18 ms·

House Oversight Committee Report on Equifax Breach [pdf]

238 points by chair6 8y ago

jedberg 8y ago
> Recommendation 6: Reduce Use of Social Security Numbers as Personal Identifiers The executive branch should work with the private sector to reduce reliance on Social Security numbers. I'm disappointed this is recommendation 6, but at least it is in there. I'm also disappointed that they suggest the executive fix this problem instead of legislating a solution. Hopefully they take some action on their own recommendation!
- dragontamer 8y ago
  The executive branch is the proper solution. If Congress mandates a solution, then it'd be like the VHS stuff all over again. Congress writes a thingy about VHS in the 1980s, and its completely irrelevant 10 years later. (If a law states that something with VHS is done a certain way, will it apply to DVDs or BluRays when they are invented 10 years later? Or to streaming media 20 years later??) The Executive Branch is the one that actually runs the government. Legislative Branch / Congress sets policies, but shouldn't set solutions. Law goes out of date incredibly quickly. Ex: If Congress says that RSA Tokens are to be used instead of SSNs, what happens if a better invention (ex: Google Titan) comes out? Furthermore, even if Congress writes a certain policy down (ex: Two Factor Authentication is necessary to protect bank accounts), the Executive Branch is still the ones who enforce the matter. So in the case of Two Factor Authentication (legal requirement of banks to protect your bank account), the Executive Branch says that "3-personal questions + Password" counts as two-factor security in the USA. And that's why you have so many banks implementing "3-secret questions". ------------ So regardless, the job will come down to the Executive Branch.
  - hannasanarion 8y ago
    Social security isn't a piece of technology, it's a government program. How is it in any way like VHS?
    - dragontamer 8y ago
      Whatever will replace SSNs will be a piece of technology. Ideally, something that uses public/private key encryption. There's a lot of things that use public/private keys however, or security tokens, or whatnot. Should it be a smartphone app? A hardware dongle? Etc. etc. If a hardware dongle, which one? As such, its the Executive Branch's job to research the various technologies, and implement a new standard to solve the online identity problem. ---------- For example, 18f (White House's crack website team) has the following: https://login.gov/ https://login.gov/ Github code here: https://github.com/18F/identity-idp https://github.com/18F/identity-idp If single-sign on were widely deployed across US Agencies (and tied to financial services / private sector banks), we'd be in a way better place. In any case, this is clearly the realm of the Executive Branch. Specifically 18f probably should continue to lead the effort, as they have been.
      - freehunter 8y ago
        All Congress has to do is pass a law saying "private companies are not allowed to store SSNs" and let those private companies figure out what the replacement is. Congress doesn't need to legislate the replacement technology.
        dragontamer 8y ago
        That fundamentally misunderstands the problem. SSNs are fine and useful. They just shouldn't be the "password" to financial systems. When every damn bank uses "Whats your pin and SSN" to gain access to an account... that's the problem. The issue is that private companies use SSNs for security. There's nothing wrong in using SSNs as an identifier. The USA needs to start assuming that SSNs are public information, and to build security through other means. SSNs were never a secret number to be used for authentication / authorization purposes.
        tialaramex 8y ago
        > There's nothing wrong in using SSNs as an identifier. There's plenty wrong with this. SSNs were already a pretty bad identifier when they were invented and didn't get better. There's no check digit, so if you make any mistake at all it's probably a different person's valid SSN. Until relatively recently they were assigned both chronologically and geographically, so one digit error in SSN plus Address plus date of birth... Causes no red flags, it looks about right. Modern ones are randomly assigned, but it'll be decades before that's most people. Like most similar systems the US SSN also very explicitly says it isn't suitable for any purpose except numbering Social Security recipients. People you want numbers for may or may not have SSNs. Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Somebody you know probably does this today. What a useful "identifier".
  - jedberg 8y ago
    The legislative solution would be to mandate a national ID with a cryptographic token, and then leave it up to the executive to define the implementation. Right now, even if they wanted to, the executive can't force a national ID.
    - dragontamer 8y ago
      > The legislative solution would be to mandate a national ID with a cryptographic token, and then leave it up to the executive to define the implementation. That's still too specific. "national ID with a cryptographic token" means that OpenID / Paypal-based single-sign on logins are illegal. Yeah, writing laws is hard as heck, and Congress is NOT the experts in the field of cryptography / login security. So Congress will get it wrong if they even tried to write the law in that manner. Executive Branch CAN hire experts (ie: 18f, NIST, etc. etc.) to define best practices. As such, the proper legislative solution would be to mandate "industry best practices of identity protection, as defined by (Insert Agency Here, maybe NIST)".
      - jonlucc 8y ago
        > "national ID with a cryptographic token" means that OpenID / Paypal-based single-sign on logins are illegal. Why? Why doesn't it just mean that there's a canonical government system that doesn't touch PayPal or OpenID that can be used for stuff that would currently be tied to your social security number?
        dragontamer 8y ago
