry all three risks in their own code and contracts.
Week of 28 August 2023
Medicare’s negotiated prices would reach hospital pharmacies as refunds, and refunds have float
When CMS named the first ten drugs for negotiation in August 2023, health systems with their own pharmacies faced three exposures with different owners: the cash gap a refund creates, the overlap with 340B, and the reconciliation systems neither problem could be managed without.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The private fund adviser rules adopted in August 2023 were vacated ten months later. Advisers that sorted the work into what investors would demand, what existing law already required and what only the rule required spent little that was wasted.
Week of 14 August 2023
A weekend of public red-teaming showed agencies that AI testing never finishes
The White House-backed red-teaming of chatbots at DEF CON in August 2023 was a demonstration, not a certification. For agencies buying AI, testing is a standing workload at three stages, before award, before deployment and in operation, and the binding constraint is staff.
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 rating actions confirmed that the spring’s bank stress would become a lasting earnings squeeze. Regional bank technology budgets had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for a smaller margin.
Week of 31 July 2023
Prospect Medical’s ransomware attack ended up on the table in a hospital sale
The August 2023 attack on Prospect Medical Holdings hit an operator that was already financially stretched and mid-way through selling three Connecticut hospitals. For such operators, cyber resilience is a balance-sheet and deal term, priced by buyers, lenders and state approvers.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
The SEC’s July 2023 rule started its four-business-day clock at the materiality determination, not at discovery. That made the determination itself the thing to govern: who makes it, what record it leaves, and how it lines up with every other notification clock.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining turned on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came from storage used to format patient emails, not from clinical systems. Outreach data looks harmless one field at a time, but together it is protected health information and needs EHR-grade ownership, inventory and minimization.
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s Local Law 144 made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder prerequisite was finding every tool that scores candidates, deciding which were in scope, and naming an owner for each.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
Colorado and Connecticut switched on their privacy laws while a California court paused new regulations a day before enforcement. When effective dates move this much, a privacy program should be organized around four standing capabilities, with each new law mapped onto them.
Week of 19 June 2023
Why a stolen DMV file weakened identity checks at agencies that were never breached
When MOVEit exposed the license records of most drivers in two states, license numbers and issue dates stopped being secrets. Every agency that used them to verify residents online inherited the breach, whether or not it ran MOVEit.
Week of 12 June 2023
Why the AI Act’s obligations follow your role, not your sector
The European Parliament’s June 2023 position drew headlines for generative AI. Its durable feature for banks, health systems and agencies was structure: duties attach to whether an organization builds a system, deploys one, or builds on a general-purpose model, and many hold all three roles.
Week of 5 June 2023
Most MOVEit victims never ran MOVEit
MOVEit reached thousands of organizations through payroll, pension and contractor firms that ran the software for them. Those clients had nothing to patch. Their exposure turned on finding affected vendors fast, settling who notified whom, and how much data they had sent.
Week of 29 May 2023
Flat caps, rising subscriptions: how the debt deal squeezed federal IT from the inside
The Fiscal Responsibility Act held nondefense spending roughly flat for two years. Federal IT budgets did not shrink evenly. Subscriptions and cloud bills grew on their own, modernization was deferred by default, and technical staff thinned through attrition. Each needed its own control.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
The May 2023 disclosures described a state actor inside US infrastructure using built-in tools and hijacked routers, not malware. Agencies and utilities had to know normal administrator behavior, own their network edge, and plan to run without a trustworthy network.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
The FTC had already said health apps outside HIPAA owe breach notice for unauthorized sharing. Its May 2023 proposal mattered for its definitions, which showed that one patient’s data can change regulators as it moves between a hospital, a consumer product and an app.
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency’s end unwound telehealth flexibilities on separate schedules set by Congress, the DEA, OCR and the states. Each schedule governed a different workforce question: what clinicians may prescribe remotely, where they may practice from, and which tools they may use.
Week of 1 May 2023
First Republic’s white-glove service had no answer for an uninsured balance
First Republic’s clients were loyal until the question became whether money above the insurance limit was safe. In a confidence crisis, client experience means three capabilities most banks lacked: seeing each client’s insured position, changing it fast, and saying something specific.