Squabble With Contractor Delayed Equifax's Response To Data Breach (bloomberg.com)

An anonymous reader quotes Bloomberg's report on the contractor Equifax first hired to investigate their breach: Equifax and Mandiant got into a dispute just as the hackers were gaining a foothold in the company's network... Mandiant warned Equifax that its unpatched systems and misconfigured security policies could indicate major problems, a person familiar with the perspectives of both sides said. For its part, Equifax believed Mandiant had sent an undertrained team without the expertise it expected from a marquee security company...

That rift, which appears to have squelched a broader look at weaknesses in the company's security posture, looks to have given the intruders room to operate freely within the company's network for months. According to an internal analysis of the attack, the hackers had time to customize their tools to more efficiently exploit Equifax's software, and to query and analyze dozens of databases to decide which held the most valuable data. The trove they collected was so large it had to be broken up into smaller pieces to try to avoid tripping alarms as data slipped from the company's grasp through the summer... By the time they were done, the attackers had accessed dozens of sensitive databases and created more than 30 separate entry points into Equifax's computer systems.
"They may not have immediately grasped the value of their discovery, but, as the attack escalated over the following months, that first group -- known as an entry crew -- handed off to a more sophisticated team of hackers," reports Bloomberg, suggesting that the attack may have been sponsored by a nation-state.

Comments

In before a dumb turkeydance one line post

[Anonymous Coward]

There is no excuse, especially how Equifax has also mishandled just about everything after the breach was made public. Make it a $1,000 fine per person per day for not notifying them within seven days of discovering the breach. The only exception is if law enforcement requests that the breach not be disclosed to protect the integrity of an investigation.

Re: In before a dumb turkeydance one line post

[Anonymous Coward]

Can't hear you buddy, floating away on my 90 million dollar golden parachute! - Ex-CEO

Re:In before a dumb turkeydance one line post

[ShanghaiBill]

Make it a $1,000 fine per person per day for not notifying them ...

You need to get a firmer grip on reality. Equifax's net income last year was $488M. There were 143M people compromised. So even $3 per person per year would likely bankrupt them.

Re: In before a dumb turkeydance one line post

[cornjones]

If you can't do the time,don't do the crime...

Re:In before a dumb turkeydance one line post

[fuzzyfuzzyfungus]

I'm not holding my breath; but is there some reason why 'that would annihilate the company' would be considered a defect rather than a feature?

Re:In before a dumb turkeydance one line post

[ShanghaiBill]

is there some reason why 'that would annihilate the company' would be considered a defect rather than a feature?

There are currently 3 credit bureaus: Equifax, Experian, and Transunion. Going from 3 to 2 would reduce competition, and raise prices. That is not in the best interest of consumers. It is already clear that everyone directly involved in this debacle is going to lose their jobs, and Equifax will be under completely different management. So what is the point of shutting Equifax down and putting 9500 employees out of work?

Re:In before a dumb turkeydance one line post

[Anonymous Coward]

So what is the point of shutting Equifax down and putting 9500 employees out of work?

To begin the teardown of America's debt-focused economy, perhaps. I'd support that; this event calls credit bureau trustworthiness into question, so that coupled with "higher prices" for credit services means even business will trust them less.

We need this to happen if we want to get Americans out of so much debt.

Re:In before a dumb turkeydance one line post

[HornWumpus]

The credit bureaus are pretty useless, let Equifax die, break the other two into three smaller ones each. Done. Again: Too big to fail, is too big to exist.

Financial education should be taught _every_year_ in school, kindergarten to high school. If they haven't 'got it' by then, it's hopeless. Don't add it to college. Debt is a necessary tool. Try and buy a house without it. But don't be it's servant. Don't use it to buy rapidly depreciating items (e.g. cars), at least not more than once in your life.

Re:In before a dumb turkeydance one line post

[geoskd]

You need to get a firmer grip on reality. Equifax's net income last year was $488M. There were 143M people compromised. So even $3 per person per year would likely bankrupt them.

I think that was the point.

Before you try to beat the odds make sure you can survive the odds beating you - despair.com

Re:In before a dumb turkeydance one line post

[Anonymous Coward]

When the demand goes down, because there is no debt, the raw cost of housing will go down as well.
Because the option to buy with debt is gone, people trying to sell for prices only obtainable with debt will be unable to sell at all. So, in order to do so, they must lower their asking price. And this will continue until it hits amark where the asking price is reasonable to purchase without debt.

