6 ms·

Two top Equifax execs to retire after security breach

68 points by bifrost 9y ago

ransom1538 9y ago
"Why did you leave your last job?"
- kitotik 9y ago
  “I felt I had contributed all I could and felt undervalued so I’m seeking a new opportunity”
rdtsc 9y ago
Ah deploy those golden parachutes and sail off to the Bahamas while giving 140M American a big fat middle finger. I can see the justification for those large compensation packages for CxO only when something like this happens they would bear the corresponding responsibility - maybe even forced to sell a few yachts or a few summer homes here and there maybe to offset the investigation costs even.
justinzollars 9y ago
This isn't enough.
quuquuquu 9y ago
If you retire, how do the dynamics of a criminal prosecution change? What is the chance that these executives flee to a non-extradition country such as Russia or China for a bit, "just in case"? Some people flee to the EU because they can make a plea against extradition based on the appalling human rights abuses in the US prisons. I hope Lauri Love wins on that front.
- twinkletwinkle 9y ago
  The EU is way more serious than the US is about consumer privacy though. Might not help them in this case.
patcheudor 9y ago
They need to take a look at their software development area as well. https://www.fastcompany.com/40468811/heres-why-equifax-yanked-its-apps-from-apple-and-google-last-week https://www.fastcompany.com/40468811/heres-why-equifax-yanke...
- JonMR 9y ago
  Do they not get their apps security scanned? In my experience checking all requests go over HTTPS is the first thing that the security teams check. You'd think since Equifax works with banks they'd force them to adhere to some kind of security testing.
  - patcheudor 9y ago
    Exactly! This is so bad. Way worse IMHO than a failed patch or default admin/admin password in terms of showing a lack of competence. Those are ops issues. This showed core issues in their ability to architect and develop secure code. This wasn't a missed patch or config file, it was flat out not knowing how to write an even remotely secure (on the wire) application.
miguelrochefort 9y ago
TIL their Chief Security Officer is a music major...
- InclinedPlane 9y ago
  https://twitter.com/patio11/status/908814104927789056 https://twitter.com/patio11/status/908814104927789056
- jlgaddis 9y ago
  You'll be shocked to discover that some IT folks never graduated or even went to college. Hell, some didn't even graduate high school.
- deorcness 9y ago
  Literally not related to their competency or experience in the field
- notruthallowed 9y ago
  Are you a bigot or something? Don't you understand the requirement to hire based on diversity?
- rb2k_ 9y ago
  Some of the best engineers that I worked with have been Linguists, Music/Composition majors or Physicists.
  - rasz 9y ago
    name three
- nilved 9y ago
  Wait until you find out that some of the best security folks didn't major in anything!
  - rdtsc 9y ago
    Going out on a limb but given the massive security breach, it seems we are not dealing with the best security folks here. Just to expand, there is nothing wrong with having a music degree, there are qualified, experienced people who don't hold the degree in their current field. Except in this case we start from the end, given the situation, we are assuming we are not dealing with qualified, experienced people but amateurs. So then we are looking and combing through their credential, proof of competence etc., and so far it doesn't look good.
kernelman 9y ago
I wonder how much they get in their retirement package ?
wkimmel 9y ago
"Retire?" Do they mean like retire to a federal prison?
- leeoniya 9y ago
  no, that's where the poor and disadvantaged retire to. and the occasional disgraced public servant.
tamersalama 9y ago
Retire is the new fire
frandroid 9y ago
NOT SO FAST!!1
sillysaurus3 9y ago
I think it's important to take a step back, take a breath, and look at this rationally. Look at what actually happened. Equifax was using the Struts framework. This is a very safe, popular choice. They were using what everybody else uses. There was a critical vuln in the framework, and they failed to update their box for N months. But we're talking only a few months. N is very small -- maybe four? And yeah, you can argue that four months is an absurdly long time to have a known critical vuln in production. But I guarantee you that most people reading this work at companies that are similarly vulnerable. Attacks are simply rare. Whatever company you work for, if you do not have regular pentests, you are no better off. And even if you do, it's overwhelmingly likely that you've overlooked some lonely outdated server that's still running on your network because Bob set it up a year ago and forgot about it and oh look now you have a pivot into your whole network. It seems very strange to choose this one company and crucify them just because they lost your data. Everybody is insecure everywhere always, and we've learned to tolerate this by pretending it's not true or that it doesn't exist or that it's not a big deal. But you know what? It is true. That truth will continue to manifest itself in the years to come. No matter how much you'd like it not to be