Insights · Looking Back

Platforms & Architecture

The Looking Back articles seen through platforms & architecture, across every sector, in order.

45 articles

January 2020

  1. Week of 20 January 2020

    Citrix gateways: the most exposed system in the hospital

    The Citrix flaw exploited in January 2020 showed that the gateway clinicians used to reach the EHR from outside was a hospital’s most exposed system. Hardening it meant ownership, segmentation behind it and a hunt after every patch.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

February 2020

  1. Week of 17 February 2020

    Morgan Stanley and E*Trade: wealth scale is a client-data problem

    Morgan Stanley’s deal for E*Trade, months after Schwab agreed to buy TD Ameritrade, bet on joining self-directed, advised and workplace channels. Whether such scale pays depends on three layers of integration, and the client layer comes first for firms of any size.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

March 2020

  1. Week of 16 March 2020

    Hairpin traffic, distant data centers and the road to federal zero trust

    When OMB told agencies to maximize telework, the binding constraint was a network design that sent remote traffic back through agency data centers and Trusted Internet Connections. Fixing it pushed federal security from location toward identity and device.

    • Government
    • Platforms & Architecture
    • 5 min read

July 2020

  1. Week of 13 July 2020

    Schrems II and the case for deciding where data lives first

    The EU’s highest court invalidated the EU-US Privacy Shield on July 16, 2020, and made standard contractual clauses depend on case-by-case assessment. Organizations that settled data location and key control first found the legal paperwork easier, and survived later swings in the law.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

August 2020

  1. Week of 3 August 2020

    Capital One’s cloud penalty was a verdict on sequencing

    The OCC’s $80 million penalty did not say the cloud was unsafe. It said a bank moved critical operations before its risk management could describe, test and monitor them, and it priced that gap.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

  2. Week of 10 August 2020

    What NIST’s zero trust definition quietly required agencies to know

    SP 800-207 is remembered for its architecture diagrams. Its lasting effect was a list of prerequisites, about assets, identities, data and telemetry, that most agencies could not yet meet and no product could supply.

    • Government
    • Platforms & Architecture
    • 5 min read

January 2021

  1. Week of 25 January 2021

    GameStop’s buy button was switched off in the clearinghouse

    When retail brokers stopped customers buying GameStop on January 28, 2021, the cause sat in clearing and settlement. The episode showed that a broker’s settlement exposure, its treasury playbook and its app are one system, though three teams own them.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

February 2021

  1. Week of 1 February 2021

    Accellion and the file transfer server nobody owned

    The Accellion breaches reached agencies through an aging file transfer appliance few leaders could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern returned through other products for years.

    • Government
    • Platforms & Architecture
    • 5 min read

  2. Week of 22 February 2021

    A few hours without Fedwire, and the bank promises with no fallback

    The Federal Reserve’s February 24, 2021 outage caused little lasting harm. It still showed how few banks had mapped which customer commitments rest on a single central rail, rehearsed the narrow manual alternatives, or planned for the backlog afterward.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

May 2021

  1. Week of 10 May 2021

    Executive Order 14028 gave zero trust three testable demands

    Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order turned a marketing term into three demands any agency can test system by system: verified identity, retained evidence, and accountable software supply chains.

    • Government
    • Platforms & Architecture
    • 5 min read

June 2021

  1. Week of 28 June 2021

    Kaseya and the most privileged system nobody on site runs

    REvil’s attack through Kaseya VSA reached hundreds of businesses through the tools their IT providers used to manage them. Clients had outsourced the work but kept the risk, and three gaps decided their exposure: privilege, concentration and contract.

    • Cross-sector
    • Platforms & Architecture
    • 6 min read

August 2021

  1. Week of 16 August 2021

    Data stayed in China and still left: PIPL’s remote access problem

    China’s Personal Information Protection Law, adopted in August 2021, pushed multinationals to store data in-country. Storage was the easy half. Personal information still left through three paths a data center map does not show: copies, remote views and derived outputs.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

  2. Week of 30 August 2021

    Hurricane Ida and the IT dependencies that sit under the EHR

    After Hurricane Ida, Louisiana hospitals ran for days on generators while the grid and carrier networks were down. A week like that tests three layers beneath clinical applications, each owned by a different team: power, connectivity and hosting.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

September 2021

  1. Week of 27 September 2021

    Trust nobody owned: the expired root certificate and hospital legacy clients

    When a widely used root certificate expired on September 30, 2021, valid servers stayed up and old clients broke. For health systems, the exposure sat in device and integration trust stores that no team owned or inventoried.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

December 2021

  1. Week of 6 December 2021

    Log4Shell was a search problem before it was a patching problem

    The Log4j flaw disclosed in December 2021 was easy to exploit and easy to fix. The crisis was finding it, and the difficulty differed for software an organization builds, software it buys and software it consumes as a service.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

January 2022

  1. Week of 24 January 2022

    M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery

    OMB’s zero trust memo told agencies to adopt authentication that phishing cannot defeat. Strong authenticators shifted attacker attention to how credentials are issued, replaced and reset, a process run by help desks the memo barely mentioned.

