98 articles
January 2020
Week of 13 January 2020
Why a Windows crypto patch was an asset inventory test
CISA gave agencies ten business days to patch a Windows cryptographic flaw, on the day Windows 7 support ended. Applying the fix was the easy step. Knowing which systems needed it, who owned them and how to prove it was the hard one.
Week of 27 January 2020
A 90-day declaration that ran for three years
The federal public health emergency declared on January 31, 2020, looked like a precaution. Other authorities, new laws and agency systems came to depend on it, so agencies needed to track what rested on it from the start, not when it ended.
February 2020
March 2020
April 2020
May 2020
June 2020
Week of 8 June 2020
When vendors set facial recognition policy before agencies did
IBM, Amazon and Microsoft stepped back from selling facial recognition to police within days in June 2020. Agencies discovered that suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center documents through the compromise of one web development firm. Each agency had judged a small contract; nobody had judged the shared platform, its accumulated archive or its sprawling user base.
August 2020
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
SP 800-207 is remembered for its architecture diagrams. Its lasting effect was a list of prerequisites, about assets, identities, data and telemetry, that most agencies could not yet meet and no product could supply.
Week of 17 August 2020
Why the Postal Service slowdown belonged on agency risk registers
The August 2020 mail controversy was covered as an election story. For agencies that send notices, payments and medications, it exposed a channel dependency with statutory deadlines attached and no owner inside the agency.
November 2020
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. The hardest constraint for public agencies was data: matching people without a national identifier, agreeing who could see records, and onboarding hundreds of new sources in weeks.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition compressed a process that moves people and their access, records and accounts, and programs already in flight. Each needs its own runbook, prepared by career staff long before any election.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for manufacturers. It set rules for one very large customer. That shifted vulnerability-handling duties onto contractors and exposed an older problem: agencies cannot apply device rules to devices they have not inventoried.
December 2020
January 2021
February 2021
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached agencies through an aging file transfer appliance few leaders could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern returned through other products for years.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that can tell the two apart, safeguards that work whoever acts, and public statements that survive revision.
March 2021
Week of 1 March 2021
ProxyLogon: the patch was the easy part
The March 2021 Exchange Server zero-days looked like a patching race. For public agencies, the damage was decided by three gaps a patch could not close: knowing what faced the internet, hunting for intruders afterward, and owning the decision to retire the platform.
Week of 8 March 2021
One-time money, recurring bills: the Rescue Plan’s technology hangover
The American Rescue Plan gave state and local governments $350 billion of flexible, temporary money. Where it paid for subscriptions, the risk sat in three places: the shape of the funds, the shape of the costs, and contracts signed in a hurry.
April 2021
May 2021
Week of 10 May 2021
Executive Order 14028 gave zero trust three testable demands
Signed days after the Colonial Pipeline attack, the May 2021 cybersecurity order turned a marketing term into three demands any agency can test system by system: verified identity, retained evidence, and accountable software supply chains.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
TSA’s first pipeline security directive after Colonial Pipeline imposed a 12-hour reporting deadline, a named coordinator and a 30-day self-assessment. Each became a template that regulators copied across sectors, and each needed a different internal capability.
Week of 31 May 2021
After Van Buren, insider snooping is an access design problem
The Supreme Court’s June 2021 Van Buren decision took most purpose-based insider misuse out of the federal computer crime law. For agencies holding sensitive records, deterrence now rests on three controls they own: access design, query monitoring and consequences.
July 2021
August 2021
Week of 2 August 2021
The paper card that made Key to NYC’s digital pass work
New York City’s August 2021 vaccination requirement accepted digital passes and the paper CDC card alike. That fallback carried the program through weak records and untrained verifiers, and it is the design choice agencies issuing digital credentials should copy first.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
Companies at the August 2021 White House cyber summit pledged to train hundreds of thousands of people. For public agencies, the shortage had three parts: supply, access and retention. Pledges addressed the first, while agencies held the levers for the other two.
October 2021
November 2021
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
CISA’s Binding Operational Directive 22-01 replaced severity scores with a short, evidence-based list and a federal deadline. Its biggest effect was on how agency patch teams spent their week, argued with system owners, and exposed weak asset inventories.
Week of 15 November 2021
A cyber grant with a rising match is a sustainment test
The infrastructure law’s State and Local Cybersecurity Grant Program paired $1 billion with a cost share that grew every year. That design asked states and localities what they would keep paying for once the federal money stopped.
December 2021
January 2022
Week of 17 January 2022
No key to buy: WhisperGate and the agency recovery plan
WhisperGate looked like ransomware but destroyed data with no way back. For US public agencies, it exposed continuity plans that quietly counted on payment as a last resort, and recovery times nobody had measured from total loss.
Week of 24 January 2022
M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told agencies to adopt authentication that phishing cannot defeat. Strong authenticators shifted attacker attention to how credentials are issued, replaced and reset, a process run by help desks the memo barely mentioned.
