3 ms·

Scrolling through the comments I'm surprised (and not all at the same time) no one has made a comment like this: So what? If an attacker is able to reach your

Scrolling through the comments I'm surprised (and not all at the same time) no one has made a comment like this: So what? If an attacker is able to reach your DB the ballgame at 90% of the way over already. Yes I understand that a strong U/P on the DB server would be 1 final gate but unless I'm living in some alternative reality I can tell you plenty of companies use weak/shared/guessable passwords for stuff that shouldn't be reachable from the outside like this. And honestly? Securing the DB with 1 extra (potentially useless) line of defense is an extremely low priority for most businesses.

gtsteve 7y ago
I agree it's not ideal that something so important wasn't at least only accessible by VPN but any decent IT professional knows to set a strong password like this, because it's so easy to do so - sometimes you can't just use a VPN because of historic reasons or due to the complexity of the network but you can certainly set a strong password on a database server. Assuming patched, modern database software, that should keep attackers at bay until all the failed login attempts are spotted. It's very embarrassing that they (allegedly) did not do this. Of course, note that in this case it's a custom web application so it would probably be at least more of a challenge to compromise.
jandrese 7y ago
Defense in depth is important in organizations for exactly this reason. It only takes one admin falling for a well crafted phishing email to get an insider in your network, which is why you need to design it in a way where they find a whole new set of roadblocks once they're inside. Sure they might eventually break those too, but it's time and effort and opportunity to be caught.
collinmanderson 7y ago
Right, the username/password is easy to point to as an obvious problem, but surely this wasn't the _only_ security hole the hackers had to get through, right? I can't imagine a secure database password would have prevented the hack. Though the lack of a secure database password probably hints at Equifax's attitude toward security in general.
sp332 7y ago
This is about liability. If you're not doing even the most basic things to protect other people's private data, then you can be held accountable for damages when the data is stolen.

gtsteve 7y ago

I agree it's not ideal that something so important wasn't at least only accessible by VPN but any decent IT professional knows to set a strong password like this, because it's so easy to do so - sometimes you can't just use a VPN because of historic reasons or due to the complexity of the network but you can certainly set a strong password on a database server. Assuming patched, modern database software, that should keep attackers at bay until all the failed login attempts are spotted. It's very embarrassing that they (allegedly) did not do this. Of course, note that in this case it's a custom web application so it would probably be at least more of a challenge to compromise.

jandrese 7y ago

Defense in depth is important in organizations for exactly this reason. It only takes one admin falling for a well crafted phishing email to get an insider in your network, which is why you need to design it in a way where they find a whole new set of roadblocks once they're inside. Sure they might eventually break those too, but it's time and effort and opportunity to be caught.

collinmanderson 7y ago

Right, the username/password is easy to point to as an obvious problem, but surely this wasn't the _only_ security hole the hackers had to get through, right? I can't imagine a secure database password would have prevented the hack. Though the lack of a secure database password probably hints at Equifax's attitude toward security in general.

sp332 7y ago

This is about liability. If you're not doing even the most basic things to protect other people's private data, then you can be held accountable for damages when the data is stolen.