    • Government
    • Platforms & Architecture
    • 5 min read

June 2022

  1. Week of 6 June 2022

    Your carrier’s routers belong in your threat model

    A joint advisory described state actors working through network devices to get inside telecom and network service providers. For enterprises that buy those services, it meant treating the provider’s network as untrusted transport, its administrators as privileged users, and its silence as a monitoring gap.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

  2. Week of 13 June 2022

    Internet Explorer retired; its clinical applications did not

    IE mode in Edge let hospitals keep legacy web applications running after the old browser’s retirement. The compatibility list it required was a ready-made inventory of legacy risk, best worked down by who could fix each site: the hospital, its vendors, or outside parties.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

October 2022

  1. Week of 10 October 2022

    In a merged health system, the network decides which hospitals go to paper

    CommonSpirit’s ransomware attack hit hospitals in several states while others in the same system carried on. In merged health systems, the blast radius is set by shared identity, shared networks and who can order a precautionary shutdown for everyone.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

December 2022

  1. Week of 5 December 2022

    Rackspace kept running old Exchange for clients, and kept its old risks

    The Rackspace ransomware incident showed that paying a provider to run an aging platform transfers the work, not the platform’s exposure. Customers needed three things the contract rarely described: a patch path, an exit path and a recovery path they controlled.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

February 2023

  1. Week of 13 February 2023

    Why a file-transfer server belongs on the list of systems that hold PHI

    The GoAnywhere breach reached patient data through a file-transfer product most health systems treated as plumbing. Managed file transfer is a data tier with its own exposure, retention and accountability, and it needs the discipline applied to any system of record.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

July 2023

  1. Week of 17 July 2023

    Why FedNow was a core-processor decision for community banks and credit unions

    The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining turned on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

September 2023

  1. Week of 18 September 2023

    Cisco’s Splunk deal and the case for owning your security logs outside the SIEM

    A SIEM changing owners exposed where lock-in actually sits: years of logs that retention rules require, detection rules written in one vendor’s query language, and the integrations around them. Each can be moved out of the platform’s exclusive control before the next deal.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

October 2023

  1. Week of 9 October 2023

    Rapid Reset sorted agency websites into three groups, and one of them had no owner

    The HTTP/2 flaw disclosed in October 2023 produced record denial-of-service attacks that large providers absorbed at their edge. Agency exposure depended on which group each public service fell into: rented edge, self-hosted, or unknown.

    • Government
    • Platforms & Architecture
    • 5 min read

January 2024

  1. Week of 22 January 2024

    Test tenants are production when their apps can reach production

    Midnight Blizzard reached Microsoft’s executive mailboxes through a test tenant account and an old OAuth app. Whether any non-production identity is a production risk turns on three properties: who can log in to it, what it can reach, and who would notice it acting.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

April 2024

  1. Week of 15 April 2024

    Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last

    Palo Alto withdrew a mitigation within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery for themselves did not have to wait for the vendor’s next revision.

    • Government
    • Platforms & Architecture
    • 5 min read

May 2024

  1. Week of 27 May 2024

    Snowflake’s stolen logins put the contractor’s laptop inside the bank’s perimeter

    The 2024 campaign against Snowflake customers broke no platform. It used passwords stolen from infected machines, often contractors’, and walked out with bulk data. Each stage, from theft to login to extraction, was a control point the customer owned.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

August 2024

  1. Week of 5 August 2024

    How the August 2024 selloff found brokerages’ capacity limit before the first trade

    On August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat in the pre-trade path, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

  2. Week of 12 August 2024

    Post-quantum priority starts in the records retention schedule

    NIST’s first post-quantum standards said what to migrate to. For banks, health systems and agencies, the order of migration is set by how long data must stay secret, which makes the retention schedule the first planning document.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

October 2024

  1. Week of 21 October 2024

    Final and already in court: sorting open banking work by how much you would regret it

    The CFPB’s Section 1033 rule was sued the day it was issued. Banks could not wait out the litigation or comply blindly. The workable approach was to split the program into no-regret work, rule-specific work and work hinging on the contested terms.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

January 2025

  1. Week of 27 January 2025

    DeepSeek arrived in three forms in one week, and each needed a different control

    Within days, the same DeepSeek model reached organizations as a consumer app, a developer API and open weights on U.S. clouds. Blanket bans treated them as one risk. They were three: shadow use, data jurisdiction and model behavior, each owned by a different team.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

April 2025

  1. Week of 14 April 2025

    How the CVE contract scare exposed the public plumbing under every patching policy

    For a day in April 2025, the program that names software flaws looked set to stop. It revealed that patching policies and audit evidence rest on three public layers, identification, enrichment and prioritization, each with its own failure mode.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

May 2025

  1. Week of 5 May 2025

    Why the air traffic control rebuild started with the wires

    The Newark outages that preceded Washington’s May 2025 air traffic control plan failed in the links between facilities. For agencies modernizing systems that cannot stop, the transport layer, the cutover and the workforce deserve as much planning as the applications.

