5 ms·

Most probably their marketing and legal team came up with the idea. Once the outcry blows over turn off the site and all incoming external links become dead. Af

by akg_67 9y ago

Most probably their marketing and legal team came up with the idea. Once the outcry blows over turn off the site and all incoming external links become dead. After a while general public will not remember and wouldn’t associate their main site with this incident through search. Legal might have encouraged to have two fully independent sites. I will not be surprised two sites belong to two separate legal entities. Just a speculation on my part considering how US corporate behave.

wmccullough 9y ago
Without looking it up, I’ll throw my chips on the table that they offshore the majority of their IT.
- mavelikara 9y ago
  Offshore or outsource?
- greedy_buffer 9y ago
  Maybe. The separate domain might be explained by lack of trust in their PR company though. See Krebs' article: https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/ https://krebsonsecurity.com/2017/09/equifax-breach-response-...
- drieddust 9y ago
  That's just Horseshit. I have worked on both sides of the table and incompetence is equally widespread. However, vendors are not as bad as they seems to appear and employees are not as good as they seems to appear. Most of the contracts nowadays have a penalty clause and a stated Service Level Agreements (SLA) around performing the vulnerability scan and closing the GAP within a stipulated time frame. Outsourcing companies might not be innovative but they don't like to lose money on failing SLAs. Coming back to the issue of incompetence. I have often seen so called innovator of the just taking the credit for the work done by Vendor. The way typical scenario rolls out is this. Senior management of of the company will throw a challenge to the senior management of Vendor. After a few discussions middle management of will assign the responsibility to their lowest level employees. After a lot of hard work when solution is in sight, all communication channels will be closed. A few weeks later solution will be presented to their own management while keeping the vendor completely out of loop as if vendor was completely useless and they did all the hard work. Vendor will be presented as mindless robot who can just execute the instruction. Hell I have seen employees not even having the courtesy even the reword our solutions. Incentives of employees are aligned with making the vendor look less effective or they themselves will be replaced at some point by their own higher management. I think its not their fault. It is just the environment where painting the vendor in positive color will be detrimental to employee's own job.
  - dasil003 9y ago
    I'm sorry this happened to you, it sucks to not get credit for your work. I think the explanation is simpler though. There is no incentive to say either good things or bad things about a Vendor, the incentive is to keep the focus on the internal people that were involved, because recognizing internal employees is critical for morale and general team cohesion. Recognizing a Vendor's effort could potentially backfire and lead to bad blood internally (happens with consultants all the time) and is not really a priority because the engagement is based on a negotiated contract that is primarily driven by financial or expertise reasons, not the human elements. The fact is, the Vendor is the one that should be worried about the morale of their own employees. The Vendor's management should be praising the good work of the employees, and if there is blatant disrespect coming down from the Company, it is their job to either address it or at least justify to appease their rank and file.
    - drieddust 9y ago
      I completely agree with you and I am not sour about it at all. In corporate environment everyone works for their self interest and as vendor we are happy if we are getting paid. I was just calling out the passive aggressive parent comment.
- throwaway1 9y ago
  Without looking it up, I’ll throw my chips on the table and claim that you would like to just blame offshoring for any problem without providing any substantive proof. If there was a vendor involved - Equifax would have already jumped on that fact and blamed the vendor. They would have already played the oh-we-had-a-bad-vendor-and-fired-them-immediately game by now.
  - Chris2048 9y ago
    why would they? they hired the vendor, they'd be still to blame.
- smt88 9y ago
  Their executives were incredibly incompetent. Whether your people are offshore or not, a competent leader knows to tell them to do things properly and knows enough to verify the basics. None of that was done.
eli 9y ago
I doubt there's a well considered plan here. Much more likely the people setting up the site simply didn't know better and/or the people who know technology aren't in decision making roles.
renaudg 9y ago
Never attribute to malice that which is adequately explained by stupidity, etc etc.
- johnhenry 9y ago
  Sometimes, legally the two are indistinguishable.
  - speedplane 9y ago
    Yup, it's called "gross negligence", which often has the same legal implications of malice. As an analogy, lending your car to a friend which turns out to have faulty brakes is negligent. But lending it to him when your mechanic told you the brakes don't work is probably grossly negligent, and will often have the the same repercussions as if you cut the brakes yourself.
speedplane 9y ago
If the legal team came up with this idea, they need a new legal team. In house lawyers do not have to be technical experts, but they should know about cyber-squatting and DNS related fraud. This should have been in their wheelhouse.
- KekDemaga 9y ago
  The head of infosec was a music major so the head of legal probably has a degree in dance theory.
  - dsfyu404ed 9y ago
    What your undergrad is in really doesn't mean anything if you've got experience, especially if you got it at a time when most schools didn't have cyber-security programs/concentrations within CS and CS was more closely aligned with math. Some of the best infosec people I know have completely irrelevant degrees. That said, I'm not trying to make excuses for Equifax. From what we know the head of infosec there was not qualified to do the job.
- adaml_623 9y ago
  They could just deactivate the domain but leave it registered

by akg_67 9y ago

wmccullough 9y ago

Without looking it up, I’ll throw my chips on the table that they offshore the majority of their IT.

