Was the Data Just Too Big? Inside the Equifax Hack

Inside the Equifax Hack

Equifax is a gigantic financial organization, the entire livelihood of which revolves around collecting and analyzing consumer credit data to assign credit scores. If any organization knows how to handle big data and keep it secure, that organization would be Equifax. Yet, we have the Equifax data breach that bared the personal details—including social security numbers and driver’s license numbers—of 143 million Americans. All told, Equifax is privileged with data from 820 million consumers and more than 91 million businesses worldwide.

Equifax’s overt negligence is undoubtedly reprehensible, however I think the waterfall of harsh critique also becomes unfair,” Ilia Kolochenko, CEO of High-Tech Bridge, a Swiss web security company, told USA Today.

But Mr. Kolochenko, our entire system of financial credibility and mobility is based on credit scores. You can expect a “waterfall of harsh critique” when we’re constantly being watched by a company like Equifax. Why should a company not able to look after its own books be able to penalize us for not looking after ours? Equifax’s “negligence” could call into question the credibility of the entire system. In the future, your credit score may not be your own.

Businesses today must be constantly alert for hackers who seek to compromise systems for purposes such as identity theft or extortion,” warns Villanova University. “Strengthening cyber security begins with keeping all software and hardware up to date and engaging in regular maintenance.

Yet keeping software up to date is exactly what Equifax didn’t do. In March of 2017, the Apache Foundation issued a patch for a vulnerability in Apache Struts, which is an “Open Source framework for creating enterprise-grade Java Web applications.” Equifax failed to apply the patch.

The company’s cybersecurity personnel would have had to upgrade to the latest version of Apache Struts, and there are plugins available online that provide the fix. Overall, fixing the holes that left Equifax vulnerable required a deep-dive of maintenance. The company needed to examine each network application for Vulnerabilities. Then, vulnerable applications should have been updated with the patch. Further, programmers may have had to rewrite some applications to coincide with the software already in place, then they would have had retest and redeploy the whole network.

A network as large as Equifax’s doubtlessly needs a lot of patches anywhere Java applications come into play. In Equifax’s defense, cybersecurity analysts are faced with more than a million new Malware threats each day. Daily, there are at least 20 million attacks on Government computers, and hundreds of millions more on other information systems. Equifax’s cybersecurity personnel may simply have been overwhelmed and may have missed the Apache Struts vulnerability due to the sheer amount of the threats and huge Equifax network that they must protect.

But at the end of the day, no one can make excuses for them. Jeff Williams, co-founder of Contrast Security, notes, “This is not some crazy movie-plot attack scenario. There is really no excuse for organizations not to be prepared for this totally expected scenario. They should have a well-practiced playbook and run it often.

No matter how much time it would have taken to patch Apache Struts, doing so should have been a standard priority for a company that thrives on consumer data. And the issue of timing is heightening the roar of scandal. The breach happened during the summer, but it took until September 7 for Equifax to announce. Between the time the company discovered the breach (July 29) and that of the announcement, the company’s top executives sold more than $2 million worth of Equifax shares.

You can visit www.equifaxsecurity2017.com to find out if your data may have been compromised.

If your data is compromised, you can place a security freeze on your credit by visiting the following URLs:

  • Equifax: https://help.equifax.com/s/article/ka137000000DSDjAAO/How-do-I-place-a-security-freeze-on-my-Equifax-credit-file
  • Experian: https://www.experian.com/freeze/center.html
  • Innovis: https://www.innovis.com/personal/securityFreeze
  • TransUnion: https://www.transunion.com/credit-freeze/place-credit-freeze

Alternatively, check your credit report at http://annualcreditreport.com/ (you can do this once a year for free).

By Daniel Matthews

Sangeeta Chhabra

What Accountants Should Know About The Cloud

Cloud Accounting Cloud technology has been at the top of the charts of new-age technologies for a long time now. Almost every industry in the world has started realizing its capabilities and integrating cloud strategies ...
Cloud Image Migration

The Best Web Migration Should Be Invisible to Your Customers

How you approach a migration of your assets to the AWS Cloud is important to getting it right When the British-bank TSB decided to migrate to the Amazon Web Services (AWS) cloud in 2017, they ...
Suraj Gupta

The Rise of the “Ecosystem of Ecosystems”

Ecosystems Emergence Even during these uncertain times, once fierce competitors are now collaborating and co-existing to not only survive, but thrive. Salesforce is partnering with Microsoft and AWS for better customer success. Apple is partnering ...
Kayla Matthews

7 Technology Trends to Look for in 2020

Leading Tech Trends 2020 Cloud computing has become the norm. As of 2019, 94% of IT professionals were using the cloud in some form or another. This widespread adoption means that although it was once a ...
Data Issues DBMS

Advantages of Database Management Systems (DBMS)

What Is A Database Management System (DBMS)? (Updated: 04,22,2020) A Database Management System, or DBMS, allows its users to create, read, delete and update data within a database. The management system works as an interface between ...
Mark Casey Apcela

How to Optimize Your Office 365 Performance with Network Peering

Optimize Performance with Network Peering Microsoft Office 365 usage has grown significantly in recent years. More than 56 percent of organizations all around the world now use Office 365 cloud-based services. In terms of user ...