        PayPal touches your SSN, as it is tied to your bank account. (Bank accounts require a "Individual Taxpayer Identification Number", which is the SSN for any citizen. Non-citizens get a different ID, but really its the TIN that is the cause of all of these security issues). So yes, really, the proposed wording would probably make Paypal illegal. You have a point on OpenID, but my overall point is that OpenID would probably be sufficient for most financial transactions on today's internet. OpenID is basically equivalent to Paypal's security model. Neither Paypal nor OpenID require 2-factor or security tokens. I think they're an optional feature. But in any case, the Paypal / OpenID model of identification (Paypal controlled website verifies password, and sends a token to the 3rd party website) would be sufficient for today's security. ---------------- Of course, none of this even touches upon Equifax. Equifax uses SSNs to identify people, and often without their knowledge or consent. Equifax is a service to the financial industry, to help keep tabs on individual's history. So the Paypal model will NOT work with Equifax's use case, because the individuals don't always know when they are being tracked. Maybe it'd have to be something to OAuth's model. In any case, I'm not an expert either. I just appreciate the difficulty of this problem.
- danShumway 8y ago
  I would support a government initiative that deprecated social security numbers entirely. Come up with an alternative plan, give businesses some reasonable number of years to stop relying on them, and after that point they'll no longer be issued to anyone new who's born. Or if you don't want to get rid of them, treat them like public information. Give businesses X years, and then say, "past this point, we're just going to make these searchable by anyone who makes a request." They're an ID number, not a password.
  - billylindeman 8y ago
    Yeah there should be some sort of government sponsored cryptographic identity system :\ I hope some of the identity verification blockchain companies succeed for this sort of thing. What we have now is laughably bad.
    - abakker 8y ago
      Government and distributed ledger seem diametric. Either the government creates a centralized identity system and is the sole authority, or, a distributed system is used to grant identity numbers. Half measures between seem more problematic. Personally, I’m fine with the government being the single source of truth for that stuff, it is kind of their raison d'être.
artursapek 8y ago
> Equifax did not see the data exfiltration because the device used to monitor ACIS network traffic had been inactive for 19 months due to an expired security certificate. On July 29, 2017, Equifax updated the expired certificate and immediately noticed suspicious web traffic. Ouch.
txcwpalpha 8y ago
> The attackers transferred this data out of the Equifax environment, unbeknownst to Equifax. Equifax did not see the data exfiltration because the device used to monitor ACIS network traffic had been inactive for 19 months due to an expired security certificate. > Equifax had allowed over 300 security certificates to expire, including 79 certificates for monitoring business critical domains. (on page 2 of the Executive Summary) I've been following the Equifax breach story but this is the first I'm hearing about the expired certificates. That is shockingly bad. I'm a little disappointed in the final "conclusion" of the report, though. The end of the executive summary basically chalks the breach up to two things: "Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure". These are valid points, but these are also issues that nearly every single major corporation in the world faces, and yet many of them still manage to prevent (or at least mitigate) major breaches. These aren't good enough reasons to explain why Equifax failed so spectacularly compared to every other bureaucratic company with legacy software. Also, I know this report isn't meant to be a remediation strategy roadmap, but it's also pretty disappointing that the recommendations section is basically just 3 pages of fluffy, vague, "X and Y should work together to increase cybersecurity" bullshit. Such a high profile incident would have been a great time for the federal government to really show some leadership (or at least strong guidance) in this realm, but they really didn't. I mean hell, at least link your recommendations to the NIST Cybersecurity Framework...
- codazoda 8y ago
  Can someone explain why an expired certificate, on a monitoring device, would cause the device to completely fail rather than just spit out warnings about the certificate?
  - david_shaw 8y ago
    My guess is that they were using private certificates to read encrypted data, without which they couldn't inspect their traffic.
    - jacquesm 8y ago
mbesto 8y ago
> In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked on an aggressive growth strategy, leading to the acquisition of multiple companies, information technology (IT) systems, and data. While the acquisition strategy was successful for Equifax’s bottom line and stock price, this growth brought increasing complexity to Equifax’s IT systems, and expanded data security risks. > Second, Equifax’s aggressive growth strategy and accumulation of data resulted in a complex IT environment. Equifax ran a number of its most critical IT applications on custombuilt legacy systems. Both the complexity and antiquated nature of Equifax’s IT systems made IT security especially challenging. Equifax recognized the inherent security risks of operating legacy IT systems because Equifax had begun a legacy infrastructure modernization effort. This effort, however, came too late to prevent the breach. As someone who works in Tech M&A, I often tell clients "hackers go after the weakest link and you just acquired a new link". They nearly unilaterally ignore this advice and ignored hardening even the smallest of acquisitions, because well, "growth". Someday people will learn.
- westmeal 8y ago
  ... unfortunately I don't think people are going to learn this anytime soon.
- dv_dt 8y ago
  If you start with the accounting assumptions that work on security is a cost, and storing of private data is not a liability then all the actions are rational within the narrow scope of profit optimization. (I'm not in agreement of this, but it seems to be true). Equifax holds these assumptions even more strongly because their fundamental existence is founded on monetization of private data.
