Was the Data Just Too Big? Inside the Equifax Hack

Inside the Equifax Hack

Equifax is a gigantic financial organization, the entire livelihood of which revolves around collecting and analyzing consumer credit data to assign credit scores. If any organization knows how to handle big data and keep it secure, that organization would be Equifax. Yet, we have the Equifax data breach that bared the personal details—including social security numbers and driver’s license numbers—of 143 million Americans. All told, Equifax is privileged with data from 820 million consumers and more than 91 million businesses worldwide.

Equifax’s overt negligence is undoubtedly reprehensible, however I think the waterfall of harsh critique also becomes unfair,” Ilia Kolochenko, CEO of High-Tech Bridge, a Swiss web security company, told USA Today.

But Mr. Kolochenko, our entire system of financial credibility and mobility is based on credit scores. You can expect a “waterfall of harsh critique” when we’re constantly being watched by a company like Equifax. Why should a company not able to look after its own books be able to penalize us for not looking after ours? Equifax’s “negligence” could call into question the credibility of the entire system. In the future, your credit score may not be your own.

Businesses today must be constantly alert for hackers who seek to compromise systems for purposes such as identity theft or extortion,” warns Villanova University. “Strengthening cyber security begins with keeping all software and hardware up to date and engaging in regular maintenance.

Yet keeping software up to date is exactly what Equifax didn’t do. In March of 2017, the Apache Foundation issued a patch for a vulnerability in Apache Struts, which is an “Open Source framework for creating enterprise-grade Java Web applications.” Equifax failed to apply the patch.

The company’s cybersecurity personnel would have had to upgrade to the latest version of Apache Struts, and there are plugins available online that provide the fix. Overall, fixing the holes that left Equifax vulnerable required a deep-dive of maintenance. The company needed to examine each network application for Vulnerabilities. Then, vulnerable applications should have been updated with the patch. Further, programmers may have had to rewrite some applications to coincide with the software already in place, then they would have had retest and redeploy the whole network.

A network as large as Equifax’s doubtlessly needs a lot of patches anywhere Java applications come into play. In Equifax’s defense, cybersecurity analysts are faced with more than a million new Malware threats each day. Daily, there are at least 20 million attacks on Government computers, and hundreds of millions more on other information systems. Equifax’s cybersecurity personnel may simply have been overwhelmed and may have missed the Apache Struts vulnerability due to the sheer amount of the threats and huge Equifax network that they must protect.

But at the end of the day, no one can make excuses for them. Jeff Williams, co-founder of Contrast Security, notes, “This is not some crazy movie-plot attack scenario. There is really no excuse for organizations not to be prepared for this totally expected scenario. They should have a well-practiced playbook and run it often.

No matter how much time it would have taken to patch Apache Struts, doing so should have been a standard priority for a company that thrives on consumer data. And the issue of timing is heightening the roar of scandal. The breach happened during the summer, but it took until September 7 for Equifax to announce. Between the time the company discovered the breach (July 29) and that of the announcement, the company’s top executives sold more than $2 million worth of Equifax shares.

You can visit www.equifaxsecurity2017.com to find out if your data may have been compromised.

If your data is compromised, you can place a security freeze on your credit by visiting the following URLs:

  • Equifax: https://help.equifax.com/s/article/ka137000000DSDjAAO/How-do-I-place-a-security-freeze-on-my-Equifax-credit-file
  • Experian: https://www.experian.com/freeze/center.html
  • Innovis: https://www.innovis.com/personal/securityFreeze
  • TransUnion: https://www.transunion.com/credit-freeze/place-credit-freeze

Alternatively, check your credit report at http://annualcreditreport.com/ (you can do this once a year for free).

By Daniel Matthews

Savvy Team

How Close Are We Getting To An Internet Hive Mind?

An Internet Hive Mind? The idea of a hive mind has been around for quite a long time in science fiction. It's also been one that has been thrown around to describe the internet or ...
Gary Bernstein

AWS General Release of Amplify Flutter

The AWS General Release of Amplify Flutter The Amazon Web Service has announced that the Amplify Flutter is now generally available in a way to help make flutter apps easier and more accessible. According to ...
Ronald van Loon

The Secrets to a Successful Desktop-as-a-Service Approach

The Secrets to a Successful Desktop-as-a-Service Approach Organizations are under pressure to reinvent their business models and adopt new technologies and digital capabilities to manage challenging conditions and adapt to new remote work scenarios. By ...
Gary Bernstein

How IoT (Internet of Things) Cloud Services Stack Up Against DIY

How IoT Cloud Services Stack Up Against DIY The ever-increasing mass adoption of IoT devices is leading to a consistent rise in the data generated through these devices. Large corporations are cashing on this opportunity ...
Darach Beirne

Take Control of Telecom by Being Your Own Carrier

Being Your Own Carrier Departments and organizations of all sizes and across all industries are transitioning away from traditional hardware IT systems and embracing SaaS-based cloud offerings. The global pandemic has spurred greater cloud adoption, ...