Slashdot Mirror
Equifax CSO 'Retires'. Known Bug Was Left Unpatched For Nearly Five Months (marketwatch.com)
phalse phace quotes MarketWatch: Following on the heels of a story that revealed that Equifax hired a music major with no education related to technology or security as its Chief Security Officer, Equifax announced on Friday afternoon that Chief Security Officer Susan Mauldin has quit the company along with Chief Information Officer David Webb.
Chief Information Officer David Webb and Chief Security Officer Susan Mauldin retired immediately, Equifax said in a news release that did not mention either of those executives by name. Mark Rohrwasser, who had been leading Equifax's international information-technology operations since 2016, will replace Webb and Russ Ayres, a member of Equifax's IT operation, will replace Mauldin.
The company revealed Thursday that the attackers exploited Apache Struts bug CVE-2017-5638 -- "identified and disclosed by U.S. CERT in early March 2017" -- and that they believed the unauthorized access happened from May 13 through July 30, 2017.
Thus, MarketWatch reports, Equifax "admitted that the security hole that attackers used was known in March, about two months before the company believes the breach began." And even then, Equifax didn't notice (and remove the affected web applications) until July 30.
Chief Information Officer David Webb and Chief Security Officer Susan Mauldin retired immediately, Equifax said in a news release that did not mention either of those executives by name. Mark Rohrwasser, who had been leading Equifax's international information-technology operations since 2016, will replace Webb and Russ Ayres, a member of Equifax's IT operation, will replace Mauldin.
The company revealed Thursday that the attackers exploited Apache Struts bug CVE-2017-5638 -- "identified and disclosed by U.S. CERT in early March 2017" -- and that they believed the unauthorized access happened from May 13 through July 30, 2017.
Thus, MarketWatch reports, Equifax "admitted that the security hole that attackers used was known in March, about two months before the company believes the breach began." And even then, Equifax didn't notice (and remove the affected web applications) until July 30.
I can see a company delaying patching serious bugs long enough to test it and make sure the fix isn't worse than the bug.
I can see a company treating bugs that aren't reported as being serious as non-serious.
I can see a company assessing a "serious" but and determining it's not serious in their environment and not treating it with urgency.
But that's not what happened here.
Heads deserved to roll and at least two did.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The company has finally figured out how to use a random number generator, from TFA:
Blaming this on a single security flaw just shows how incompetent they are. It's your design and approach at security that's flawed to begin with.
Allowing some shiny MVC framework directly accessing a database containing millions and millions of personal records is just plain dead retarded software design. This kind of incompetency should be fined, let's start with $100 for every record that got stolen in compensation. If such an incident can instantly bankrupt you, maybe then these companies start to take their software security serious.
What will happen with the one that sold they stock before annoncement.
I have some (extremely limited) sympathy for patching "deep applicaiton infrastructure" things like Struts, because it can take quite a bit of QA to make sure that the patches don't break the application or make the problem worse. That being said, it's a top priority and companies - especially in a PCI or similar compliance environments - need to budget the time and resources to deal with issues like this, because they will pop up on a regular basis.
That being said, this problem could have been blocked without patching. First of all, an application-level proxy / API that sanity checks the types and rate of requests should have been between the public web application and the database back end. All sorts of mischief can be either stopped or at least slowed down here, and the failure to have something list this is a major architectural error. Secondly, a reverse-proxy (or load balancer) could look for attacks of this nature and block them before the get to the web server. F5's products are explicitly capable of stopping this CVE, and I'm sure some of their competitors can do it as well.
Security needs to exist in layers, because at some point people will screw up at one layer or another. That's just human nature, and it will not change until AIs take over the world and enslave us, but that's a problem for 2019.
Help save the critically endangered Blue Iguana
She's going to get her pension and benefits, which given her title, is a lot of money. Maybe even some sort of parachute.
This needs to be fully investigated, and she should probably lose all of it.
So, one year they send me two documents. One says "pci compliance". One is for data breach insurance. I do the PCI, and toss the insurance. The next year, they send me PCI compliance, and charge me for the insurance. I call, tell them no, as I don't have any hackable databases, unless you break into my office and pull out handwritten credit card numbers from each individual file. I argue with them, and they tell me that it is mandatory. I read the policy, and find it is almost useless. If I don't PCI, they charge me $20 per month "noncompliance fee". If I do, they then charge me a bit under $200 for this useless insurance anyway. Meanwhile, someone goes to the front door and walks off with the whole database ? I know interchange is a huge ripoff and is in desperate need of renovation...if Africa can move money with a dumb-phone for a lower commission rate, then V/MC/AX need to die in a fire today...but WTF ? Meanwhile, I'm stuck with paying for insurance I can't use, with a system that is not easily electronically hackable (no stored numbers anywhere..period, and I use their portal to charge HTTPS).........
A company that holds that much information should have top notch security. That includes penetration testing, penetration detection and multiple layers. Public layer should never have access to database that has that much information. There should be an internal webservice that returns filtered information information. This is 101 security!
..but were David Webb and/or Susan Mauldin amongst those execs that sold shares before the breach was made public?
Clearly, the root cause here is cat parasites that impaired judgement of the board and execs to ignore basic security practices in a trust and consumer data line of business. It is like mice getting attracted to cat urine smell, only with your financial information.
It means the all things being equal between candidates in technical knowledge
In all my years of sorting through job applications and conducting interviews, "all things being equal" has never occurred.