true, your stuff will still get stolen. Usually you just don't hear about it. Yes, it was stupid for them to have everybody's PII attached to that one webserver. A single point of failure should never result in compromising the whole system. But think about how that architecture would work in practice. A customer service rep still needs to get at most of your data. It's a credit bureau. Where would the data be stored in a way that a remote code exec wouldn't be able to snag it? Equifax's crime boils down to "they failed to run the equivalent of sudo apt-get upgrade on their framework." When you're managing a fleet of hundreds or thousands of machines, this is a situation that almost all of us have wound up in. If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block? Think about it this way: the time between "someone discovered a vuln in Spring" and "the attackers stole 150M credit reports" was just a few months. Are you sure Equifax wasn't a victim here? Someone threw a cinderblock through their window and made off with their trove of data. Except of course, it wasn't a cinderblock through a window. It was completely silent. Even if your firewall is great, you can still smuggle data out of a network using DNS alone. Food for thought.
- kibwen 9y ago
ohazi 9y ago
paywall: http://www.facebook.com/l.php?u=https://www.wsj.com/articles/two-top-equifax-executives-to-retire-1505510863 http://www.facebook.com/l.php?u=https://www.wsj.com/articles...
Cozumel 9y ago
"You are no longer David Webb." "From now on, you will be known as; Mark Rohrwasser." "Welcome to Equihax."
Overtonwindow 9y ago
Perhaps with enough heat they'll start clawing back some of that money.
desireco42 9y ago
Only in jail as far as I am concerned, why would be the only one to suffer.
yebyen 9y ago
I was pretty sure it was true that the CISO had no experience at all after listening to the first two or three minutes of the video interviews that were available here[1], but apparently they don't want anyone to see interviews with the CISO from before the breach (as they have been scrubbed from the internet.) I have never seen anybody say cloud so many times in two minutes. By the end of the interview, I felt sorry for her. I have no idea if she had relevant experience or not, she just sounded like someone who has been conditioned to argue that delays in new development are unacceptable, and that the cloud is inevitable, and if it costs more to do it right then you'll have to make do with less, and cetera and so forth. I'm not terribly shocked that they've taken down these interviews, but I am very sorry I didn't save a copy when I found them. The interviews were still available for viewing as of 12:31pm Eastern Time on Sept 10, and there are transcripts that you can find following the links in the article, which has been updated to note the videos were scrubbed from the internet. [1]: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... "The full interview videos went far in explaining what may have been the eventual cause of the massive leak of information now gravely affecting 143 million Americans." Serious question, is there any way this might actually count as destroying evidence? It says the interviews were removed by user, but I saw them and they were briefly still playable after they were first reported on. Someone must have been keen enough to snag a copy. They were eye opening. The transcript does not include the quote that really brought it home for me, "resistance to the cloud is futile" – I wonder what else it does not include... https://archive.is/Je7Yi https://archive.is/Je7Yi https://archive.is/6M8mg https://archive.is/6M8mg
mgleason_3 9y ago
I think we're looking at this all wrong. It doesn't matter what the technical details are. If you're controlling something dangerous it's your responsibility to ensure it doesn't do damage or hurt anyone. Take a car for example. If you're driving and you allow the car to hit someone and they die, you are charged with manslaughter. It's your responsibility to operate it safely. It doesn't matter if the conditions were difficult. In fact it's worse - you shouldn't have operated the car. It's the same concept here. They were operating something dangerous and did not take the necessary steps to ensure our safety. They should go to jail.
- paulddraper 9y ago
  Agreed. Though I think it's debatable whether leaking SSNs is comparable to manslaughter.
  - djKianoosh 9y ago
    It might be worse. But I dont know how anyone can weigh destruction of one life vs ruining thousands of people's lives (or at the very least increasing the general angst among society at large).
  - zipwitch 9y ago
    They leaked far more than SSNs. This also raises a real question about scale and distributed harm. If killing someone is wrong, what is stealing one ten-thousandth of a lifespan (through stress and monetary loss) from a hundred million people?
dv_dt 9y ago
If the credit history data of many people have been copied from Equifax, then the effectiveness and value of credit identity verification measures using the exact same data from the other two agencies and any company relying on those services severely drops. One wonders how that aspect of the industry will change going forward...