  - nawtacawp 8y ago
    This afteraction also validates breaches are not a liability, in the end their sharevalue recovered nearly immediately.
  - rorykoehler 8y ago
    Data is always a liability unless it is the core component which drives value in your business (ie you are Google or Facebook).
citilife 8y ago
The report doesn't appear to mention that you could just login to their web portal with an obvious password [1]. It also doesn't appear to be under the purview to look at the leadership team selling stock[2]. Both of which it should consider when reviewing the competency and ethics of an organization managing and profiling nearly everyone in the U.S. Speaking of which... why is it only ~50% of the adult population in the U.S.? If the intruders were going around the Equifax network at will (which from the report it appears they were). We should assume 100% of the data was breached. [1] https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l... [2] https://www.bloomberg.com/news/articles/2018-03-14/sec-says-former-equifax-executive-engaged-in-insider-trading https://www.bloomberg.com/news/articles/2018-03-14/sec-says-...
- Twirrim 8y ago
  You're making the large assumption that Equifax runs a single, global, interconnected network.
- sorlon 8y ago
  The report doesn't appear to mention that you could just login to their web portal with an obvious password [1]. That was a different portal and a different breach.
deleted 8y ago
[deleted]
Someone1234 8y ago
Just want to talk about Recommendation 6 (Recommendation 6: Reduce Use of Social Security Numbers as Personal Identifiers). Page 96. The recommendation is essentially "Try to convince the public and private sector to use them less." But I'd argue it is well passed time that SSNs be replaced by something fit for purpose. SSNs were never designed to be a unique form of ID, and using things like the cardboard card as further verification is almost comical. I'd like to see an aggressive alternative that uses the best of our security knowledge and then have it vetted by everyone in the security industry with a pulse. We've seen other countries try this. But most of those countries outsource it to the lowest government bidder, who hide the inner workings behind proprietary claims, and never vet the resulting proposal. Instead we need something more akin to the United States Digital Service, a publically created proposal (fully released specs) that is vetted by every academic and security expert they can find. The hardest part will be saying "no" to requirements creep. Allow certain government agencies to continue to use SSNs for now, and have the new ID "flip" into an SSN behind the scenes. Better than needing five hundred different departments to adopt the new standard before it can go live.
- viraptor 8y ago
  > Try to convince the public and private sector to use them less. It's gov, so they can do more. It can also be "By 202x using SSN for identification in non-SS purposes becomes illegal."
strict9 8y ago
There is so much to comment on and digest in this report, but the lifecycle of an attack diagram[1] on page 31 (figure 164) is something every software developer should burn in to memory. It is easy to fall in the trap of seeing the most miniscule of vulnerabilities and dismissing it as "no one could ever possibly utilize that as a vector, it's not critical." But that miniscule vulnerability becomes a single link in a ladder to everything in the system. Every seemingly-small vulnerability matters, like this painfully shows. [1] referenced here: https://blog.hellobloom.io/how-hard-was-the-equifax-hack-a3bae36f9e6f https://blog.hellobloom.io/how-hard-was-the-equifax-hack-a3b...
- jacquesm 8y ago
  That's something you keep seeing as a pattern in many hacks. It is rarely just one mistake, usually a chain of small ones, each of which doesn't look all that bad by itself.
  - freehunter 8y ago
    That's why technologies like SIEMs exist. No number of humans could look at logs across all the various systems and spot anomalies within them, but a SIEM can. But only if it's turned on, ingesting data, running a useful ruleset, and crucially: only if someone is watching the output.
evolvedlight 8y ago
The most alarming part of this is that it appears that the intrusion was only discovered when the new SSL monitoring certificates were being checked to ensure that the appliance was again "on". I wonder how long it'd have taken if someone hadn't spotted something suspicious by accident at that point - I'm sure we've all spotted bugs or flaws by accident when testing a completely different feature.
yalogin 8y ago
Why is Equifax in business still? I don't get it. A company like Bear Sterns got "killed", Enron and others got litigated out. But it looks like Equifax did not face any consequences. Its high time we treat data as an asset class and regulate accordingly. Particularly personal information is acquired by every company and is treated as a valuable commodity. Companies get acquired purely for the amoutn of data they have. The market has already declared it as an asset why is it not regulated?
- harryh 8y ago
  Bears Sterns was acquired by JP Morgan when it was under financial duress. Enron went out of business due to losing an enormous amount of money. Neither of these things had much to do with government regulation.
  - dopamean 8y ago
    You could argue that deregulation played a significant role in the fiascos that brought down both of those companies.
  - yalogin 8y ago
    The analogy was that Equifax lost all of its assets and then some. It failed in the only job it had, protecting users' data, its only asset. It lost credibility and could be argued that its name became toxic. Its very similar to Bear Sterns and Enron, IMO
    - harryh 8y ago
      They didn't lose them. They still have them. They just let someone else make a copy. That didn't make the copy that Equifax still has any less valuable. Keeping that data secret isn't the only job it has. In fact that isn't even really their primary job. Their primary job is evaluating the credit worthiness of potential customers for equifax clients. As far as I know, they are still doing that job quite well.