Week of 31 January 2022
One door is not a service: the IRS selfie reversal
The IRS backed away from mandatory selfie verification in February 2022 because a single proofing route, however strong against fraud, locks out part of a universal population. Agencies needed several routes to the same assurance level, measured by who fails.
April 2022
May 2022
Week of 2 May 2022
Quantum risk is dated by how long your data must stay secret
NSM-10 set 2035 as a national goal, but for any given agency system the effective deadline is earlier: how long its data must stay confidential, plus how long migration will take, measured against when a capable machine might exist.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s pledge not to charge good-faith security research made outside reports more likely. For agencies, the work it created was operational: a front door for reports, a route to whoever can fix the flaw, and a way to close the loop.
June 2022
July 2022
August 2022
Week of 15 August 2022
Why the IRS’s ten-year budget needed a one-year payoff
The Inflation Reduction Act gave the IRS about 80 billion dollars over a decade, and opponents promised to cut it from the first day. Multiyear money that can be reversed has to be spent in an order where every tranche stands on its own.
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
The second-largest U.S. school district opened on schedule days after ransomware hit its systems. That was possible because classroom teaching depends on few systems. The hard parts were resetting access for an enormous population and telling families what to do.
September 2022
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s e-government services aimed at public embarrassment, not ransom. When disruption is the goal, agencies have to defend a minimum visible service, contest the attacker’s story, and know who decides on attribution.
Week of 12 September 2022
M-22-18 asked producers to sign; agencies first had to know who they were
OMB’s secure software memo made a producer’s signed attestation a condition of federal use. The form drew the attention. The work that lasted was the producer-level inventory behind it and the judgment needed to use what came back.
November 2022
December 2022
January 2023
March 2023
April 2023
Week of 3 April 2023
Eligible but unreachable: Medicaid unwinding ran on contact data
When continuous enrollment ended, states had about a year to redetermine eligibility for tens of millions of people. Outcomes turned less on eligibility rules than on whether agencies could renew people from data they held, reach the rest, and process their replies.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
The documents posted on Discord were taken by a junior IT specialist whose clearance and systems access were valid, but who had no need for the material. Agencies that hold any sensitive data need separate controls for administrative access, its monitoring and its supervision.
May 2023
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
The May 2023 disclosures described a state actor inside US infrastructure using built-in tools and hijacked routers, not malware. Agencies and utilities had to know normal administrator behavior, own their network edge, and plan to run without a trustworthy network.
Week of 29 May 2023
Flat caps, rising subscriptions: how the debt deal squeezed federal IT from the inside
The Fiscal Responsibility Act held nondefense spending roughly flat for two years. Federal IT budgets did not shrink evenly. Subscriptions and cloud bills grew on their own, modernization was deferred by default, and technical staff thinned through attrition. Each needed its own control.
June 2023
August 2023
September 2023
Week of 4 September 2023
Storm-0558’s key escaped through a crash dump, a path every agency development team also has
Microsoft’s September 2023 post-mortem described a signing key that left production in diagnostic data, tokens accepted beyond their scope, and a key that lived for years. Agencies that build their own applications carry all three risks in their own code and contracts.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still forced agencies to write lapse plans. Those plans were built around excepted staff, while agency technology also depended on how each contract was funded, what would expire mid-lapse and how systems would restart.
October 2023
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
The HTTP/2 flaw disclosed in October 2023 produced record denial-of-service attacks that large providers absorbed at their edge. Agency exposure depended on which group each public service fell into: rented edge, self-hosted, or unknown.
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance said rights- and safety-impacting AI must meet minimum practices by a deadline or be switched off. The hard cases were systems already in production, many of them inside vendor products.
December 2023
January 2024
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
FinCEN opened beneficial ownership filing on January 1, 2024 to tens of millions of small companies while the law faced constitutional challenge. A public obligation at that scale has four design problems, and the last, how it narrows, is rarely planned.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The false bitcoin ETF post from the SEC’s X account came one day before the actual approval, when markets were primed to believe it. Agencies whose announcements move markets or behavior should secure official accounts as privileged credentials, by the calendar, and for the audience.
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were documented. What decided who met the deadline was who could authorize cutting remote access, who could rebuild the devices, and where agencies sat in their contractors’ queues.
March 2024
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
The March 2024 White House and EPA letter invited each state’s environmental, health and homeland security secretaries. That list was the finding: water cybersecurity in a state sits with a regulator, a funder and a responder, and few governors had named anyone to join them.
Week of 25 March 2024
Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record
The final OMB memo kept the draft’s comply-or-stop deadline and added something sharper. Every way out of it, whether a determination, a waiver or an extension, now needed a named signer, documented evidence and a public or OMB-reviewed record.
