Was the Data Just Too Big? Inside the Equifax Hack

Inside the Equifax Hack

Equifax is a gigantic financial organization, the entire livelihood of which revolves around collecting and analyzing consumer credit data to assign credit scores. If any organization knows how to handle big data and keep it secure, that organization would be Equifax. Yet, we have the Equifax data breach that bared the personal details—including social security numbers and driver’s license numbers—of 143 million Americans. All told, Equifax is privileged with data from 820 million consumers and more than 91 million businesses worldwide.

Equifax’s overt negligence is undoubtedly reprehensible, however I think the waterfall of harsh critique also becomes unfair,” Ilia Kolochenko, CEO of High-Tech Bridge, a Swiss web security company, told USA Today.

But Mr. Kolochenko, our entire system of financial credibility and mobility is based on credit scores. You can expect a “waterfall of harsh critique” when we’re constantly being watched by a company like Equifax. Why should a company not able to look after its own books be able to penalize us for not looking after ours? Equifax’s “negligence” could call into question the credibility of the entire system. In the future, your credit score may not be your own.

Businesses today must be constantly alert for hackers who seek to compromise systems for purposes such as identity theft or extortion,” warns Villanova University. “Strengthening cyber security begins with keeping all software and hardware up to date and engaging in regular maintenance.

Yet keeping software up to date is exactly what Equifax didn’t do. In March of 2017, the Apache Foundation issued a patch for a vulnerability in Apache Struts, which is an “Open Source framework for creating enterprise-grade Java Web applications.” Equifax failed to apply the patch.

The company’s cybersecurity personnel would have had to upgrade to the latest version of Apache Struts, and there are plugins available online that provide the fix. Overall, fixing the holes that left Equifax vulnerable required a deep-dive of maintenance. The company needed to examine each network application for Vulnerabilities. Then, vulnerable applications should have been updated with the patch. Further, programmers may have had to rewrite some applications to coincide with the software already in place, then they would have had retest and redeploy the whole network.

A network as large as Equifax’s doubtlessly needs a lot of patches anywhere Java applications come into play. In Equifax’s defense, cybersecurity analysts are faced with more than a million new Malware threats each day. Daily, there are at least 20 million attacks on Government computers, and hundreds of millions more on other information systems. Equifax’s cybersecurity personnel may simply have been overwhelmed and may have missed the Apache Struts vulnerability due to the sheer amount of the threats and huge Equifax network that they must protect.

But at the end of the day, no one can make excuses for them. Jeff Williams, co-founder of Contrast Security, notes, “This is not some crazy movie-plot attack scenario. There is really no excuse for organizations not to be prepared for this totally expected scenario. They should have a well-practiced playbook and run it often.

No matter how much time it would have taken to patch Apache Struts, doing so should have been a standard priority for a company that thrives on consumer data. And the issue of timing is heightening the roar of scandal. The breach happened during the summer, but it took until September 7 for Equifax to announce. Between the time the company discovered the breach (July 29) and that of the announcement, the company’s top executives sold more than $2 million worth of Equifax shares.

You can visit www.equifaxsecurity2017.com to find out if your data may have been compromised.

If your data is compromised, you can place a security freeze on your credit by visiting the following URLs:

  • Equifax: https://help.equifax.com/s/article/ka137000000DSDjAAO/How-do-I-place-a-security-freeze-on-my-Equifax-credit-file
  • Experian: https://www.experian.com/freeze/center.html
  • Innovis: https://www.innovis.com/personal/securityFreeze
  • TransUnion: https://www.transunion.com/credit-freeze/place-credit-freeze

Alternatively, check your credit report at http://annualcreditreport.com/ (you can do this once a year for free).

By Daniel Matthews

Shells.com – Your Personal Cloud Computer

Personal Cloud Computer Shells, a robust virtual desktop infrastructure, ensures better performance by enabling its users to incorporate a layer of virtualization between the control server and any device that they choose. This way, it ...

Simplifying and Streamlining Cloud Management with AI

AI Cloud Management Software with artificial intelligence capabilities layered with cloud computing can allow businesses to improve their data management, visualize insights that represent patterns in information, deliver a better customer experience, and optimize their ...

Top Four Predictions in 2020 for Unified Collaboration

Predictions in 2020 The year 2020 promises to usher in significant new developments in collaboration and communication. It’s part of an unending climb, moving higher on a logarithmic curve of progress. New technologies continue to ...

Who Should Protect Our Data?

Who Should Protect Our Data in The Cloud? You would think that cloud service providers are safe havens for your personal data – they all have a ‘security’ component embedded into their offerings and claim ...

Exposed Data From 21 Million VPN Mobile Users

Exposed Data From 21 Million VPN Mobile Users The data and credentials from 21 million mobile VPN users were found for sale last week in an internet forum. A cyber thief posted the credentials for ...

Security is Job 1: Machines vs. Machines

Digital is redefining cybercrime and cyberwarfare Cyberattacks today are multi-stage, hard to discover and highly targeted. Some security threats are accidental, stemming from unauthorized employee access. As much as 38% of attacks come from internal ...