This is the case in other countries where the concept of a "mortgage" doesn't exist, and there isn't any gov't subsidy to offset the cost of the debt.
So, instead of the government (read: other citizens) helping to pay for your house via mortgage deductions, you have to foot all that cost your self.
If the availability of the mortgage is gone, then the house sellers will have to lower their asking price.
The net result, is that the "housing economy" will re-settle at a more affordable price-point going forward.
It's not "housing market collapse" but more "housing market re-balancing to the amount of money available to spend on housing".
If we allow rampant debt, and communistic policies like mortgage-interest deductions, it drives the money available in the market up, driving the housing costs up.
Remove that, and it drives the housing costs down.
Most of society will rather prefer the freedom that comes when a house is 100k again, and able to have it debt free.
And then to go on to actively be able to pursue other avenues, such as creative endeavours, experiences, or entrepreneurship.

   

Re:In before a dumb turkeydance one line post

[geoskd]

There are currently 3 credit bureaus: Equifax, Experian, and Transunion. Going from 3 to 2 would reduce competition, and raise prices. That is not in the best interest of consumers. It is already clear that everyone directly involved in this debacle is going to lose their jobs, and Equifax will be under completely different management. So what is the point of shutting Equifax down and putting 9500 employees out of work?

If this breach were to be fully exploited, two things would happen:

First, the fraud that could be perpetrated would be on the order of tens if not hundreds of billions of dollars. That would be more than the company is worth for the next 100 years. That cost would not be coming out of the CEOs pockects, but from John Q. Taxpayer like every other bailout in history.

Second, it would undermine the value of all credit check services because they all use the same information to verify identity. The result would be that no lender could actually trust that the credit applicant was actually who they said they were. The result would be countrywide meltdown of credit for individuals.

At the end of the day, letting one of the three fail would raise prices for consumers, some percentage of which would pay for better security, and you could bet your favorite genital component that the companies would take data security seriously after watching equifax get liquidated from the failure. This is what should have been done to the banks in 2009, even if it would have cost the economy. In the banks case, they should have been nationalized and the entire management structure put out of a job. Make sure that everyone (including the shareholders) who had a stake in the mess looses their shirts as a warning to others. In Equifax's case, it is simpler to just fine them out of existence.

Luckily for us, it is looking more and more like the breach was done by a foreign government. While this does present certain foreign policy problems, it is far more manageable than had the breach been done by organized crime.

Re:In before a dumb turkeydance one line post

[HiThere]

The problem with purchasing a house without debt is that rent for living space increases in cost without bounds otherwise. And when purchasing a house becomes too difficult, even with debt, the cost of rental housing explodes, even though there is a practical bound. As it has recently in many cities of the US, and probably elsewhere.

This doesn't say what the answer to that problem should be. It's merely constraints on the answer. Certainly rent-control has many well known problems, and has proven an undesirable answer...though possibly not as undesirable as arbitrarily increasing rents.

It's my suspicion that the basic problem can be traced to an exploding population combined with housing that degrades in quality quickly. This combination makes any real solution impossible, as land area within easy reach of an urban area is limited. Faster transport tends to lead to larger cites, and a denser urban core, with higher prices. Rapidly degrading housing quality tends to cause that urban core to degrade in quality, but the demand keeps prices from decreasing as the quality degrades.

Once upon a time the cities were where the rich lived, and the poor lived in the suburbs. This is because slow transport meant that it took a long time to get anywhere. I suspect that the time I was reading of was shortly after a war had destroyed much of the city and it had been freshly rebuilt. But the pressure of "commute time" remains. So you really need to factor the time spent commuting into the cost of the housing.

The only answers I've run across that were at all convincing were fictional. The idea of "archology" with elevators and escalators for rapid 3-dimensional transport has it's plausibility. But the cost wouldn't be trivial, and currently the maintenance would probably be impossible. And maintenance would be needed, or the entire thing would become unlivable. But note that the only plausible archology stories that I've read also feature an extreme degree of surveillance by the organization that runs the archology. Sometimes it's benevolent, but this is a bit dubious because people with unrestrained power don't tend to be benevolent. (Some have said it's not power that corrupts, but the lack of consequences for it's misuse. This is true, but if you have power one of the first things you will do is protect yourself against consequences for inadvertent mistakes...and that's assuming you start from an ethical and benevolent position.)

Re:In before a dumb turkeydance one line post

[HornWumpus]

No, real estate will concentrate into the hands of those with piles of money. Everybody else pays rent.