68 points by bifrost 9y ago

ransom1538 9y ago

"Why did you leave your last job?"

kitotik 9y ago
“I felt I had contributed all I could and felt undervalued so I’m seeking a new opportunity”

rdtsc 9y ago

Ah deploy those golden parachutes and sail off to the Bahamas while giving 140M American a big fat middle finger. I can see the justification for those large compensation packages for CxO only when something like this happens they would bear the corresponding responsibility - maybe even forced to sell a few yachts or a few summer homes here and there maybe to offset the investigation costs even.

justinzollars 9y ago

This isn't enough.

quuquuquu 9y ago

If you retire, how do the dynamics of a criminal prosecution change? What is the chance that these executives flee to a non-extradition country such as Russia or China for a bit, "just in case"? Some people flee to the EU because they can make a plea against extradition based on the appalling human rights abuses in the US prisons. I hope Lauri Love wins on that front.

twinkletwinkle 9y ago
The EU is way more serious than the US is about consumer privacy though. Might not help them in this case.

patcheudor 9y ago

They need to take a look at their software development area as well. https://www.fastcompany.com/40468811/heres-why-equifax-yanked-its-apps-from-apple-and-google-last-week https://www.fastcompany.com/40468811/heres-why-equifax-yanke...

JonMR 9y ago
Do they not get their apps security scanned? In my experience checking all requests go over HTTPS is the first thing that the security teams check. You'd think since Equifax works with banks they'd force them to adhere to some kind of security testing.
- patcheudor 9y ago
  Exactly! This is so bad. Way worse IMHO than a failed patch or default admin/admin password in terms of showing a lack of competence. Those are ops issues. This showed core issues in their ability to architect and develop secure code. This wasn't a missed patch or config file, it was flat out not knowing how to write an even remotely secure (on the wire) application.

miguelrochefort 9y ago

TIL their Chief Security Officer is a music major...

InclinedPlane 9y ago
https://twitter.com/patio11/status/908814104927789056 https://twitter.com/patio11/status/908814104927789056
jlgaddis 9y ago
You'll be shocked to discover that some IT folks never graduated or even went to college. Hell, some didn't even graduate high school.
deorcness 9y ago
Literally not related to their competency or experience in the field
notruthallowed 9y ago
Are you a bigot or something? Don't you understand the requirement to hire based on diversity?
rb2k_ 9y ago
Some of the best engineers that I worked with have been Linguists, Music/Composition majors or Physicists.
- rasz 9y ago
  name three
nilved 9y ago
Wait until you find out that some of the best security folks didn't major in anything!
- rdtsc 9y ago
  Going out on a limb but given the massive security breach, it seems we are not dealing with the best security folks here. Just to expand, there is nothing wrong with having a music degree, there are qualified, experienced people who don't hold the degree in their current field. Except in this case we start from the end, given the situation, we are assuming we are not dealing with qualified, experienced people but amateurs. So then we are looking and combing through their credential, proof of competence etc., and so far it doesn't look good.

kernelman 9y ago

I wonder how much they get in their retirement package ?

wkimmel 9y ago

"Retire?" Do they mean like retire to a federal prison?

leeoniya 9y ago
no, that's where the poor and disadvantaged retire to. and the occasional disgraced public servant.

