8 ms·
Equifax must be dismantled and driven into bankruptcy. You present a fallacy. No, a rational company with accountability for its data doesn't outsource their I
by ak217 9y ago
Equifax must be dismantled and driven into bankruptcy.
You present a fallacy. No, a rational company with accountability for its data doesn't outsource their IT security or let the intern access production. They take their job seriously and prevent something like this from happening by building security into their architecture.
I have worked for companies that recognize they are liable for protecting the data they hold, and that it only takes one breach for trust to be destroyed. We spent countless hours hardening, compartmentalizing, and monitoring our infrastructure. The nihilistic implication that nothing can be done is maddening.
- nevir 9y agoCompanies that take this sort of thing seriously ALSO have breaches occur. They just do a better job of mitigating them, and messaging them.
- emidln 9y agoBreaches occur. Negligent security, networking, and auditing missed or ignored network segmentation. I can forgive a small company dealing with my email when they lose it. Equifax is't a small company. They didn't just lose my email. They should be disbanded and their CTO, CIO, and CEO should be held personally responsible.
- bdamm 9y agoAnd Equifax's handling and messaging was truly abysmal. Security professionals are going to write songs about this and pass the knowledge on to their (older) children as scary camp fire stories.
- 086421357909764 9y agoCorrect, all companies face breaches, it's the management and response that should determine the course of action. This is where an independent investigation is crucial for determining basic failures vs systemic disregard. The harder part would be weighing it.
- vkou 9y agoThen perhaps the risk of allowing this kind of business - period - is too great.
- goialoq 9y agoThe alternative is higher interest rates, reduced unsecured credit, pay-in-advance for housing, and shutting "the masses" out of access to capital.
- blowski 9y agoI agree that seeing Equifax go bankrupt over this would be great. But do you honestly believe your data will be safe? All that time you spent hardening your architecture makes it safer, but not 100% safe. If it's hacked because of one mistake that one person made, would it be right to hold you criminally responsible?
- smaddox 9y agoThere should be no avenue for single points of failure to result in catastrophic data breach. Neither architecture nor procedures should allow a single person to compromise the system, willingly or accidentally.
- CaptSpify 9y agoIf you can't guarantee that the data can be kept safe, then you shouldn't rely your business on it.
- bogomipz 9y ago>"Equifax must be dismantled and driven into bankruptcy." I don't disagree with that sentiment but you have to deal with the whole triumvirate - Equifax, Experian and Transunion.
- Pixeleen 9y agoAs well as ChexSystems which contains just as must personal data about deposit accounts instead of credit accounts. Also Lexis which collects from a wide range of private sources and has exclusive special arrangements with public sources.
- bogomipz 9y agoI guess I am not as familiar with CheckSystems, is that pay roll data? Does Lexis Nexus collect financial data on individuals? I thought it's focus was research
- Pixeleen 9y agoChexSystems does not have salary information. They contain information on bank accounts that have been overdrawn, bad checks, and checkbook orders. They also contain information on accounts in good standing, and the usual information like aliases, addresses, SSNs, and driver license numbers. Lexis Nexis long since moved beyond newspaper and courthouse archiving. They have dozens of intelligence products and databases aimed at marketing, debt collection, private investigators, and law enforcement. They collect massive personal consumer (and business) data, including retail purchases and returns, and salaries, and associate it in a Facebook-style graph, loosely associated with SSN and DL#.
- bogomipz 9y agoInteresting about both, thanks. I suppose it's just a matter of time before both of these are compromised. In fact is surprising that they haven't. I wonder if this is just because they aren't as well known as the big 3?
- kabdib 9y agoI don't disagree, either, but whatever data Equifax has collected would be part of the bankruptcy sale. Equifax needs to wipe its data and all extant backups. Then it can be sold (for maybe ten dollars).
- g051051 9y agoWere the companies you worked for dealing with data at the scale of Equifax? Were they under the kind of unceasing attack that the Equifax systems are? Do you think you could have withstood that kind of assault on your systems? All the CRAs endure attacks at a scale that are difficult to comprehend. It's frankly a surprise that something like this hasn't happened before to any one of the big 3.
- bdamm 9y agoIt's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection. Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available if one happened to know the magic URL. This discovery was made through the process of a pen-test team sharing their findings back to development, who in turn extended their findings based on what developers knew about the system. Forensics done after the discovery revealed no cases of anyone actually finding the magic URL, which was a big relief for the company. So maybe the banks aren't as strong as we think, either. We have quite a few payment breaches to look back to as evidence.
- g051051 9y ago> It's only surprising because we now know how terribly fast and loose Equifax was operating. I certainly assumed they knew their job and were operating more akin to a bank in terms of data protection. Can you cite a source for how we "now know how terribly fast and loose Equifax was operating"? Equifax is a CRA and is treated as a financial institution under the applicable laws, like banks are. > Then again, I once did work for a bank, and witnessed an event where user PINs were discovered to be publicly available Then you should know better than to simply claim that a company that suffers a breach is somehow inherently incompetent or uncaring about security.
- grasshopperpurp 9y ago> Equifax was negligent to spill all that data, but a business model that requires all that data in one place is itself a form of negligence. - Matt Blaze http://thehill.com/opinion/technology/350197-equifax-breach-a-nightmare-that-should-serve-as-wake-up-call-for-feds http://thehill.com/opinion/technology/350197-equifax-breach-...
- jacquesm 9y ago> No, a rational company with accountability for its data doesn't outsource their IT security There are a lot of irrational companies in the world by that standard.
- pmarreck 9y ago> The nihilistic implication that nothing can be done is maddening. THIS. And in this case we have blatant evidence of negligence- There is absolutely zero excuse in this day and age to not keep operating systems patched up with security patches. There is no financial excuse, there is no logistical excuse, and given the sensitivity of the data, there is no ethical excuse. Take the responsibility seriously, or please just go off and die in a fire. (Or, if you're an Equifax executive, retire at the height of your incompetence.) Which is why I shamelessly say: Fuck Richard Smith, fuck Equifax, fuck Susan Mauldin, and fuck their entire IT management staff. What the fuck is wrong with you people? Disclaimer: I was recently hacked/had my identity stolen, and although I was fortunate to only have to wait 2 weeks to get back access to everything, I may be a little sore about stuff like this.