Re:In before a dumb turkeydance one line post

[Anonymous Coward]

And?

People commit crimes that bankrupt them. Why should companies get a pass?

Re:In before a dumb turkeydance one line post

[Anonymous Coward]

You need to get a firmer grip on reality. Equifax's net income last year was $488M. There were 143M people compromised. So even $3 per person per year would likely bankrupt them.

But giving one executive $90M won't?

No, the real solution is to treat white collar criminals the same way that Vietnam does.

Re:In before a dumb turkeydance one line post

[Anonymous Coward]

You mean just like it has already.

Re:In before a dumb turkeydance one line post

[Anonymous Coward]

Completely agree comrade

Re:In before a dumb turkeydance one line post

[Radiophobic]

A breach like this should bankrupt a company.

Oooops...

[Anonymous Coward]

I guess that under trained security team had their shit together and Equifax is now SCREWED!

Correct Headline:

[Known Nutter]

Squabble With Equifax Delayed Equifax's Response To Data Breach

The way the headline reads as published makes it sound as if the contractor is to blame -- which is obviously horseshit.

Re: Correct Headline:

[Anonymous Coward]

When in doubt, blame the IT guy. He doesn't have a PR firm to lie for him to the media.

Re:Correct Headline:

[Anonymous Coward]

Agreed. The sad point of this.. is Equifax didn't have their own blue team.. or even an electronic forensics team on-station. Like normal they were riding the wave of ignorance until a shark took a big bite out of their board. Their first action was to blame the first third-party blue-team that they hired.

Stupid is as stupid does (Forest Gump)

Peace out.

Re:Correct Headline:

[Anonymous Coward]

Yeah, but it's not as though contractors like Mandiant are full of skilled competent staff is it? Companies like that win contracts by bidding cheapest, but the problem is that they still want to make as massive a profit as possible, so they cut corners, they hire people who aren't even remotely competent to do the job as pointed out by Equifax.

Companies like Mandiant get away with it because they know they're making a profit, and if shit hits the fan then the company paying them has to take ultimate blame.

But that's why you're right about one thing - Equifax IS to blame too without a doubt, because we've had enough examples of paying shit and getting shit with IT subcontracting over the years that blaming cheap contractors is hardly a valid excuse anymore.

So yes, it serves Equifax right for using really shit external contractors, and yes, it's their fault for paying shit to hire shit. But that doesn't mean that if a company like Mandiant has supplied people incapable of doing the job properly because they only gave a shit about maximising profit rather than doing the security tasks properly that they were paid to do that Equifax shouldn't sue the living shit out of them.

Equifax deserves the blame, but we can't keep absolving companies like Mandiant, WiPro, InfoSys, Serco and so forth of blame just because they're "Just contractors", because they're really not. They're fucking vultures, who are paid in good faith to do a job, but then regularly grossly under-deliver, or outright fail, demanding more money to then do the job properly. Maybe if we call these companies out a bit more too on their bullshit, execs will wake up and start to listen, then bring back jobs that are actually important like security internally so that they can be done properly, as opposed to believing the clowns at various contractors are really willing to do it for a fraction of the price.

Mandiant

[Hognoxious]

Mandiant - that name rings a bell. I can't be arsed to google it, but IIRC this isn't their first clusterfuck,

Re: Mandiant

[Anonymous Coward]

It isnâ(TM)t, they basically get called every time there is a clusterfuck. Where you heard about them before was when they tracked down an APT actor to the building: https://mobile.nytimes.com/2013/02/19/technology/chinas-army-is-seen-as-tied-to-hacking-against-us.html?referer=https://www.google.com/

Re:Mandiant

[someone1234]

If a company is hired to resolve clusterfucks, it is obvious they deal with multiple ones.

"Mandiant warned Equifax"

[Gravis Zero]

Regardless of whatever they may have believed, they were warned and ignored the warnings. Sure seems like gross negligence or possibly even criminal negligence. If the system weren't corrupted, I would expect indictments. It's too bad our government doesn't function properly.

Re:"Mandiant warned Equifax"

[oldgraybeard]

So the Equifax CSO (the music composition major) didn't think the security contractor sent individuals that had the right background to do security work?
"Equifax believed Mandiant had sent an undertrained team without the expertise it expected from a marquee security company."
Odd, Maybe they could not hum the right tune ;)

I have heard people say a specific degree does not matter. Just having a degree proves you have the ability to learn and do any job. Guess Not ;)

Re:"Mandiant warned Equifax"

[dgatwood]

Odd, Maybe they could not hum the right tune ;)

And if the reports of their former security head being a music major are accurate, they were uniquely qualified to recognize when the contractors could not hum the right tune....