    - g051051 8y ago
Twirrim 8y ago
>The Equifax data breach and federal customers’ use of Equifax identity validation services highlight the need for the federal government to be vigilant in mitigating cybersecurity risk in federal acquisition. The Office of Management and Budget (OMB) should continue efforts to develop a clear set of requirements for federal contractors to address increasing cybersecurity risks, particularly as it relates to handling of PII. There should be a government wide framework of cybersecurity and data security risk based requirements. From my understanding of FEDRAMP, all of the things that Equifax failed to do should be already covered. Software patching, isolation of data, audit trails etc. etc. Seems more like a massive auditing fail.
- g051051 8y ago
  Reading through the timeline, it shows that at every step Equifax was trying to do the right thing...internally publishing vulnerabilities, applying patches, scanning for vulnerabilities, etc. The policies and procedures were good. One difference is that previously Equifax claimed a single employee failed to scan and patch a system. I don't see a reference to that in the report. All I see now is that someone scanned a system improperly: > The scan did not identify any components utilizing an affected version of Apache Struts. Interim CSO Russ Ayres stated the scan missed identifying the vulnerability because the scan was run on the root directory, not the subdirectory where the Apache Struts was listed.
Nelkins 8y ago
Anyone got any stories of being affected by this breach?
- pfranz 8y ago
  The problem is identifying which breach caused your problem. Often, criminals use data from multiple breaches. Inaction on data security is actually lowering the liability for companies and pushing more responsibility onto individuals.
- arduanika 8y ago
  I waited in trepidation for the value of my index funds' shares in Equifax to go to zero, but it didn't end up happening. False alarm. Don't know why I got so worked up.
onetimemanytime 8y ago
>>"Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure" I feel for them (not!). BUT they shouldn't store any valuable data then. They should be not-insurable.
ne0n 8y ago
> Equifax, however, did not fully patch its systems. Equifax’s Automated Consumer Interview System (ACIS), a custom-built internet-facing consumer dispute portal developed in the 1970s, was running a version of Apache Struts containing the vulnerability. Equifax did not patch the Apache Struts software located within ACIS, leaving its systems and data exposed. 1970s? Am I reading that right? HTML wasn't even developed yet.
- jstarfish 8y ago
  Yes. ACIS is still a terminal-based mainframe application, but it's now fronted by a bunch of shitty Java apps that function as its API.
- g051051 8y ago
  Most likely they had a web front end that talks to the legacy system. Very common in big companies. It was probably developed very quickly, possibly outsourced, and just stuck in front of the older system with minimal re-engineering. Many years ago, I worked on a system that put an X Windows front end in front of a mainframe app that used a 3270 emulator to interact with parts of the legacy app. I imagine this is somewhat similar.
infodocket 8y ago
The report linked here is the House Oversight Committee (Majority) Staff Report. Another report from the committee's minority is also available. https://democrats-oversight.house.gov/sites/democrats.oversight.house.gov/files/Equifax https://democrats-oversight.house.gov/sites/democrats.oversi... Minority Report - FINAL 12-10-2018.pdf
- arduanika 8y ago
  Link not working for me. Try: https://democrats-oversight.house.gov/sites/democrats.oversight.house.gov/files/Equifax%20Minority%20Report%20-%20FINAL%2012-10-2018.pdf https://democrats-oversight.house.gov/sites/democrats.oversi... Key recommendations from the minority report: "Based on the investigation conducted by the Committees, four key legislative reforms proposed by Democrats would help prevent future cyberattacks: [A] hold federal financial regulatory agencies accountable for their consumer protection oversight responsibilities; [B] require federal contractors to comply with established cybersecurity standards and guidance from the National Institute of Standards and Technology (NIST); [C] establish high standards for how data breach victims should be notified; [D] and strengthen the ability of the Federal Trade Commission (FTC) to levy civil penalties for private sector violations of consumer data security requirements." On [B], they note that "Equifax was a federal contractor at the time of its data breach". On [D], they note that "In the three years before the Equifax data breach, the company spent only about 3% of its operating revenue on cybersecurity—less than the company spent on stock dividends...Civil penalties would incentivize private sector companies to prioritize and invest in continually upgrading and deploying modernized IT solutions and applying cybersecurity best practices."
loteck 8y ago
Check out how Equifax started rolling heads starting on page 50. They pinned the fact of not patching Struts on a SVP who was one of hundreds of people notified of the need to patch Struts. But he didn't forward that email, so he's toast! Now pardon me while I go route my patch management procedures through the nearest baffling and inane dependency. A senior Equifax official was terminated for failing to forward an email – an action he was not directed to do – the day before former CEO Richard Smith testified in front of Congress. This type of public relations-motivated maneuver seems gratuitous against the back drop of all the facts
cronix 8y ago
This is the equivalent to "We offer our thoughts and prayers" after a mass-shooting.
lifeisstillgood 8y ago
What does the baseline of "good enough security" look like? For physical banks it looks like money stored in vaults with no staff access, cash in transit stored with market dye, etc etc For the non physical world I have some ideas - The entire infrastructure of IT can be rebuilt in an automated fashion and is done so in a prod-parallel equivalent at least weekly - Any chnage to "vital" files on any server is audited - err?

