4 ms·

Former Equifax CEO says breach boiled down to one person not doing their job

41 points by orange_county 9y ago

ww520 9y ago
Blame the IT peon. Yeah, right. Every single time.
patmcc 9y ago
Absolutely true. That person is the former Equifax CEO.
whipoodle 9y ago
And who built the company that let that slide? Who came up with the practices that led to such a failure? Et cetera.
jepler 9y ago
Someone needs to read http://web.mit.edu/2.75/resources/random/How%20Complex%20Systems%20Fail.pdf http://web.mit.edu/2.75/resources/random/How%20Complex%20Sys... and also probably just stop talking
deleted 9y ago
[deleted]
dudul 9y ago
Apparently the data was stored in plain text. Sorry, but if not applying a patch to your Web framework is enough to make it that vulnerable, there are other problems in your infrastructure, your architecture and your process.
MBCook 9y ago
Good to know. And what about the person who’s job was to make sure that one guy did his job? And the guy who was in charge of that person? And the department who’s job was makin sure nothing was insecure? And the guy managing them? Yep. All one guys fault. Poor guy, ruining the American credit monitoring system for the rest of us.
justboxing 9y ago
This is how it always goes down. - F*ck your customers over by gross negligence and sheer greed (or stupidity, or both) - Get caught with your pants down - Dump your stocks and cash out - Apologize when customers and media express outrage - Go to Congressional hearing and repeat the magic words "I do not recall" for every question - Find 1 low-level scapegoat employee - Fire that employee and declare that the company is now 'clean' - Avoid any jail time for wrong doing by paying a fine - Collect your 'Golden Parachute' = MILLIONS and slide into a new CEO Job. - Rinse and repeat. White collar crime pays. Big time. And almost no-one ever goes to Jail -- unless they have the bad-fortune of being prosecuted by A.G. Preet Bharara (record of 79-0 conviction obtained), which is also not relevant since Trump fired him soon after taking the White House Office. Related: Here's Preet Bharara's Amazing 79-0 Insider Trading Conviction Score Card - http://www.businessinsider.com/bharara-insider-trading-convictions-2014-2 http://www.businessinsider.com/bharara-insider-trading-convi...
- BatFastard 9y ago
  You missed "Sell your stock"
- vermontdevil 9y ago
  - collect $90 million and skip the jail part.
  - justboxing 9y ago
    lol. Yes. I added your point.
- Deinos 9y ago
  And, if it is bad enough that a CEO has to be let go... they pop that fancy, golden parachute on the way down...
- eagerpace12 9y ago
  As of 2016 you can now add to the list "suspected state actors." How could any private company be responsible for being able to stop this?
openasocket 9y ago
There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.
- iaw 9y ago
  Bought a book mentioned in another thread about understanding system failures. If the conclusion blames an individual then 100% of the time the real problem is with the system that gave them that much power.
  - vendiddy 9y ago
    What's the book? Would like to add to my reading list :)
    - iaw 9y ago
      And here I thought I could avoid grabbing it from my shelf... "The Field Guide to Understanding 'Human Error'" by Sidney Dekker.
- TheSpiceIsLife 9y ago
  Has this mantra been stress-tested in the real world with a large scale data breach? Edit: to add to his, what I mean to say is: it's great that (some) companies have this culture internally. It remains to be seen whether the mantra would survive a sufficiently large scandal. Maybe that's when the legal team comes in with the damage control plan as outlined in another comment by @justboxing.
  - openasocket 9y ago
    I work for AWS. We haven't had a breach, but consider that S3 outage not too long ago, which was due to one engineer fat-fingering a command. Rather than blaming or disciplining that person, AWS changed the process so that people aren't manually typing in those commands.
s73ver_ 9y ago
Well, that person, that person's boss, and so on up to the CEO. The one who is paid such a large salary to ultimately be responsible for the entire company.
caconym_ 9y ago
Having just a single point of human failure standing in the way of leaking 145M people's data is already negligent. Trying to foist responsibility onto this poor individual (presumably some lower-rung employee) is shameful and just goes to show how ripe their corporate culture was for something like this to happen.
- zipwitch 9y ago
  Nice of him to publicly testify to their gross incompetence , though. (And under oath too?) Doubtless the various lawsuits will be coming back to this testimony for many years.
deleted 9y ago
[deleted]
aaroninsf 9y ago
FTA "The notion that just one person didn’t do their job and led to the biggest breach in history is quite an amazing claim and shows a fundamental lack of good security practices." "Amazing" is a word I would use, but not the first one. Or even one of the first few.
Thriptic 9y ago
This is shamefully terrible leadership. If you're the CEO and a subordinate fucks up, it means you fucked up. At the end of the day the performance of the entire company is your responsibility.
- notacoward 9y ago
  It's not leadership at all.
khana 9y ago
this is the problem. OWN YOUR SHIT.
Pharylon 9y ago
The CEO is right that it boils down to being one person's fault. He should know since he sees him every day in the mirror.
coldcode 9y ago
Yes, him. Guess what, you are (were) the CEO and you are legally required to be responsible for what your public company does. Blaming anyone else is what terrible CEOs do.
rodgerd 9y ago
People (generally) do the best job they can within the constraints they operate under. If someone isn't, say, patching things in a timely way, the most likely explanation is not that the person is lazy or stupid, but that the system is broken. And if you run a company with a lazy, stupid person being on the critical path for your most important systems? Your systems are broken, because that person shouldn't be there.
eartheaterrr 9y ago
"They’re men of integrity." Not having or addressing any of the women on your IT staff sounds like a systemic issue as well.
galeforcewinds 9y ago
IMO, the board of a public company is responsible for overseeing risk, audit and internal controls, and the CEO is the one person most responsible for ensuring the company acts in accordance with those directives on a day-to-day basis. That an error could be made by a worker is human, though an automated system could also suffer a fault. Audit would have caught a gap, risk management would have caught a vulnerability, and internal controls would have detected incomplete work were these practices properly designed and deployed. Good CEOs look at governance, process, oversight and don't fling muck at employees.
pixel 9y ago
FIFY: "Former Equifax CEO says 'There is only one infosec person in our company'"
Volundr 9y ago
If one person not doing their job leaves the entire credit card holding populous of the US vulnerable to this kind of data leak.... then there was a lot more then one person not doing their job.
jacknews 9y ago
And, ultimately, that person is the CEO himself.