This sounds like standard MBA behavior. Being secure is expensive in the short term, which hurts short-term profits, which hurts the value of their options. Therefore, in their minds, it is better to factor in insecurity as a long-term risk and spend as little money as possible on it, knowing that when it crashes, they'll get new options priced at a lower price point anyway.

And this is why we have government regulations. Unbridled capitalism led by unscrupulous people would otherwise ruin us all.

Re:"Mandiant warned Equifax"

[Anonymous Coward]

ISIS has claimed responsibility. Don't believe contractor conspiracy theories on the Interwebzes. ae911truth dot org

Re:"Mandiant warned Equifax"

[Anonymous Coward]

Education is independent of intelligence. It's possible to be an educated idiot - I know a lot of them personally. It's possible to be smart and uneducated, too. The difference is that an educated smart person will far exceed an uneducated smart person in terms of success. The idiots see that educated smart people make a lot of money, and because they are unable to discern correlation from causation, they decided that going to college meant anyone could be as successful as smart educated people. When the idiots started graduating in droves and couldn't find work they were truly astonished.

Re:"Mandiant warned Equifax"

[Anonymous Coward]

... having a degree proves you have the ability to learn and do any job.

Every job requires a body of knowledge, which is why bosses want workplace experience: It means the job applicant already has that body of knowledge and uses it well enough to add value to the business. So the boss can avoid providing training, even to the point that job applicants must know how to operate a particular machine or software application. The workflow is different for every business so a new employee must learn that, regardless of experience but again, experience in that industry in that town means there is less to learn.

A degree provides foundation knowledge; a little bit about everything. So when the graduate encounters new factoid s/he knows where it belongs in the big picture. That's why knowledge-acquisition skills (and in past decades, leadership skills) are the focus of a degree, a university isn't a trade-school for office jobs. Also the graduate can start anywhere in that field (eg. IT) and start learning the 'how' instead of the 'what' and 'why'.

Back when degrees were rare, it was common for an engineering graduate to land in, for instance, the healthcare industry. In such a situation, it is obviously necessary for the new employee (and recent graduate) to learn a new body of knowledge in a hurry, on the job. Some people can do that and some people can't: Which is why the 'peter principle' exists: The upwardly mobile employee doesn't have, or can't acquire, the needed body of knowledge for the new job tasks.

Guess Not.

Her failure to do the job she was given, does not mean other graduates are similarly afflicted; unless you're willing to admit that you can't do your job.

Re:"Mandiant warned Equifax"

[Anonymous Coward]

"I thought those were just warnings!"
"They were warnings..."

Here's an idea

[Anonymous Coward]

Give companies like Equifax the corporate death penalty, which is revoking their corporate charter. Give the CEO the actual death penalty, especially when he gets $90 million to retire due to his incompetence. The laws need to change to put an end to this ridiculousness from companies like Equifax. We should be marching in the streets and engaging in civil disobedience like blocking streets until the laws change to protect the people from vile corporations like Equifax.

Serves them Right for using Acess

[filesiteguy]

Actually I have no idea what Equifax uses but it seems every time i read of these breaches they are because of a lack of communication between various internal groups. Working for a company that is often hit with DDOS or other intrusion attempts by nation-states, I know that the overriding thing to keep them out is open candid communication between staff, management, and vendors.

Also, probably shouldn't put Access databases outside teh DMZ.

Re: Serves them Right for using Acess

[Anonymous Coward]

What in the fuck are you talking about? Access databases, communication between various internal groups, and you are talking like you know about nation state threats? Piss off moron

Re:Serves them Right for using Acess

[Anonymous Coward]

Sounds like they didn't have a working DMZ. Since security is supposed to be layered maybe the inside network should have been hardened as well. Assuming your internal network is clean is a good way not to be.

Re:Serves them Right for using Acess

[Anonymous Coward]

What Access database can handle 140 million records? With a 2GB limit on the size of a database, each row would have to be 15 bytes or smaller.

Re:Serves them Right for using Acess

[HiThere]

Access? Are you talking about MSAccess?

I don't know whether they've fixed the problem, as I haven't used it in decades, but I remember it as "The database that couldn't add two number correctly". It had a bunch of other problems, but it was so convenient that I used it until I actually caught it adding two numbers together and getting the wrong answer (repeatedly, but not on every run). After that I transitioned away from it as quickly as I could. It took a lot of testing, as I couldn't believe a business database could be that bad.

