3 ms·
>The Equifax data breach and federal customers’ use of Equifax identity validation services highlight the need for the federal government to be vigilant in miti
by Twirrim 8y ago
>The Equifax data breach and federal customers’ use of Equifax identity validation services highlight the need for the federal government to be vigilant in mitigating cybersecurity risk in federal acquisition. The Office of Management and Budget (OMB) should continue efforts to develop a clear set of requirements for federal contractors to address increasing cybersecurity risks, particularly as it relates to handling of PII. There should be a government wide framework of cybersecurity and data security risk based requirements.
From my understanding of FEDRAMP, all of the things that Equifax failed to do should be already covered. Software patching, isolation of data, audit trails etc. etc. Seems more like a massive auditing fail.
- g051051 8y agoReading through the timeline, it shows that at every step Equifax was trying to do the right thing...internally publishing vulnerabilities, applying patches, scanning for vulnerabilities, etc. The policies and procedures were good. One difference is that previously Equifax claimed a single employee failed to scan and patch a system. I don't see a reference to that in the report. All I see now is that someone scanned a system improperly: > The scan did not identify any components utilizing an affected version of Apache Struts. Interim CSO Russ Ayres stated the scan missed identifying the vulnerability because the scan was run on the root directory, not the subdirectory where the Apache Struts was listed.