Insights · Looking Back
Security & Resilience
The Looking Back articles seen through security & resilience, across every sector, in order.
61 articles
January 2020
February 2020
April 2020
May 2020
June 2020
July 2020
September 2020
December 2020
January 2021
Week of 4 January 2021
Credit for security practice, payable only in arrears
A short HITECH amendment signed on January 5, 2021 told HHS to weigh recognized security practices when penalizing breaches. The credit requires a year of practice already in place, so it can only be earned before an incident, with evidence produced by daily operations.
Week of 11 January 2021
Before the 36-hour clock: deciding which bank incidents count
The banking agencies’ proposed notification rule looked like a deadline. The harder work sat upstream of it: a named judgment about what counts as material disruption, and vendor notices that reach the people making that judgment in time.
February 2021
March 2021
Week of 1 March 2021
ProxyLogon: the patch was the easy part
The March 2021 Exchange Server zero-days looked like a patching race. For public agencies, the damage was decided by three gaps a patch could not close: knowing what faced the internet, hunting for intruders afterward, and owning the decision to retire the platform.
Week of 15 March 2021
Why business email compromise belongs to the payments team
The FBI’s 2020 crime report again put business email compromise at the top of its loss table. For banks and credit unions, the controls that decide those losses sit at three points in payment operations, and the inbox is only the first.
April 2021
May 2021
July 2021
October 2021
January 2022
March 2022
April 2022
Week of 4 April 2022
Cyclops Blink turned forgotten firewalls into someone else’s infrastructure
The April 2022 court-authorized takedown of the Cyclops Blink botnet showed small firewalls serving Russian military intelligence as relays, often without their owners noticing. For public agencies, an unmanaged edge device is a liability to others before it is a breach of their own.
Week of 18 April 2022
TraderTraitor aimed fake job offers at the engineers who hold the keys
An April 2022 federal advisory described North Korean operators courting crypto-firm engineers with fake recruiting and trojanized apps. For any financial firm, a job approach reaches the people with the most access through a channel security rarely watches, so controls must assume one will succeed.
July 2022
August 2022
September 2022
October 2022
November 2022
January 2023
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s disruption of Hive spared many victims, hospitals among them, from paying. It removed one ransomware brand. The affiliates, techniques and hospital weaknesses that made the attacks work were untouched, and those needed different responses.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
The ransomware attack on ION’s cleared derivatives software showed that sector-wide disruption often starts at specialized post-trade vendors that many firms share and few rank as critical. Finding them, grading them and rehearsing life without them are three separate jobs.
February 2023
May 2023
June 2023
September 2023
Week of 4 September 2023
Storm-0558’s key escaped through a crash dump, a path every agency development team also has
Microsoft’s September 2023 post-mortem described a signing key that left production in diagnostic data, tokens accepted beyond their scope, and a key that lived for years. Agencies that build their own applications carry all three risks in their own code and contracts.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks used help desk calls to reach identity administrators. For banks, the priority was a small set of control-plane accounts: how they are recovered, who is allowed to recover them, and how a takeover of the identity platform would be spotted.
October 2023
November 2023
December 2023
January 2024
February 2024
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
The deepfaked video call that moved about US$25 million beat a meeting, not a payment system. Most firms let staff treat a face on screen as identity. Banks need controls at the invitation, inside the meeting, and at the handoff to money.
Week of 19 February 2024
How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
When ransomware hit the largest US claims clearinghouse, every connected provider faced the same call. Cutting the connection was quick. Knowing what to cut, and what proof to demand before reconnecting, depended on preparation few had done.
March 2024
April 2024
July 2024
October 2024
December 2024
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS’s proposed overhaul turned flexible safeguards into specific requirements. Sorted by difficulty, most were controls hospitals already had or evidence they could build. Recovery within 72 hours was different: it needed clinical sequencing, tested capacity and money few systems had budgeted.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers reached Treasury workstations with a stolen key that secured a vendor’s cloud remote support service. Remote support is privileged access by another name, and governing it takes four controls along the path from vendor to endpoint, most of which agencies only partly had.
February 2025
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Setting the politics aside, the fight over new access to Treasury’s payment systems played out in sworn filings about who had which permissions. It showed that privileged access governance rests on four separate controls, and that each must be provable, not just stated.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record defeated multi-signature approval without breaking it, by altering the interface the signers trusted. Banks approving payments through software face the same risk at four points: how the interface is built, what approvers see, how payments are verified, and recovery.
March 2025
April 2025
June 2025
Week of 16 June 2025
Why Scattered Spider’s turn to insurers should have set a deadline for the rest of finance
When a group that works one industry at a time reached U.S. insurers in June 2025, threat intelligence turned into a date. Institutions needed a pre-agreed surge mode: a named trigger, tighter help-desk rules for weeks, and containment planned around compromised identity.
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each has a different owner, timescale and fix.
September 2025
October 2025
March 2026
Week of 2 March 2026
Iran’s war tested banks’ decision rights more than their defenses
The cyber warnings after the strikes on Iran named old techniques banks knew how to stop. The harder test was deciding, amid market stress and thin federal support, what to fix first, who could break a change freeze, and what to demand of providers.
Week of 9 March 2026
Stryker’s wipe made a supplier’s admin console a hospital supply risk
The attack on Stryker reportedly used the company’s own device-management tools to erase systems, with no ransom and no patient data at stake. It reached hospitals through orders and shipments, which most vendor risk reviews never examine.
April 2026
Week of 6 April 2026
When AI made flaws cheap to find, banks’ patch queues set the pace
Few banks had access to the model officials warned them about. For most, faster AI-driven discovery would arrive as a surge of fixes from vendors and open-source maintainers, so the constraint was how fast they could absorb patches.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
Spring 2026 research cut estimates of what it would take to break elliptic-curve cryptography. For agencies, that mattered less for encryption than for authentication, where certificates, smart cards and firmware keys take longest to replace.