    • Government
    • Platforms & Architecture
    • 5 min read

June 2025

  1. Week of 9 June 2025

    Google Cloud’s June outage moved bank cloud diligence from uptime to change safety

    Google Cloud’s June 2025 outage started with a routine policy update that reached every region at once. Banks learn more from asking how a provider releases code and configuration than from its uptime commitment.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

July 2025

  1. Week of 21 July 2025

    ToolShell made patching the easy part of a SharePoint emergency

    Attackers exploiting the July 2025 SharePoint zero-day stole the keys that let them return after the patch. For agencies running collaboration servers on premises, the response split into three jobs with different owners: patch, evict, and decide whether the server should exist.

    • Government
    • Platforms & Architecture
    • 5 min read

August 2025

  1. Week of 25 August 2025

    OAuth integrations make their vendors custodians of your credentials

    The Salesloft Drift data theft started in a vendor’s environment, not in any customer’s Salesforce org. Approving an integration hands a vendor a standing credential, and most third-party reviews never asked how that credential was kept.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

September 2025

  1. Week of 8 September 2025

    Why bank change control never saw the npm hijack

    Malicious versions of widely used JavaScript packages were live for about two hours in September 2025. Bank change control approves code people write; this attack arrived in code the build pipeline fetched on its own, which nobody approves.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

October 2025

  1. Week of 13 October 2025

    Why Windows 10’s end of support split every hospital fleet in three

    Hospital endpoints fell into machines IT controls, machines device makers control and machines nobody clearly controls. Reporting them as one migration hid where the residual risk sat, and only the first group had a simple answer.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

  2. Week of 20 October 2025

    One region failed, many financial apps stalled: concentration risk sat in the dependencies

    The October 2025 us-east-1 outage hit financial apps whose own designs looked resilient. The exposure lay in shared services and recovery backlogs, so the response is dependency mapping and tested degraded modes, not reflexive multi-cloud.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

December 2025

  1. Week of 15 December 2025

    Crypto trust charters and community banks: the binding decision sits in the core

    The OCC’s conditional charters made federally supervised digital-asset custodians a realistic option for smaller banks and credit unions. The harder decision was how any of it would reconcile to the general ledger, statements and reports their core platforms produce.

    • Financial Services
    • Platforms & Architecture
    • 5 min read

March 2026

  1. Week of 16 March 2026

    States could build Medicaid work requirements from the statute before the rule arrived

    In spring 2026, states had nine months to implement Medicaid community engagement and no federal rule yet. The safe path was to build what the statute fixed, configure what the rule would decide, and contract for delivery capacity before it ran out.

    • Government
    • Platforms & Architecture
    • 5 min read

April 2026

  1. Week of 13 April 2026

    Direct File’s quiet exit made retirement part of service design

    The first filing deadline without IRS Direct File showed that ending a public digital service carries obligations of its own: to returning users, to the states that integrated with it, and to the public record.

    • Government
    • Platforms & Architecture
    • 5 min read

May 2026

  1. Week of 11 May 2026

    Payer prior authorization APIs will only help the providers ready to call them

    CMS requires payers to offer prior authorization APIs by January 2027. The benefit lands with health systems that have settled three things first: which system makes the call, whether the chart can answer, and who owns the request.

    • Healthcare
    • Platforms & Architecture
    • 5 min read

June 2026

  1. Week of 15 June 2026

    The client-certificate deadline that moved, and the certificate authorities that didn’t wait

    Chrome pushed its cutoff for client authentication in public TLS certificates to March 2027, but certificate authorities kept their own earlier schedules. For any mutual TLS link, the deadline that counts is the one set by whoever issues the certificate.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read

August 2026

  1. Week of 10 August 2026

    Post-quantum signatures are still being chosen, so build PKI to switch twice

    Signatures had moved up the post-quantum queue, but two years after NIST’s first standards the choice of signature scheme was still open. Organizations should sort signatures by how long they must stay verifiable, and design each tier for a second change.

    • Cross-sector
    • Platforms & Architecture
    • 5 min read