Hire a music major as CIO...

[Anonymous Coward]

expect them to not grok security and put budget concerns above everything else. Our CTO has a degree is social justice, and he fired everyone that was educated in order to hide his incompetence. Plus, he fired all of the white people, and our company repeatedly lied to the state that they were fired with cause so they couldn't get unemployment.

Re:Hire a music major as CIO...

[jcr]

Some of the best engineers I've worked with have had music degrees.

-jcr

Re:Hire a music major as CIO...

[Anonymous Coward]

Why lie? Is someone paying you to spew that lie?

Re:Hire a music major as CIO...

[jcr]

What's your fucking problem?

-jcr

Re:Hire a music major as CIO...

[bernywork]

Don't feed the trolls

Re: Hire a music major as CIO...

[Anonymous Coward]

Out of curiosity, was music their only degree or did they have a bachelors in music and then got an engineering masters?

Re:Hire a music major as CIO...

[ichimunki]

I've got a Fine Art degree and 15+ years working as a developer. The worst code I've ever seen was from a CSci grad with the job title "systems architect" (my guess is he got that title to get around normal pay range issues with being an "engineer"). Just the crappiest garbage I've ever seen. Normally the worst I see from CSci types is a tendency to over-engineer, which counterpoints the tendency of others to use copy/paste or bizarre workarounds to issues they don't understand because they lack the CSci chops. And unless I'm missing something, organizational management isn't taught at all during a regular Csci program, so the assumption that CSci degree holders should manage technical groups seems rather flawed to me.

Re: Hire a music major as CIO...

[jcr]

One of them has composition and conducting degrees from Juliard, and a BA in computer science from Rutgers. One of my early mentors was an organist, with a music degree from some very small college whose name I don't recall, and he leaned what he knew about writing code entirely on the job.

-jcr

Re:Hire a music major as CIO...

[jcr]

The worst code I've ever seen came from some clown I never met, no idea what his schooling was. There was some really strange shit in his code, like declaring a global array of a hundred ints called "constants", filling it with the values from 0 to 99, and then using "constants[whatever]" anytime he needed a constant value in the code.

I asked my customer what happened to the guy (he was long gone by the time I got there), and found out that he'd been shitcanned for getting drunk at the office christmas party and punching a girl out.

-jcr

nation state actors

[Anonymous Coward]

whoa whoa whoa, So a foreign power now has access to the credit records of the entire country? We need to stop dicking around and bring in the NSA.
This is in their mandate.

Re: nation state actors

[Anonymous Coward]

Wrong. Completely wrong. They don't handle this type of thing at all.

But they should. It doesn't take a genius to figure out that economic sabotage has been a primary route of attack against the USA for quite some time now. It's the long con game and we're now starting to see the effects of ignoring it for so... long.

Doesn't sound like a Squabble to me

[rsilvergun]

sounds like Equifax didn't like what it heard so it disregarded their consultant's advise.

Re:Doesn't sound like a Squabble to me

[Cederic]

No, it sounds like Mandiant went, "You're insecure" and Equifax went, "No shit. Now tell us how to resolve that insecurity at reasonable expense. Stop sending us shitty consultants that know how to read the output of a Qualys scan."

Equifax should have been more secure, but isn't that what Mandiant were there to actually help with?

Re: Doesn't sound like a Squabble to me

[Anonymous Coward]

Yeah Sure. That makes Sense based on the information we have. Not.

Re:Doesn't sound like a Squabble to me

[Anonymous Coward]

And yet Equifax still carried on operating with known vulnerabilities for MONTHS.

If they weren't happy with Mandiant then they should have gone elsewhere instead of burying their heads up their collective arses.

This farce just keeps getting better everyday, just when you think Equifax couldn't be more incompetant stuff like this pops up.

Re:Doesn't sound like a Squabble to me

[Anonymous Coward]

No. It would have been utterly retarded of Mandiant to accept work on such a vulnerable system that was already being hacked.
They would have then had to prove that the hack started before they came on an that they weren't responsible and bla bla bla.
All in all it would have been terrible for their reputation to have their client hacked while working on the system.

Re:Doesn't sound like a Squabble to me

[Bert64]

It depends on the scope of the engagement...
Were mandiant hired to just perform a vulnerability scan? or a more detailed assessment? how limited was their scope?
Without knowing exactly what mandiant were hired to do, its impossible to determine if they were incompetent or not.

