Equifax CSO 'Retires'. Known Bug Was Left Unpatched For Nearly Five Months (marketwatch.com)

phalse phace quotes MarketWatch: Following on the heels of a story that revealed that Equifax hired a music major with no education related to technology or security as its Chief Security Officer, Equifax announced on Friday afternoon that Chief Security Officer Susan Mauldin has quit the company along with Chief Information Officer David Webb.

Chief Information Officer David Webb and Chief Security Officer Susan Mauldin retired immediately, Equifax said in a news release that did not mention either of those executives by name. Mark Rohrwasser, who had been leading Equifax's international information-technology operations since 2016, will replace Webb and Russ Ayres, a member of Equifax's IT operation, will replace Mauldin.
The company revealed Thursday that the attackers exploited Apache Struts bug CVE-2017-5638 -- "identified and disclosed by U.S. CERT in early March 2017" -- and that they believed the unauthorized access happened from May 13 through July 30, 2017.

Thus, MarketWatch reports, Equifax "admitted that the security hole that attackers used was known in March, about two months before the company believes the breach began." And even then, Equifax didn't notice (and remove the affected web applications) until July 30.

Comments

Not noticing?? That's bad

[davidwr]

I can see a company delaying patching serious bugs long enough to test it and make sure the fix isn't worse than the bug.

I can see a company treating bugs that aren't reported as being serious as non-serious.

I can see a company assessing a "serious" but and determining it's not serious in their environment and not treating it with urgency.

But that's not what happened here.

Heads deserved to roll and at least two did.

Good news everyone!

[mrsam]

The company has finally figured out how to use a random number generator, from TFA:

The company clarified that consumers placing a security freeze will be provided a randomly generated PIN.

Patching is not the only answer.

[ErikTheRed]

I have some (extremely limited) sympathy for patching "deep applicaiton infrastructure" things like Struts, because it can take quite a bit of QA to make sure that the patches don't break the application or make the problem worse. That being said, it's a top priority and companies - especially in a PCI or similar compliance environments - need to budget the time and resources to deal with issues like this, because they will pop up on a regular basis.

That being said, this problem could have been blocked without patching. First of all, an application-level proxy / API that sanity checks the types and rate of requests should have been between the public web application and the database back end. All sorts of mischief can be either stopped or at least slowed down here, and the failure to have something list this is a major architectural error. Secondly, a reverse-proxy (or load balancer) could look for attacks of this nature and block them before the get to the web server. F5's products are explicitly capable of stopping this CVE, and I'm sure some of their competitors can do it as well.

Security needs to exist in layers, because at some point people will screw up at one layer or another. That's just human nature, and it will not change until AIs take over the world and enslave us, but that's a problem for 2019.

Re:Stock sold ??

[cdreimer]

The three executives who sold stock before the data breach became public knowledge are being investigated by the SEC for insider trading. Unless they can prove that this was a "routine" sale (I.e., consistently sold shares every quarter) and the timing was coincidental, they are facing my fines and/or prison sentences.

Re:Not really

[geoskd]

As a material witness I'd rather suspect she could be issued with a subpoena by any court.

Only in a criminal case. In a civil case, unless she is directly a party to the proceedings (is a named defendant), the court will have no reason to compel her to appear, and even if it did, she would be well within her rights to refuse. As an employee of the company, the judge can order the company to produce her, and they would have to or else they would face a penalty (commonly summary judgement against them). Since the company has no way to compel a non-employee to do anything, the only way to compel her to testify is to actually name her in the suit.