Inside the Equifax Hack
Equifax is a gigantic financial organization, the entire livelihood of which revolves around collecting and analyzing consumer credit data to assign credit scores. If any organization knows how to handle big data and keep it secure, that organization would be Equifax. Yet, we have the Equifax data breach that bared the personal details—including social security numbers and driver’s license numbers—of 143 million Americans. All told, Equifax is privileged with data from 820 million consumers and more than 91 million businesses worldwide.
“Equifax’s overt negligence is undoubtedly reprehensible, however I think the waterfall of harsh critique also becomes unfair,” Ilia Kolochenko, CEO of High-Tech Bridge, a Swiss web security company, told USA Today.
But Mr. Kolochenko, our entire system of financial credibility and mobility is based on credit scores. You can expect a “waterfall of harsh critique” when we’re constantly being watched by a company like Equifax. Why should a company not able to look after its own books be able to penalize us for not looking after ours? Equifax’s “negligence” could call into question the credibility of the entire system. In the future, your credit score may not be your own.
“Businesses today must be constantly alert for hackers who seek to compromise systems for purposes such as identity theft or extortion,” warns Villanova University. “Strengthening cyber security begins with keeping all software and hardware up to date and engaging in regular maintenance.”
Yet keeping software up to date is exactly what Equifax didn’t do. In March of 2017, the Apache Foundation issued a patch for a vulnerability in Apache Struts, which is an “Open Source framework for creating enterprise-grade Java Web applications.” Equifax failed to apply the patch.
The company’s cybersecurity personnel would have had to upgrade to the latest version of Apache Struts, and there are plugins available online that provide the fix. Overall, fixing the holes that left Equifax vulnerable required a deep-dive of maintenance. The company needed to examine each network application for Vulnerabilities. Then, vulnerable applications should have been updated with the patch. Further, programmers may have had to rewrite some applications to coincide with the software already in place, then they would have had retest and redeploy the whole network.
A network as large as Equifax’s doubtlessly needs a lot of patches anywhere Java applications come into play. In Equifax’s defense, cybersecurity analysts are faced with more than a million new Malware threats each day. Daily, there are at least 20 million attacks on Government computers, and hundreds of millions more on other information systems. Equifax’s cybersecurity personnel may simply have been overwhelmed and may have missed the Apache Struts vulnerability due to the sheer amount of the threats and huge Equifax network that they must protect.
But at the end of the day, no one can make excuses for them. Jeff Williams, co-founder of Contrast Security, notes, “This is not some crazy movie-plot attack scenario. There is really no excuse for organizations not to be prepared for this totally expected scenario. They should have a well-practiced playbook and run it often.”
No matter how much time it would have taken to patch Apache Struts, doing so should have been a standard priority for a company that thrives on consumer data. And the issue of timing is heightening the roar of scandal. The breach happened during the summer, but it took until September 7 for Equifax to announce. Between the time the company discovered the breach (July 29) and that of the announcement, the company’s top executives sold more than $2 million worth of Equifax shares.
You can visit www.equifaxsecurity2017.com to find out if your data may have been compromised.
If your data is compromised, you can place a security freeze on your credit by visiting the following URLs:
- Equifax: https://help.equifax.com/s/article/ka137000000DSDjAAO/How-do-I-place-a-security-freeze-on-my-Equifax-credit-file
- Experian: https://www.experian.com/freeze/center.html
- Innovis: https://www.innovis.com/personal/securityFreeze
- TransUnion: https://www.transunion.com/credit-freeze/place-credit-freeze
Alternatively, check your credit report at http://annualcreditreport.com/ (you can do this once a year for free).
By Daniel Matthews