238 points by chair6 8y ago

> Recommendation 6: Reduce Use of Social Security Numbers as Personal Identifiers The executive branch should work with the private sector to reduce reliance on Social Security numbers. I'm disappointed this is recommendation 6, but at least it is in there. I'm also disappointed that they suggest the executive fix this problem instead of legislating a solution. Hopefully they take some action on their own recommendation!

dragontamer 8y ago
The executive branch is the proper solution. If Congress mandates a solution, then it'd be like the VHS stuff all over again. Congress writes a thingy about VHS in the 1980s, and its completely irrelevant 10 years later. (If a law states that something with VHS is done a certain way, will it apply to DVDs or BluRays when they are invented 10 years later? Or to streaming media 20 years later??) The Executive Branch is the one that actually runs the government. Legislative Branch / Congress sets policies, but shouldn't set solutions. Law goes out of date incredibly quickly. Ex: If Congress says that RSA Tokens are to be used instead of SSNs, what happens if a better invention (ex: Google Titan) comes out? Furthermore, even if Congress writes a certain policy down (ex: Two Factor Authentication is necessary to protect bank accounts), the Executive Branch is still the ones who enforce the matter. So in the case of Two Factor Authentication (legal requirement of banks to protect your bank account), the Executive Branch says that "3-personal questions + Password" counts as two-factor security in the USA. And that's why you have so many banks implementing "3-secret questions". ------------ So regardless, the job will come down to the Executive Branch.
- hannasanarion 8y ago
  Social security isn't a piece of technology, it's a government program. How is it in any way like VHS?
  - dragontamer 8y ago
    Whatever will replace SSNs will be a piece of technology. Ideally, something that uses public/private key encryption. There's a lot of things that use public/private keys however, or security tokens, or whatnot. Should it be a smartphone app? A hardware dongle? Etc. etc. If a hardware dongle, which one? As such, its the Executive Branch's job to research the various technologies, and implement a new standard to solve the online identity problem. ---------- For example, 18f (White House's crack website team) has the following: https://login.gov/ https://login.gov/ Github code here: https://github.com/18F/identity-idp https://github.com/18F/identity-idp If single-sign on were widely deployed across US Agencies (and tied to financial services / private sector banks), we'd be in a way better place. In any case, this is clearly the realm of the Executive Branch. Specifically 18f probably should continue to lead the effort, as they have been.
    - freehunter 8y ago
      All Congress has to do is pass a law saying "private companies are not allowed to store SSNs" and let those private companies figure out what the replacement is. Congress doesn't need to legislate the replacement technology.
      - dragontamer 8y ago
        That fundamentally misunderstands the problem. SSNs are fine and useful. They just shouldn't be the "password" to financial systems. When every damn bank uses "Whats your pin and SSN" to gain access to an account... that's the problem. The issue is that private companies use SSNs for security. There's nothing wrong in using SSNs as an identifier. The USA needs to start assuming that SSNs are public information, and to build security through other means. SSNs were never a secret number to be used for authentication / authorization purposes.
        tialaramex 8y ago
        > There's nothing wrong in using SSNs as an identifier. There's plenty wrong with this. SSNs were already a pretty bad identifier when they were invented and didn't get better. There's no check digit, so if you make any mistake at all it's probably a different person's valid SSN. Until relatively recently they were assigned both chronologically and geographically, so one digit error in SSN plus Address plus date of birth... Causes no red flags, it looks about right. Modern ones are randomly assigned, but it'll be decades before that's most people. Like most similar systems the US SSN also very explicitly says it isn't suitable for any purpose except numbering Social Security recipients. People you want numbers for may or may not have SSNs. Don't worry though, since they all look pretty similar and there's no check digit the people who don't have one long learned to give a bogus SSN, probably belonging to somebody else. Somebody you know probably does this today. What a useful "identifier".
- jedberg 8y ago
  The legislative solution would be to mandate a national ID with a cryptographic token, and then leave it up to the executive to define the implementation. Right now, even if they wanted to, the executive can't force a national ID.
  - dragontamer 8y ago
    > The legislative solution would be to mandate a national ID with a cryptographic token, and then leave it up to the executive to define the implementation. That's still too specific. "national ID with a cryptographic token" means that OpenID / Paypal-based single-sign on logins are illegal. Yeah, writing laws is hard as heck, and Congress is NOT the experts in the field of cryptography / login security. So Congress will get it wrong if they even tried to write the law in that manner. Executive Branch CAN hire experts (ie: 18f, NIST, etc. etc.) to define best practices. As such, the proper legislative solution would be to mandate "industry best practices of identity protection, as defined by (Insert Agency Here, maybe NIST)".
    - jonlucc 8y ago
      > "national ID with a cryptographic token" means that OpenID / Paypal-based single-sign on logins are illegal. Why? Why doesn't it just mean that there's a canonical government system that doesn't touch PayPal or OpenID that can be used for stuff that would currently be tied to your social security number?
      - dragontamer 8y ago
        PayPal touches your SSN, as it is tied to your bank account. (Bank accounts require a "Individual Taxpayer Identification Number", which is the SSN for any citizen. Non-citizens get a different ID, but really its the TIN that is the cause of all of these security issues). So yes, really, the proposed wording would probably make Paypal illegal. You have a point on OpenID, but my overall point is that OpenID would probably be sufficient for most financial transactions on today's internet. OpenID is basically equivalent to Paypal's security model. Neither Paypal nor OpenID require 2-factor or security tokens. I think they're an optional feature. But in any case, the Paypal / OpenID model of identification (Paypal controlled website verifies password, and sends a token to the 3rd party website) would be sufficient for today's security. ---------------- Of course, none of this even touches upon Equifax. Equifax uses SSNs to identify people, and often without their knowledge or consent. Equifax is a service to the financial industry, to help keep tabs on individual's history. So the Paypal model will NOT work with Equifax's use case, because the individuals don't always know when they are being tracked. Maybe it'd have to be something to OAuth's model. In any case, I'm not an expert either. I just appreciate the difficulty of this problem.
danShumway 8y ago
I would support a government initiative that deprecated social security numbers entirely. Come up with an alternative plan, give businesses some reasonable number of years to stop relying on them, and after that point they'll no longer be issued to anyone new who's born. Or if you don't want to get rid of them, treat them like public information. Give businesses X years, and then say, "past this point, we're just going to make these searchable by anyone who makes a request." They're an ID number, not a password.
- billylindeman 8y ago
  Yeah there should be some sort of government sponsored cryptographic identity system :\ I hope some of the identity verification blockchain companies succeed for this sort of thing. What we have now is laughably bad.
  - abakker 8y ago
    Government and distributed ledger seem diametric. Either the government creates a centralized identity system and is the sole authority, or, a distributed system is used to grant identity numbers. Half measures between seem more problematic. Personally, I’m fine with the government being the single source of truth for that stuff, it is kind of their raison d'être.