mavelikara 9y ago
Offshore or outsource?
greedy_buffer 9y ago
Maybe. The separate domain might be explained by lack of trust in their PR company though. See Krebs' article: https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/ https://krebsonsecurity.com/2017/09/equifax-breach-response-...
drieddust 9y ago
That's just Horseshit. I have worked on both sides of the table and incompetence is equally widespread. However, vendors are not as bad as they seems to appear and employees are not as good as they seems to appear. Most of the contracts nowadays have a penalty clause and a stated Service Level Agreements (SLA) around performing the vulnerability scan and closing the GAP within a stipulated time frame. Outsourcing companies might not be innovative but they don't like to lose money on failing SLAs. Coming back to the issue of incompetence. I have often seen so called innovator of the just taking the credit for the work done by Vendor. The way typical scenario rolls out is this. Senior management of of the company will throw a challenge to the senior management of Vendor. After a few discussions middle management of will assign the responsibility to their lowest level employees. After a lot of hard work when solution is in sight, all communication channels will be closed. A few weeks later solution will be presented to their own management while keeping the vendor completely out of loop as if vendor was completely useless and they did all the hard work. Vendor will be presented as mindless robot who can just execute the instruction. Hell I have seen employees not even having the courtesy even the reword our solutions. Incentives of employees are aligned with making the vendor look less effective or they themselves will be replaced at some point by their own higher management. I think its not their fault. It is just the environment where painting the vendor in positive color will be detrimental to employee's own job.
- dasil003 9y ago
  I'm sorry this happened to you, it sucks to not get credit for your work. I think the explanation is simpler though. There is no incentive to say either good things or bad things about a Vendor, the incentive is to keep the focus on the internal people that were involved, because recognizing internal employees is critical for morale and general team cohesion. Recognizing a Vendor's effort could potentially backfire and lead to bad blood internally (happens with consultants all the time) and is not really a priority because the engagement is based on a negotiated contract that is primarily driven by financial or expertise reasons, not the human elements. The fact is, the Vendor is the one that should be worried about the morale of their own employees. The Vendor's management should be praising the good work of the employees, and if there is blatant disrespect coming down from the Company, it is their job to either address it or at least justify to appease their rank and file.
  - drieddust 9y ago
    I completely agree with you and I am not sour about it at all. In corporate environment everyone works for their self interest and as vendor we are happy if we are getting paid. I was just calling out the passive aggressive parent comment.
throwaway1 9y ago
Without looking it up, I’ll throw my chips on the table and claim that you would like to just blame offshoring for any problem without providing any substantive proof. If there was a vendor involved - Equifax would have already jumped on that fact and blamed the vendor. They would have already played the oh-we-had-a-bad-vendor-and-fired-them-immediately game by now.
- Chris2048 9y ago
  why would they? they hired the vendor, they'd be still to blame.
smt88 9y ago
Their executives were incredibly incompetent. Whether your people are offshore or not, a competent leader knows to tell them to do things properly and knows enough to verify the basics. None of that was done.

eli 9y ago

I doubt there's a well considered plan here. Much more likely the people setting up the site simply didn't know better and/or the people who know technology aren't in decision making roles.

renaudg 9y ago

Never attribute to malice that which is adequately explained by stupidity, etc etc.

johnhenry 9y ago
Sometimes, legally the two are indistinguishable.
- speedplane 9y ago
  Yup, it's called "gross negligence", which often has the same legal implications of malice. As an analogy, lending your car to a friend which turns out to have faulty brakes is negligent. But lending it to him when your mechanic told you the brakes don't work is probably grossly negligent, and will often have the the same repercussions as if you cut the brakes yourself.

speedplane 9y ago

If the legal team came up with this idea, they need a new legal team. In house lawyers do not have to be technical experts, but they should know about cyber-squatting and DNS related fraud. This should have been in their wheelhouse.

KekDemaga 9y ago
The head of infosec was a music major so the head of legal probably has a degree in dance theory.
- dsfyu404ed 9y ago
  What your undergrad is in really doesn't mean anything if you've got experience, especially if you got it at a time when most schools didn't have cyber-security programs/concentrations within CS and CS was more closely aligned with math. Some of the best infosec people I know have completely irrelevant degrees. That said, I'm not trying to make excuses for Equifax. From what we know the head of infosec there was not qualified to do the job.
adaml_623 9y ago
They could just deactivate the domain but leave it registered