4 ms·

This is the first time I'd heard anything about expired certs, too. It's absolutely ridiculous that any kind of a security team -- not to mention one that's su

This is the first time I'd heard anything about expired certs, too. It's absolutely ridiculous that any kind of a security team -- not to mention one that's supposedly safeguarding such an immense amount of data -- could let monitoring certificates expire at all. It's almost inconceivable that they could let seventy nine certificates that are required for security monitoring expire for months on-end. I've worked in security for my whole career, and I'm firmly of the optimistic belief that someday, far fewer security-minded people will be needed to keep organizations secure. This is an excellent counterpoint to my argument, though: even the people who supposedly specialize in keeping things secure can apparently be absolutely clueless.

txcwpalpha 8y ago
> It's almost inconceivable that they could let seventy nine certificates that are required for security monitoring expire for months on-end. Even worse, the "seventy nine" figure was just the certs that were associated with "critical" systems. The total number of expired certs was at least 324. > At the time of the breach, however, Equifax had allowed at least 324 of its SSL certificates to expire. Seventy-nine of the expired certificates were for devices monitoring highly business critical domains. (from pg 70 of the report)
rconti 8y ago
It's entirely possible they were monitoring cert validity, and that monitoring itself failed due to the expired certs :) We don't really know what the certs were used for (eg, whether it was needed to decrypt traffic), or just as part of the reporting... And yes, the team is responsible for keeping them valid, but... this isn't the first time that cert expiration "broke" something and left us worse off than with no SSL at all.