41 points by orange_county 9y ago

ww520 9y ago

Blame the IT peon. Yeah, right. Every single time.

patmcc 9y ago

Absolutely true. That person is the former Equifax CEO.

whipoodle 9y ago

And who built the company that let that slide? Who came up with the practices that led to such a failure? Et cetera.

jepler 9y ago

Someone needs to read http://web.mit.edu/2.75/resources/random/How%20Complex%20Systems%20Fail.pdf http://web.mit.edu/2.75/resources/random/How%20Complex%20Sys... and also probably just stop talking

deleted 9y ago

[deleted]

dudul 9y ago

Apparently the data was stored in plain text. Sorry, but if not applying a patch to your Web framework is enough to make it that vulnerable, there are other problems in your infrastructure, your architecture and your process.

MBCook 9y ago

Good to know. And what about the person who’s job was to make sure that one guy did his job? And the guy who was in charge of that person? And the department who’s job was makin sure nothing was insecure? And the guy managing them? Yep. All one guys fault. Poor guy, ruining the American credit monitoring system for the rest of us.

justboxing 9y ago

This is how it always goes down. - F*ck your customers over by gross negligence and sheer greed (or stupidity, or both) - Get caught with your pants down - Dump your stocks and cash out - Apologize when customers and media express outrage - Go to Congressional hearing and repeat the magic words "I do not recall" for every question - Find 1 low-level scapegoat employee - Fire that employee and declare that the company is now 'clean' - Avoid any jail time for wrong doing by paying a fine - Collect your 'Golden Parachute' = MILLIONS and slide into a new CEO Job. - Rinse and repeat. White collar crime pays. Big time. And almost no-one ever goes to Jail -- unless they have the bad-fortune of being prosecuted by A.G. Preet Bharara (record of 79-0 conviction obtained), which is also not relevant since Trump fired him soon after taking the White House Office. Related: Here's Preet Bharara's Amazing 79-0 Insider Trading Conviction Score Card - http://www.businessinsider.com/bharara-insider-trading-convictions-2014-2 http://www.businessinsider.com/bharara-insider-trading-convi...

