4 ms·

They were able to identify and re-run the attack, so auditing and logging are likely present enough to capture what they attackers did, which in most breaches n

They were able to identify and re-run the attack, so auditing and logging are likely present enough to capture what they attackers did, which in most breaches needs to be analyzed to see what they were able to accomplish. This doesn't shout amateur hour to me directly, it seems more kicking a dead horse while its down, but that doesn't mean it isn't amateur hour or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I'm not trying to defend them, just stating this sounds somewhat misleading and sensationalized.

toomuchtodo 8y ago
> or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I haven't seen any proof that Equifax operates in any other way. I am not attempting to be rude, only stating fact.
- g051051 8y ago
  Unless you work for them, you haven't seen any proof of anything, outside of the tiny amount of information revealed since the breach.
  - toomuchtodo 8y ago
    I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. I don’t need to be inside their org to see that. Do you work for Equifax?
    - g051051 8y ago
      > I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. Can you share that proof?
      - toomuchtodo 8y ago
        > Can you share that proof? https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... > If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies. > Here are the facts, according to Equifax. The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too. Sensitive personal and financial data of half of American adults, as well as UK and Canadian citizens. For 90 days. If that isn't proof, I don't know what is.
        g051051 8y ago
        That's proof of a security breach, not proof of "a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public".
        deleted 8y ago
        [deleted]
        AlexCoventry 8y ago
        ISTR the details of the exploit have been reported, and relied on a known vulnerability which they had failed to patch, despite ample opportunity. I could be wrong, though.
        g051051 8y ago
        This article from Bloomberg has the best and least clickbait reporting on the breach: https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros https://www.bloomberg.com/news/features/2017-09-29/the-equif.... While it's true that the breach entry can be attributed to an unpatched vulnerability, it was unpatched due to a process failure, not a "complete disregard for the secure storage and transport of sensitive financial and PII" as the other poster claimed. According to the article, Equifax processed the vulnerability: they got notification and applied the update. But their process was flawed and missed at least one spot, and that was their undoing. Saying "they had failed to patch, despite ample opportunity" implies they knew about the issue and ignored it, which is not the case.

toomuchtodo 8y ago

> or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I haven't seen any proof that Equifax operates in any other way. I am not attempting to be rude, only stating fact.

g051051 8y ago
Unless you work for them, you haven't seen any proof of anything, outside of the tiny amount of information revealed since the breach.
- toomuchtodo 8y ago
  I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. I don’t need to be inside their org to see that. Do you work for Equifax?
  - g051051 8y ago
    > I have seen proof that they have a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public. Can you share that proof?
    - toomuchtodo 8y ago
      > Can you share that proof? https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... > If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies. > Here are the facts, according to Equifax. The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too. Sensitive personal and financial data of half of American adults, as well as UK and Canadian citizens. For 90 days. If that isn't proof, I don't know what is.
      - g051051 8y ago
        That's proof of a security breach, not proof of "a complete disregard for the secure storage and transport of sensitive financial and PII of a large swath of the American public".
        deleted 8y ago
        [deleted]
        AlexCoventry 8y ago
        ISTR the details of the exploit have been reported, and relied on a known vulnerability which they had failed to patch, despite ample opportunity. I could be wrong, though.
        g051051 8y ago
        This article from Bloomberg has the best and least clickbait reporting on the breach: https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros https://www.bloomberg.com/news/features/2017-09-29/the-equif.... While it's true that the breach entry can be attributed to an unpatched vulnerability, it was unpatched due to a process failure, not a "complete disregard for the secure storage and transport of sensitive financial and PII" as the other poster claimed. According to the article, Equifax processed the vulnerability: they got notification and applied the update. But their process was flawed and missed at least one spot, and that was their undoing. Saying "they had failed to patch, despite ample opportunity" implies they knew about the issue and ignored it, which is not the case.