artursapek 8y ago

> Equifax did not see the data exfiltration because the device used to monitor ACIS network traffic had been inactive for 19 months due to an expired security certificate. On July 29, 2017, Equifax updated the expired certificate and immediately noticed suspicious web traffic. Ouch.

txcwpalpha 8y ago

> The attackers transferred this data out of the Equifax environment, unbeknownst to Equifax. Equifax did not see the data exfiltration because the device used to monitor ACIS network traffic had been inactive for 19 months due to an expired security certificate. > Equifax had allowed over 300 security certificates to expire, including 79 certificates for monitoring business critical domains. (on page 2 of the Executive Summary) I've been following the Equifax breach story but this is the first I'm hearing about the expired certificates. That is shockingly bad. I'm a little disappointed in the final "conclusion" of the report, though. The end of the executive summary basically chalks the breach up to two things: "Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure". These are valid points, but these are also issues that nearly every single major corporation in the world faces, and yet many of them still manage to prevent (or at least mitigate) major breaches. These aren't good enough reasons to explain why Equifax failed so spectacularly compared to every other bureaucratic company with legacy software. Also, I know this report isn't meant to be a remediation strategy roadmap, but it's also pretty disappointing that the recommendations section is basically just 3 pages of fluffy, vague, "X and Y should work together to increase cybersecurity" bullshit. Such a high profile incident would have been a great time for the federal government to really show some leadership (or at least strong guidance) in this realm, but they really didn't. I mean hell, at least link your recommendations to the NIST Cybersecurity Framework...

codazoda 8y ago
Can someone explain why an expired certificate, on a monitoring device, would cause the device to completely fail rather than just spit out warnings about the certificate?
- david_shaw 8y ago
  My guess is that they were using private certificates to read encrypted data, without which they couldn't inspect their traffic.
  - jacquesm 8y ago

mbesto 8y ago

> In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked on an aggressive growth strategy, leading to the acquisition of multiple companies, information technology (IT) systems, and data. While the acquisition strategy was successful for Equifax’s bottom line and stock price, this growth brought increasing complexity to Equifax’s IT systems, and expanded data security risks. > Second, Equifax’s aggressive growth strategy and accumulation of data resulted in a complex IT environment. Equifax ran a number of its most critical IT applications on custombuilt legacy systems. Both the complexity and antiquated nature of Equifax’s IT systems made IT security especially challenging. Equifax recognized the inherent security risks of operating legacy IT systems because Equifax had begun a legacy infrastructure modernization effort. This effort, however, came too late to prevent the breach. As someone who works in Tech M&A, I often tell clients "hackers go after the weakest link and you just acquired a new link". They nearly unilaterally ignore this advice and ignored hardening even the smallest of acquisitions, because well, "growth". Someday people will learn.

westmeal 8y ago
... unfortunately I don't think people are going to learn this anytime soon.
dv_dt 8y ago
If you start with the accounting assumptions that work on security is a cost, and storing of private data is not a liability then all the actions are rational within the narrow scope of profit optimization. (I'm not in agreement of this, but it seems to be true). Equifax holds these assumptions even more strongly because their fundamental existence is founded on monetization of private data.
- nawtacawp 8y ago
  This afteraction also validates breaches are not a liability, in the end their sharevalue recovered nearly immediately.
- rorykoehler 8y ago
  Data is always a liability unless it is the core component which drives value in your business (ie you are Google or Facebook).

