4 ms·
Yep. You can do all that. At the end of it, a box somewhere needs to be able to access the data. That box has access. You handwave it as single-person-at-a-time
by sillysaurus3 9y ago
Yep. You can do all that. At the end of it, a box somewhere needs to be able to access the data. That box has access. You handwave it as single-person-at-a-time queries. But on any given day, they have to run tens or hundreds of thousands of those queries. Even if people aren't accessing their credit info, there is plenty of automation that does. Meaning if you pop that single person query box, you can scale up the queries by a factor of ten without raising any flags directly.
It's much better, certainly. Companies should do that. But it's not obviously a panacea.
- lowbloodsugar 9y agoConceivably, the attackers spent the 75 days downloading the 143,000,000 records, 2,000,000 records per day, and managed to trigger no scaling alarms as a result. Or perhaps there were no alarms. I wonder if we'll ever know.
- sova 9y ago75 days? The report by Equifacks makes it sound like a one day delay from attack to taking the machine offline. Sneaky language.
- closeparen 9y agoTFA says Equifax learned of the breach by detecting anomalous traffic. I'd say there was an alarm, but it didn't do anything to actually stop the attack.
- AlexCoventry 9y agoGiven the vagueness of their statements about the 143M records which "may" have been affected, it seems likely that they weren't logging the relevant queries in any useful way, and that is definitely an architectural failure.
- mdpopescu 9y agoI worked for a company that was doing at least 100k credit checks each day. A lot of it was batched - we would get a file with 25k records and had to process it and send back the results (usually HTML reports and/or decisions based on them). What I want to say is, it wouldn't surprise me to hear that the three main bureaus process millions of requests per day. Oh, and also - all bureaus were replying to a request in less than a second. Quite impressive.
- sillysaurus3 9y agoThank you for backing up my claim with data. I was admittedly making an educated guess, but there was a nagging "hundreds of thousands? Are you sure?" feeling. This underscores the importance of figuring out a better architecture. And not just for credit bureaus. It is remarkable how resistant people are to the idea that you need to be patient while the world changes. Everyone is out for blood and gives not a fleeting thought about what would come after such a purge.