4 ms·
Failure to apply a patch for a two month old bug led to this entire nightmare scenario. What are some best practices to ensure that ones dependencies are alway
by simpfai 9y ago
Failure to apply a patch for a two month old bug led to this entire nightmare scenario. What are some best practices to ensure that ones dependencies are always up to date?
-asking as a relatively inexperienced dev
- pishpash 9y agoHave a process to know what all your shit is and be paranoid about using any shit. Being paranoid helps.
- seandougall 9y agoAlthough I'm sure Equifax is not going to be very forthcoming about this aspect of it, not having plaintext passwords visible after logging in as admin/admin also helps.
- godzillabrennus 9y agoApplying patches when they come out...
- deleted 9y ago[deleted]
- la6470 9y agoThey should provide free credit monitoring for LIFE for affected individuals and not just one year...the individuals have been affected for life because now their SSN numbers are going to be out in the wild FOR EVER!!!
- tommynicholas 9y agoEquifax makes their partners have a fully implemented and tested patch management program and audits annually (or via a third party) that you stick to it, making this situation even more hilarious.
- ccrush 9y agoDon't hire someone who majored in Music Composition as your Chief Security Officer is key.
- sasas 9y agoI knew a music major who is a Linux kernel dev hacker. I know someone who has a law degree who worked on the file system your probabily using now. Don't be so quick to judge.
- dingo_bat 9y agoNobody's saying music majors are incompetent. But this woman's sole qualification is that. She is not a "kernel dev hacker" AFAICT. Do you know if she is in any way qualified to be CSO of a huge corp handling so much sensitive customer data?
- jsemrau 9y agoBased on her work experience she seemed qualified.
- DonHopkins 9y agoYou mean her "Head of Security when Equifax was Hacked" work experience?
- AlexCoventry 9y agoI heard she was in a similar role at First Data, prior to the Equifax gig.
- kanwisher 9y agoShe held another position as director of security, but no hands on technical roles ever. It really looks like the resume of a middle manager who moved to CSuite. I didn't see anything that indicated she was technical
- adrianmonk 9y ago
- sasas 9y agoKeep an up to date asset register before anything else. If you don't know what's in your platform then your running blind.
- larzang 9y agoIf you're lazy and dealing with a non-critical system, `yum update --security -y` as a nightly cron job goes a long way. If you're working on something important, say critical national economic infrastructure, you do the equivalent with automated staging and testing happening before any potentially breaking changes are made to live servers. Or... you do nothing, as the case may be...
- krallja 9y agoYum isn't going to patch Struts, though. That's an application package. There are services that monitor your package configuration(s) and let you know when something has been updated. There are also mailing lists. Unless you're a Node developer, you probably only have a couple dozen dependencies in your app. Subscribe to them. Finally, you can just check in your lockfile and update packages as part of your dev builds, then commit it whenever something changes. Your CI/CD will make sure you are always running the latest version of every application dependency in production.
- eatboogers 9y agoFailure to patch wasn't the cause of this breach. The causes of this breach were: 1. Reliance on a consumer-grade component in a security-critical system holding high-value data. The portal should have had a small, audited code base with secure coding techniques and minimal reliance on third-party components. 2. Excessive attack surface on a system holding high-value data. The machine hosting the portal should never have had read access to SSNs. Sensitive data should have been "thrown over the wall" to a secure backend with a constrained interface. This would have greatly reduced the scope of the breach.