citilife 8y ago

The report doesn't appear to mention that you could just login to their web portal with an obvious password [1]. It also doesn't appear to be under the purview to look at the leadership team selling stock[2]. Both of which it should consider when reviewing the competency and ethics of an organization managing and profiling nearly everyone in the U.S. Speaking of which... why is it only ~50% of the adult population in the U.S.? If the intruders were going around the Equifax network at will (which from the report it appears they were). We should assume 100% of the data was breached. [1] https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login-and-password-of-a-non-us-database.html https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l... [2] https://www.bloomberg.com/news/articles/2018-03-14/sec-says-former-equifax-executive-engaged-in-insider-trading https://www.bloomberg.com/news/articles/2018-03-14/sec-says-...

Twirrim 8y ago
You're making the large assumption that Equifax runs a single, global, interconnected network.
sorlon 8y ago
The report doesn't appear to mention that you could just login to their web portal with an obvious password [1]. That was a different portal and a different breach.

deleted 8y ago

[deleted]

Someone1234 8y ago

Just want to talk about Recommendation 6 (Recommendation 6: Reduce Use of Social Security Numbers as Personal Identifiers). Page 96. The recommendation is essentially "Try to convince the public and private sector to use them less." But I'd argue it is well passed time that SSNs be replaced by something fit for purpose. SSNs were never designed to be a unique form of ID, and using things like the cardboard card as further verification is almost comical. I'd like to see an aggressive alternative that uses the best of our security knowledge and then have it vetted by everyone in the security industry with a pulse. We've seen other countries try this. But most of those countries outsource it to the lowest government bidder, who hide the inner workings behind proprietary claims, and never vet the resulting proposal. Instead we need something more akin to the United States Digital Service, a publically created proposal (fully released specs) that is vetted by every academic and security expert they can find. The hardest part will be saying "no" to requirements creep. Allow certain government agencies to continue to use SSNs for now, and have the new ID "flip" into an SSN behind the scenes. Better than needing five hundred different departments to adopt the new standard before it can go live.

viraptor 8y ago
> Try to convince the public and private sector to use them less. It's gov, so they can do more. It can also be "By 202x using SSN for identification in non-SS purposes becomes illegal."

strict9 8y ago

There is so much to comment on and digest in this report, but the lifecycle of an attack diagram[1] on page 31 (figure 164) is something every software developer should burn in to memory. It is easy to fall in the trap of seeing the most miniscule of vulnerabilities and dismissing it as "no one could ever possibly utilize that as a vector, it's not critical." But that miniscule vulnerability becomes a single link in a ladder to everything in the system. Every seemingly-small vulnerability matters, like this painfully shows. [1] referenced here: https://blog.hellobloom.io/how-hard-was-the-equifax-hack-a3bae36f9e6f https://blog.hellobloom.io/how-hard-was-the-equifax-hack-a3b...

jacquesm 8y ago
That's something you keep seeing as a pattern in many hacks. It is rarely just one mistake, usually a chain of small ones, each of which doesn't look all that bad by itself.
- freehunter 8y ago
  That's why technologies like SIEMs exist. No number of humans could look at logs across all the various systems and spot anomalies within them, but a SIEM can. But only if it's turned on, ingesting data, running a useful ruleset, and crucially: only if someone is watching the output.

evolvedlight 8y ago

The most alarming part of this is that it appears that the intrusion was only discovered when the new SSL monitoring certificates were being checked to ensure that the appliance was again "on". I wonder how long it'd have taken if someone hadn't spotted something suspicious by accident at that point - I'm sure we've all spotted bugs or flaws by accident when testing a completely different feature.

yalogin 8y ago

Why is Equifax in business still? I don't get it. A company like Bear Sterns got "killed", Enron and others got litigated out. But it looks like Equifax did not face any consequences. Its high time we treat data as an asset class and regulate accordingly. Particularly personal information is acquired by every company and is treated as a valuable commodity. Companies get acquired purely for the amoutn of data they have. The market has already declared it as an asset why is it not regulated?

harryh 8y ago
Bears Sterns was acquired by JP Morgan when it was under financial duress. Enron went out of business due to losing an enormous amount of money. Neither of these things had much to do with government regulation.
- dopamean 8y ago
  You could argue that deregulation played a significant role in the fiascos that brought down both of those companies.
- yalogin 8y ago
  The analogy was that Equifax lost all of its assets and then some. It failed in the only job it had, protecting users' data, its only asset. It lost credibility and could be argued that its name became toxic. Its very similar to Bear Sterns and Enron, IMO
  - harryh 8y ago
    They didn't lose them. They still have them. They just let someone else make a copy. That didn't make the copy that Equifax still has any less valuable. Keeping that data secret isn't the only job it has. In fact that isn't even really their primary job. Their primary job is evaluating the credit worthiness of potential customers for equifax clients. As far as I know, they are still doing that job quite well.
  - g051051 8y ago