tamersalama 9y ago

Retire is the new fire

frandroid 9y ago

NOT SO FAST!!1

sillysaurus3 9y ago

I think it's important to take a step back, take a breath, and look at this rationally. Look at what actually happened. Equifax was using the Struts framework. This is a very safe, popular choice. They were using what everybody else uses. There was a critical vuln in the framework, and they failed to update their box for N months. But we're talking only a few months. N is very small -- maybe four? And yeah, you can argue that four months is an absurdly long time to have a known critical vuln in production. But I guarantee you that most people reading this work at companies that are similarly vulnerable. Attacks are simply rare. Whatever company you work for, if you do not have regular pentests, you are no better off. And even if you do, it's overwhelmingly likely that you've overlooked some lonely outdated server that's still running on your network because Bob set it up a year ago and forgot about it and oh look now you have a pivot into your whole network. It seems very strange to choose this one company and crucify them just because they lost your data. Everybody is insecure everywhere always, and we've learned to tolerate this by pretending it's not true or that it doesn't exist or that it's not a big deal. But you know what? It is true. That truth will continue to manifest itself in the years to come. No matter how much you'd like it not to be true, your stuff will still get stolen. Usually you just don't hear about it. Yes, it was stupid for them to have everybody's PII attached to that one webserver. A single point of failure should never result in compromising the whole system. But think about how that architecture would work in practice. A customer service rep still needs to get at most of your data. It's a credit bureau. Where would the data be stored in a way that a remote code exec wouldn't be able to snag it? Equifax's crime boils down to "they failed to run the equivalent of sudo apt-get upgrade on their framework." When you're managing a fleet of hundreds or thousands of machines, this is a situation that almost all of us have wound up in. If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block? Think about it this way: the time between "someone discovered a vuln in Spring" and "the attackers stole 150M credit reports" was just a few months. Are you sure Equifax wasn't a victim here? Someone threw a cinderblock through their window and made off with their trove of data. Except of course, it wasn't a cinderblock through a window. It was completely silent. Even if your firewall is great, you can still smuggle data out of a network using DNS alone. Food for thought.

kibwen 9y ago

ohazi 9y ago

paywall: http://www.facebook.com/l.php?u=https://www.wsj.com/articles/two-top-equifax-executives-to-retire-1505510863 http://www.facebook.com/l.php?u=https://www.wsj.com/articles...

Cozumel 9y ago

"You are no longer David Webb." "From now on, you will be known as; Mark Rohrwasser." "Welcome to Equihax."

Overtonwindow 9y ago

Perhaps with enough heat they'll start clawing back some of that money.

desireco42 9y ago

Only in jail as far as I am concerned, why would be the only one to suffer.

yebyen 9y ago

I was pretty sure it was true that the CISO had no experience at all after listening to the first two or three minutes of the video interviews that were available here[1], but apparently they don't want anyone to see interviews with the CISO from before the breach (as they have been scrubbed from the internet.) I have never seen anybody say cloud so many times in two minutes. By the end of the interview, I felt sorry for her. I have no idea if she had relevant experience or not, she just sounded like someone who has been conditioned to argue that delays in new development are unacceptable, and that the cloud is inevitable, and if it costs more to do it right then you'll have to make do with less, and cetera and so forth. I'm not terribly shocked that they've taken down these interviews, but I am very sorry I didn't save a copy when I found them. The interviews were still available for viewing as of 12:31pm Eastern Time on Sept 10, and there are transcripts that you can find following the links in the article, which has been updated to note the videos were scrubbed from the internet. [1]: https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... "The full interview videos went far in explaining what may have been the eventual cause of the massive leak of information now gravely affecting 143 million Americans." Serious question, is there any way this might actually count as destroying evidence? It says the interviews were removed by user, but I saw them and they were briefly still playable after they were first reported on. Someone must have been keen enough to snag a copy. They were eye opening. The transcript does not include the quote that really brought it home for me, "resistance to the cloud is futile" – I wonder what else it does not include... https://archive.is/Je7Yi https://archive.is/Je7Yi https://archive.is/6M8mg https://archive.is/6M8mg

mgleason_3 9y ago

I think we're looking at this all wrong. It doesn't matter what the technical details are. If you're controlling something dangerous it's your responsibility to ensure it doesn't do damage or hurt anyone. Take a car for example. If you're driving and you allow the car to hit someone and they die, you are charged with manslaughter. It's your responsibility to operate it safely. It doesn't matter if the conditions were difficult. In fact it's worse - you shouldn't have operated the car. It's the same concept here. They were operating something dangerous and did not take the necessary steps to ensure our safety. They should go to jail.

paulddraper 9y ago
Agreed. Though I think it's debatable whether leaking SSNs is comparable to manslaughter.
- djKianoosh 9y ago
  It might be worse. But I dont know how anyone can weigh destruction of one life vs ruining thousands of people's lives (or at the very least increasing the general angst among society at large).
- zipwitch 9y ago
  They leaked far more than SSNs. This also raises a real question about scale and distributed harm. If killing someone is wrong, what is stealing one ten-thousandth of a lifespan (through stress and monetary loss) from a hundred million people?

dv_dt 9y ago

If the credit history data of many people have been copied from Equifax, then the effectiveness and value of credit identity verification measures using the exact same data from the other two agencies and any company relying on those services severely drops. One wonders how that aspect of the industry will change going forward...