Instead, what does occur is that HR managers or upper management hint strongly that "won't someone rid me of this meddlesome diversity quota imbalance". The end result is that some will hire the first diversity candidate that in good light meets absolute minimum requirements, despite there being better candidates available.
FTP: "Thus, MarketWatch reports, Equifax 'admitted that the security hole that attackers used was known in March, about two months before the company believes the breach began.' And even then, Equifax didn't notice (and remove the affected web applications) until July 30."
I'll be interested to see how Equifax is punished for their lack of security in allowing the sensitive data -- not even given willingly to them -- of 143 million Americans to be stolen. Our laws in this country give slaps on the wrist to these financial services companies because they believe they're too big to fail and should be treated with kid gloves.
Even today, all mandatory data breach notification regulations are at the state level. Our do-nothing U.S. Congress has yet to require companies to report data breaches at a national level. It's simply mind blowing how we allow this to continue.
Thing is, this is what 'next quarter' corporate culture rewards - accountants and lawyers cooking books and lobbying for government handouts.
If everyone old enough to receive credit or get a job locked down their CRA files, the CRAs would go out of business.
Look for:
1. The lock down fee changing from one-off to a yearly subscription.
2. The definition of what access is allowed to a person's locked down file to be changed to allow everything but opening a new account.
If we are honest, merit was always secondary consideration. Before recent diversity at all costs push, it was connections and schmoozing that got unqualified males promoted to the top. It isn't structurally different from what is going on right now. The key difference is that today unqualified candidates mistakenly believe they can actually make decisions, while in the past they mostly worked on putting away hard liquor before lunch, and played golf all afternoon.
She retired. She wasn't fired. So she'll get to take it all with her. Once again, the ruling class (and at CSO level she's a member) take care of themselves. And once again, I sure wish we could get the working class to do the same. Hell, we can't even get the working class to agree Healthcare is a right and not a privilege.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
One would think that after suffering one of the worst breaches ever in terms of the potential damage, a company would look for fresh perspectives, and not hire the new leaders from within.
Perhaps not too many outside leaders are interested in being hired as officers on a sinking ship?
No, the ones they should have hired are the ones that want to make names for themselves for righting a sinking a ship. Some executives really are looking for a distinguishing challenge, not just a cushy offer.
The Daddy casts sleep on the Baby. The Baby resists!
to sit around waiting for these kinds of things. But you need skilled people to do it and there's only so many H1-Bs you can have work full time on one thing while three or four times a year ramping up to an 80+ hour work week. Most experienced programmers won't put up with those kinds of hours except occasionally. Once they figure out it's part of the job they leave if they can.
So you either find a way to get the indentured servants that are folks here on work visas or you pay people to sit around waiting for problems and fixing them. It's usually only $300-$500k/yr. A sizable chunk of change but still quite affordable to large companies. But saving that $300-$500k was somebody's bonus the year the decision was made.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I wondered if Equifax intended to circle the wagons, hold on to upper management, and then try to buy, bribe, or schmooze their way out of this mess via political channels. For a lesser P.R. disaster than this recent exploit, such a strategy might have worked.
But abruptly canning the CSO and CIO says three things to me:
(1) Equifax's internal auditing shows that this mess is considerably worse than what has been publicly revealed so far.
(2) The CEO has now shifted to "I have to save my own job" mode. The CSO and CIO have been thrown under the bus, and more will probably follow.
(3) Equifax is going to take it on the chin, financially speaking. Canning the CSO and CIO is a clear admission that Equifax was negligent. The lawsuits are going to increase exponentially from this point. But worse than that is the overwhelming demand by millions of consumers to freeze their credit reports. Equifax (along with Experian and Transunion) makes a lot of money selling credit information to banks so that they can offer credit cards to you. Credit freezes prevent that. Every new credit freeze is another hit on the annual bottom line. Equifax is bleeding from millions of tiny cuts, and it will only get worse.
Frankly, it couldn't happen to a more deserving bunch of guys.
At the executive level, you can assume that anyone holding that position has no actual expertise and sometimes no experience. Anyone with a CxO title is appointed to that position, and is usually well-connected on the boards of several companies. BUT -- good people in this position know they have to hire people who actually do understand the areas they're responsible for. If she wasn't capable of doing this, or was just hiring her friends for key positions, this is the result you get. I've been doing IT work in big companies for over 20 years now and have witnessed stuff like this over and over. It's a constant battle to do a good job when you have executives hiring incompetent people at the top, offshoring or outsourcing key IT functions for big kickbacks, etc. (I'm assuming that when we peel back the covers on this, the unpatched system will be a result of the IT department getting so disconnected that a simple system change takes 3 months and people on 2 different continents coordinating it.)
What I don't like about IT in general is that people can mess up badly, get fired or be allowed to "retire", then go to another company and mess things up there as well. I would love the idea of a professional organization that would ban incompetent people from working in the field after a fair finding of facts. This would really cut down on the number of slapped-together "solutions" that cause breaches like this in the long run. If my reputation were on the line, I wouldn't rush through a system design the way I'm sometimes forced to by schedules. As it is, IT people can do the equivalent of joining the French Foreign Legion and come out on the other end with a clean reputation. (For those unfamiliar, the FFL is France's overseas military force who basically accepts anyone who wants to escape their current situation and grants them a new identity in exchange for military service.)