Twirrim 8y ago

>The Equifax data breach and federal customers’ use of Equifax identity validation services highlight the need for the federal government to be vigilant in mitigating cybersecurity risk in federal acquisition. The Office of Management and Budget (OMB) should continue efforts to develop a clear set of requirements for federal contractors to address increasing cybersecurity risks, particularly as it relates to handling of PII. There should be a government wide framework of cybersecurity and data security risk based requirements. From my understanding of FEDRAMP, all of the things that Equifax failed to do should be already covered. Software patching, isolation of data, audit trails etc. etc. Seems more like a massive auditing fail.

g051051 8y ago
Reading through the timeline, it shows that at every step Equifax was trying to do the right thing...internally publishing vulnerabilities, applying patches, scanning for vulnerabilities, etc. The policies and procedures were good. One difference is that previously Equifax claimed a single employee failed to scan and patch a system. I don't see a reference to that in the report. All I see now is that someone scanned a system improperly: > The scan did not identify any components utilizing an affected version of Apache Struts. Interim CSO Russ Ayres stated the scan missed identifying the vulnerability because the scan was run on the root directory, not the subdirectory where the Apache Struts was listed.

Nelkins 8y ago

Anyone got any stories of being affected by this breach?

pfranz 8y ago
The problem is identifying which breach caused your problem. Often, criminals use data from multiple breaches. Inaction on data security is actually lowering the liability for companies and pushing more responsibility onto individuals.
arduanika 8y ago
I waited in trepidation for the value of my index funds' shares in Equifax to go to zero, but it didn't end up happening. False alarm. Don't know why I got so worked up.

onetimemanytime 8y ago

>>"Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure" I feel for them (not!). BUT they shouldn't store any valuable data then. They should be not-insurable.

ne0n 8y ago

> Equifax, however, did not fully patch its systems. Equifax’s Automated Consumer Interview System (ACIS), a custom-built internet-facing consumer dispute portal developed in the 1970s, was running a version of Apache Struts containing the vulnerability. Equifax did not patch the Apache Struts software located within ACIS, leaving its systems and data exposed. 1970s? Am I reading that right? HTML wasn't even developed yet.

jstarfish 8y ago
Yes. ACIS is still a terminal-based mainframe application, but it's now fronted by a bunch of shitty Java apps that function as its API.
g051051 8y ago
Most likely they had a web front end that talks to the legacy system. Very common in big companies. It was probably developed very quickly, possibly outsourced, and just stuck in front of the older system with minimal re-engineering. Many years ago, I worked on a system that put an X Windows front end in front of a mainframe app that used a 3270 emulator to interact with parts of the legacy app. I imagine this is somewhat similar.

infodocket 8y ago

The report linked here is the House Oversight Committee (Majority) Staff Report. Another report from the committee's minority is also available. https://democrats-oversight.house.gov/sites/democrats.oversight.house.gov/files/Equifax https://democrats-oversight.house.gov/sites/democrats.oversi... Minority Report - FINAL 12-10-2018.pdf

arduanika 8y ago
Link not working for me. Try: https://democrats-oversight.house.gov/sites/democrats.oversight.house.gov/files/Equifax%20Minority%20Report%20-%20FINAL%2012-10-2018.pdf https://democrats-oversight.house.gov/sites/democrats.oversi... Key recommendations from the minority report: "Based on the investigation conducted by the Committees, four key legislative reforms proposed by Democrats would help prevent future cyberattacks: [A] hold federal financial regulatory agencies accountable for their consumer protection oversight responsibilities; [B] require federal contractors to comply with established cybersecurity standards and guidance from the National Institute of Standards and Technology (NIST); [C] establish high standards for how data breach victims should be notified; [D] and strengthen the ability of the Federal Trade Commission (FTC) to levy civil penalties for private sector violations of consumer data security requirements." On [B], they note that "Equifax was a federal contractor at the time of its data breach". On [D], they note that "In the three years before the Equifax data breach, the company spent only about 3% of its operating revenue on cybersecurity—less than the company spent on stock dividends...Civil penalties would incentivize private sector companies to prioritize and invest in continually upgrading and deploying modernized IT solutions and applying cybersecurity best practices."

loteck 8y ago

Check out how Equifax started rolling heads starting on page 50. They pinned the fact of not patching Struts on a SVP who was one of hundreds of people notified of the need to patch Struts. But he didn't forward that email, so he's toast! Now pardon me while I go route my patch management procedures through the nearest baffling and inane dependency. A senior Equifax official was terminated for failing to forward an email – an action he was not directed to do – the day before former CEO Richard Smith testified in front of Congress. This type of public relations-motivated maneuver seems gratuitous against the back drop of all the facts

cronix 8y ago

This is the equivalent to "We offer our thoughts and prayers" after a mass-shooting.

lifeisstillgood 8y ago

What does the baseline of "good enough security" look like? For physical banks it looks like money stored in vaults with no staff access, cash in transit stored with market dye, etc etc For the non physical world I have some ideas - The entire infrastructure of IT can be rebuilt in an automated fashion and is done so in a prod-parallel equivalent at least weekly - Any chnage to "vital" files on any server is audited - err?