BatFastard 9y ago
You missed "Sell your stock"
vermontdevil 9y ago
- collect $90 million and skip the jail part.
- justboxing 9y ago
  lol. Yes. I added your point.
Deinos 9y ago
And, if it is bad enough that a CEO has to be let go... they pop that fancy, golden parachute on the way down...
eagerpace12 9y ago
As of 2016 you can now add to the list "suspected state actors." How could any private company be responsible for being able to stop this?

openasocket 9y ago

There's a mantra at my company that you can't assign blame for a problem to a particular person. If one person is capable of breaking your system, you have a bad system. The focus isn't on finding the one person or the one mistake that caused it, but fixing the process so one person or one mistake can't wreak that much havoc. I think it's a very good philosophy.

iaw 9y ago
Bought a book mentioned in another thread about understanding system failures. If the conclusion blames an individual then 100% of the time the real problem is with the system that gave them that much power.
- vendiddy 9y ago
  What's the book? Would like to add to my reading list :)
  - iaw 9y ago
    And here I thought I could avoid grabbing it from my shelf... "The Field Guide to Understanding 'Human Error'" by Sidney Dekker.
TheSpiceIsLife 9y ago
Has this mantra been stress-tested in the real world with a large scale data breach? Edit: to add to his, what I mean to say is: it's great that (some) companies have this culture internally. It remains to be seen whether the mantra would survive a sufficiently large scandal. Maybe that's when the legal team comes in with the damage control plan as outlined in another comment by @justboxing.
- openasocket 9y ago
  I work for AWS. We haven't had a breach, but consider that S3 outage not too long ago, which was due to one engineer fat-fingering a command. Rather than blaming or disciplining that person, AWS changed the process so that people aren't manually typing in those commands.

s73ver_ 9y ago

Well, that person, that person's boss, and so on up to the CEO. The one who is paid such a large salary to ultimately be responsible for the entire company.

caconym_ 9y ago

Having just a single point of human failure standing in the way of leaking 145M people's data is already negligent. Trying to foist responsibility onto this poor individual (presumably some lower-rung employee) is shameful and just goes to show how ripe their corporate culture was for something like this to happen.

zipwitch 9y ago
Nice of him to publicly testify to their gross incompetence , though. (And under oath too?) Doubtless the various lawsuits will be coming back to this testimony for many years.

deleted 9y ago

[deleted]

aaroninsf 9y ago

FTA "The notion that just one person didn’t do their job and led to the biggest breach in history is quite an amazing claim and shows a fundamental lack of good security practices." "Amazing" is a word I would use, but not the first one. Or even one of the first few.

Thriptic 9y ago

This is shamefully terrible leadership. If you're the CEO and a subordinate fucks up, it means you fucked up. At the end of the day the performance of the entire company is your responsibility.

notacoward 9y ago
It's not leadership at all.

khana 9y ago

this is the problem. OWN YOUR SHIT.

Pharylon 9y ago

The CEO is right that it boils down to being one person's fault. He should know since he sees him every day in the mirror.

coldcode 9y ago

Yes, him. Guess what, you are (were) the CEO and you are legally required to be responsible for what your public company does. Blaming anyone else is what terrible CEOs do.

rodgerd 9y ago

People (generally) do the best job they can within the constraints they operate under. If someone isn't, say, patching things in a timely way, the most likely explanation is not that the person is lazy or stupid, but that the system is broken. And if you run a company with a lazy, stupid person being on the critical path for your most important systems? Your systems are broken, because that person shouldn't be there.

eartheaterrr 9y ago

"They’re men of integrity." Not having or addressing any of the women on your IT staff sounds like a systemic issue as well.

galeforcewinds 9y ago

IMO, the board of a public company is responsible for overseeing risk, audit and internal controls, and the CEO is the one person most responsible for ensuring the company acts in accordance with those directives on a day-to-day basis. That an error could be made by a worker is human, though an automated system could also suffer a fault. Audit would have caught a gap, risk management would have caught a vulnerability, and internal controls would have detected incomplete work were these practices properly designed and deployed. Good CEOs look at governance, process, oversight and don't fling muck at employees.

pixel 9y ago

FIFY: "Former Equifax CEO says 'There is only one infosec person in our company'"

Volundr 9y ago

If one person not doing their job leaves the entire credit card holding populous of the US vulnerable to this kind of data leak.... then there was a lot more then one person not doing their job.

jacknews 9y ago

And, ultimately, that person is the CEO himself.