April 2024
Week of 1 April 2024
Agencies buy a cloud provider’s security culture whether or not the contract mentions it
The Cyber Safety Review Board blamed the 2023 Exchange Online intrusion on Microsoft’s security culture. Agencies cannot audit a culture, but the report showed three places it leaves evidence a buyer can demand: secrets, disclosure and defaults.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
Palo Alto withdrew a mitigation within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery for themselves did not have to wait for the vendor’s next revision.
May 2024
June 2024
July 2024
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
Four Supreme Court decisions in five days ended deference on statutory meaning, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could prove it had contained the attack on its systems. It could not yet prove what the stolen data held or whom it exposed. Each claim needs its own evidence, and borrowing from the first to answer the second costs trust.
August 2024
September 2024
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
The Council of Europe convention covers AI used by public authorities and by private actors acting on their behalf. That means an agency’s duties follow the service into its contractors, and the boundary of “on their behalf” is where governance gaps will open.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Continuity plans for local agencies are written for the loss of a building or a system. Helene removed people, connectivity and decision authority across a whole region at once, and each of the three needs its own preparation with its own lead time.
October 2024
December 2024
Week of 9 December 2024
In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
When attackers breached the vendor-run RIBridges benefits system, the state carried public accountability while the vendor held the systems, logs and forensic work. Contracts for such systems must settle visibility, decision rights, costs and exit before an incident, not during one.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers reached Treasury workstations with a stolen key that secured a vendor’s cloud remote support service. Remote support is privileged access by another name, and governing it takes four controls along the path from vendor to endpoint, most of which agencies only partly had.
January 2025
February 2025
March 2025
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist in a senior officials’ chat made the headlines. For agencies at every level, the durable failure was a sanctioned channel that could not set content boundaries, verify participants and keep the record at the same time.
Week of 31 March 2025
Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos trimmed internal AI process but asked contracts to carry more of the load. Agencies that treated each stage of the contract as a governance control kept bargaining power that review boards alone could not provide.
May 2025
June 2025
July 2025
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s digital escorts showed that a cloud authorization says little about who actually operates a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting the July 2025 SharePoint zero-day stole the keys that let them return after the patch. For agencies running collaboration servers on premises, the response split into three jobs with different owners: patch, evict, and decide whether the server should exist.
August 2025
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 agreements made leading AI tools nearly free for agencies. The price did not grant the three permissions that decide real use: a security authorization, a ruling on what data may go in, and an owner for the records and oversight duties.
Week of 11 August 2025
Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when the 2025 CM/ECF breach widened. The trouble was the boundary. Agencies holding dangerous records inside general systems need a tier defined by consequence, not by label.
September 2025
November 2025
Week of 3 November 2025
For SNAP systems, paying less was harder than paying nothing
During the 2025 shutdown, court orders pushed states toward partial and then full November SNAP payments within days. Eligibility logic, EBT issuance and public communication were each built for benefits paid in full or not at all.
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
When CMMC requirements began appearing in Defense contracts on November 10, 2025, attention went to assessment levels. The senior official’s affirmation mattered more, because it turned security claims into dated representations with legal weight.
December 2025
February 2026
Week of 9 February 2026
What a second CISA lapse in five months asked state and local security teams to own
The DHS funding lapse that began on February 14 was the second interruption to CISA’s proactive services in five months. For state and local agencies, the question moved from listing federal dependencies to deciding which work to absorb, buy or keep borrowing.
Week of 23 February 2026
What a supply chain label on a U.S. AI vendor asked of agencies and contractors
When the administration moved to exclude Anthropic, agencies and contractors could not wait for the courts. The workable response scoped three things: which instrument applied, whom and which contracts it reached, and which uses of the model it covered.
March 2026
April 2026
Week of 13 April 2026
Direct File’s quiet exit made retirement part of service design
The first filing deadline without IRS Direct File showed that ending a public digital service carries obligations of its own: to returning users, to the states that integrated with it, and to the public record.
Week of 20 April 2026
DOJ’s accessibility delay moved one date and put the budget at risk
The one-year delay of the ADA Title II web rule left the standard, the underlying duty and residents’ experience where they were. Its sharpest effect was on budgets that had used April 2026 to justify the work.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
Spring 2026 research cut estimates of what it would take to break elliptic-curve cryptography. For agencies, that mattered less for encryption than for authentication, where certificates, smart cards and firmware keys take longest to replace.
June 2026
August 2026
September 2026
Week of 21 September 2026
Agency certificates now expire faster than agency budgets turn over
The first full-term 200-day TLS certificates expired on October 1, 2026, the first day of the federal fiscal year. Agencies that bought, staffed and scheduled certificates on an annual rhythm had to rebuild all three around renewals that no longer fit one.
Week of 28 September 2026
Paused, not repealed: what CMMC’s suspension left defense contractors paying for
With third-party CMMC certification suspended and no new schedule six weeks before the old November date, contractors faced a budgeting problem. Some security spending was still owed, some could wait, and some had simply changed price.