4 ms·

> "Equifax allowed personal data on more than half the adults in the country to get stolen, and its legal liability is so limited that it may end up making mone

> "Equifax allowed personal data on more than half the adults in the country to get stolen, and its legal liability is so limited that it may end up making money off the breach." "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. There was a detailed Bloomberg article that covered the breach in depth. They found that Equifax had paid top dollar for solid tools, but they were misconfigured (or misused) in such a way as to actually not be working. They found that they had good written procedures. Equifax knew about this vulnerability, and thought they had patched it. So how is any of that "allowed"? In addition, Equifax stock took a huge dip and hasn't recovered (down 21 as of this morning). They're also going to provide features so that all consumers (whether they were potentially impacted by the breach or not) will be able to lock and unlock their credit file, for free, forever. So not only did they take a big hit in terms of stock price, they are giving away the revenue generating lock and unlock service. > If passed into law, the bill would give the US Federal Trade Commission the authority to inspect the companies that collect vast amounts of financial data on consumers to make sure they're protecting that information. In what way does this in any way actually help consumers? Does the FTC have some sort of magic wand to prevent breaches? Does this help out with the overall problem of identity theft? Will this add any security or confidence above and beyond the existing government and industry regulations that are already in effect? Will her new law address any of these? https://www.identityforce.com/blog/2017-data-breaches https://www.identityforce.com/blog/2017-data-breaches

maxerickson 9y ago
So thinking you patched a vulnerability is the same thing as patching it now? I'm gonna run to the bank and tell them I think I'm a millionaire!
tssva 9y ago
If their expensive tools were misconfigured in a manner to render them effectively useless than they didn't have good procedures and follow best practices. Best practices would have included testing and auditing procedures both at deployment and ongoing to verify that they were operating as intended. By not having the proper auditing in place Equifax did allow the breach to occur.
- g051051 9y ago
  Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question that the process was flawed (in that the tools were silently failing and that a single human failure could disrupt their security). The point is, that even with solid processes and procedures, it is impossible to have perfect security. No doubt they (and every other company) will have a much higher focus on security going forward, but at the time they thought they were adequately protected. Their policies were sound, but their execution was flawed, and they got burned.
52-6F-62 9y ago
> "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. Maybe you haven't heard about one of the exploits, but leaving the front door open is what I would call using "admin" as both username and password. This also implies no further configuration was done past install and setup... https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l...
- g051051 9y ago
  That was a totally different site in another country, not even in current use, and had no exposure of PII. Yes, it was a dumb thing, but it was completely unrelated to the breach.
  - 52-6F-62 9y ago
    * not in current use according to Equifax. I'm hesitant to take their word at face value, as they've tried to mitigate the entire situation via PR already and claim many users [who were affected] were not affected. However the site was still live, and exposed to the public web. It's only unrelated to the specific event in the United States, but clearly indicative of a pattern of negligence. I also wanted to add that the software in question that was compromised was a free and open source solution[0], not some top-dollar security program. And it was breached by relative simple XSS attack that even may have been carried out automatically. Beyond that it could just as likely have been a script kiddie who caught wind of the vulnerability on a message board somewhere and went hunting. I wouldn't call that highly sophisticated. XSS protection is the very baseline of internet data security... I'd also like to point to a video posted by another user upthread (willfarvar): https://www.youtube.com/watch?v=vsMydMDi3rI https://www.youtube.com/watch?v=vsMydMDi3rI FBI's Frank Abagnale speaks to the Equifax breach at ~37m (as willfarvar says, though, the entire video/talk is great) --- [0] https://struts.apache.org/announce.html#a20170707 https://struts.apache.org/announce.html#a20170707
    - 9y ago
jkestner 9y ago
Allowed. They left the back door open for two months. If "good written procedures" weren't followed, what good is that? When carelessness is systemic, where does the buck stop? https://www.wired.com/story/equifax-breach-no-excuse/ https://www.wired.com/story/equifax-breach-no-excuse/ I agree that a federal agency barreling into this space is likely to be ineffective, but I'd rather nudge them to build policy with security experts than continue allowing every freaking company to police itself. The latter has proven to be ineffective.
- g051051 9y ago
  > They left the back door open for two months. There's a difference between "left the back door open for two months" and "the back door was open for two months because the person assigned to verify it was closed told everyone it was". > If "good written procedures" weren't followed, what good is that? How do you know they aren't being followed? How many layers are enough? If a process breaks down, what's your first signal? > allowing every freaking company to police itself. CRAs don't police themselves, they're audited and regulated already.

maxerickson 9y ago

So thinking you patched a vulnerability is the same thing as patching it now? I'm gonna run to the bank and tell them I think I'm a millionaire!

tssva 9y ago

If their expensive tools were misconfigured in a manner to render them effectively useless than they didn't have good procedures and follow best practices. Best practices would have included testing and auditing procedures both at deployment and ongoing to verify that they were operating as intended. By not having the proper auditing in place Equifax did allow the breach to occur.

g051051 9y ago
Who knows when the flaw in their process was introduced? Perhaps it passed all the audits and tests, but got misconfigured later. There's no doubt or question that the process was flawed (in that the tools were silently failing and that a single human failure could disrupt their security). The point is, that even with solid processes and procedures, it is impossible to have perfect security. No doubt they (and every other company) will have a much higher focus on security going forward, but at the time they thought they were adequately protected. Their policies were sound, but their execution was flawed, and they got burned.

52-6F-62 9y ago

> "Allowed"? She phrases that to make it sound like Equifax just left the front door open. In truth, they were hacked by sophisticated criminals (possibly state sponsored), who pinpointed a flaw in their security and exploited it. Maybe you haven't heard about one of the exploits, but leaving the front door open is what I would call using "admin" as both username and password. This also implies no further configuration was done past install and setup... https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l...

g051051 9y ago
That was a totally different site in another country, not even in current use, and had no exposure of PII. Yes, it was a dumb thing, but it was completely unrelated to the breach.
- 52-6F-62 9y ago
  * not in current use according to Equifax. I'm hesitant to take their word at face value, as they've tried to mitigate the entire situation via PR already and claim many users [who were affected] were not affected. However the site was still live, and exposed to the public web. It's only unrelated to the specific event in the United States, but clearly indicative of a pattern of negligence. I also wanted to add that the software in question that was compromised was a free and open source solution[0], not some top-dollar security program. And it was breached by relative simple XSS attack that even may have been carried out automatically. Beyond that it could just as likely have been a script kiddie who caught wind of the vulnerability on a message board somewhere and went hunting. I wouldn't call that highly sophisticated. XSS protection is the very baseline of internet data security... I'd also like to point to a video posted by another user upthread (willfarvar): https://www.youtube.com/watch?v=vsMydMDi3rI https://www.youtube.com/watch?v=vsMydMDi3rI FBI's Frank Abagnale speaks to the Equifax breach at ~37m (as willfarvar says, though, the entire video/talk is great) --- [0] https://struts.apache.org/announce.html#a20170707 https://struts.apache.org/announce.html#a20170707
  - 9y ago

jkestner 9y ago

Allowed. They left the back door open for two months. If "good written procedures" weren't followed, what good is that? When carelessness is systemic, where does the buck stop? https://www.wired.com/story/equifax-breach-no-excuse/ https://www.wired.com/story/equifax-breach-no-excuse/ I agree that a federal agency barreling into this space is likely to be ineffective, but I'd rather nudge them to build policy with security experts than continue allowing every freaking company to police itself. The latter has proven to be ineffective.

g051051 9y ago
> They left the back door open for two months. There's a difference between "left the back door open for two months" and "the back door was open for two months because the person assigned to verify it was closed told everyone it was". > If "good written procedures" weren't followed, what good is that? How do you know they aren't being followed? How many layers are enough? If a process breaks down, what's your first signal? > allowing every freaking company to police itself. CRAs don't police themselves, they're audited and regulated already.