Re: Here's another idea

[Anonymous Coward]

Take care of yourself and be educated about the world.

There are three companies with the exact same info on you.

Ever heard the old joke about the three guys on a safari that piss off a lion? One guy says âoeshit weâ(TM)re deadâ, one guy says âoemaybe we can outrun itâ, and the last guy says âoeI just have to outrun one of youâ.

Thatâ(TM)s this situation. One was always going to be the slowest to run from the lion and it happened to be Equifax. So what? It was going to happen... freeze your credit except for when you need it, take the effort to pull a report from one of the three every four months (which is free), use a password manager and enable multi factor auth in your primary email.

Donâ(TM)t trust others to take care of you. Take care of yourself.

ah an attack by a nation state

[Anonymous Coward]

because a corporation that couldnt manage basic security - can not be attacked and brought law by common hackers even if they are given enough time and room to bring in specialists.

Re:Correct Headline - Nailed it!

[Anonymous Coward]

Sounds like the "undertrained team without the expertise it expected" nailed it. Described a potential problem, how to fix said problem. Rather then act on the information provided equifax said they knew better and asked for a "better team' that would do as they were told.

With hindsight .... oh wait.

All of which misses the MAIN POINT

[Anonymous Coward]

Who the hell gave these freaks the right to have the personal info on millions of Americans???

Did YOU say that they could have YOUR personal info?

Did your parents? Did your kids? Did your neighbors or co-workers?

Who gave them the gun and let them load it and then get drunk and start shooting?

Re:All of which misses the MAIN POINT

[jcr]

Who the hell gave these freaks the right to have the personal info on millions of Americans???

The millions of Americans who told them their personal info.

-jcr

Re:All of which misses the MAIN POINT

[TigerPlish]

Um, no.

We didn't give Equifax our info. We gave our info to banks, lenders, stores. They in turn gave our info to Equifax.

It may seem like a minor point, but there it is -- We the People usually don't give the credit bureaus our info directly.... unless it's in the guise of "free credit reports!!!OMG!ZOMG!" in which case then we did.

Re:All of which misses the MAIN POINT

[jcr]

And when you give that info up to your bank, you give your consent to them sharing it with the equifaxes of the world. If you don't believe me, go look up the paperwork that you got when you last opened any kind of account.

-jcr

Re:All of which misses the MAIN POINT

[Anonymous Brave Guy]

And when you give that info up to your bank, you give your consent to them sharing it with the equifaxes of the world.

This is a very weak argument. Consent without a viable alternative isn't really consent at all.

Re:All of which misses the MAIN POINT

[Known Nutter]

But there is a viable alternative: Do not use services offered where you are required to give objectionable consent.

Re:All of which misses the MAIN POINT

[Anonymous Brave Guy]

It isn't viable to function as a normal member of any Western society I know about without access to basic financial facilities like a bank account. In fact, it's caused so many problems for those unlucky enough to fall through the gaps here in the UK that the government had to step in and promote the provision of basic bank accounts that might not have any sort of credit facilities but at least provided enough basic services for someone to do things like receiving pay from an employer or settling household bills.

Re:All of which misses the MAIN POINT

[Anonymous Coward]

In the U.S. is so bad that you can't even rent a place to live if you are not in the credit system.
It's not even about borrowing money. From the point of view of a property management company they consider a lease as equivalent to lending money. That means if you don't have established credit they won't rent to you.
I had to cosign to get an apartment complex to rent to my employed twenty-something son because he didn't have credit. What would he have done if I hadn't been willing to do that?
So no, there is no viable alternative.

CEO covered up breach for 6 months

[bongey]

"The investigation in March was described internally as "a top-secret project" and one that Smith was overseeing personally, according to one person with direct knowledge of the matter."
WTF? CEO was trying to cover-up the breach, instead of being a real leader and shutting down equifax until it was fixed, he let hackers just slowly take the data over 6 months. .

Government is at fault.

[Anonymous Coward]

The government regulations that stifle the industry and make it hard to do business is the real cause here. As usual, all government is bad government. We need to deregulate the industry so that the free market can fix this problem once and for all. Guaranteed.

Leadership is top down and bottom up

[bernywork]

There's two issues here. The CEO didn't insist on security, so either he's naive or mis-informed. Either is bad.

The CTO didn't insist or wasn't given budget for appropriate security measures. Either is bad.

The CEO wasn't managing the CTO in regards to requirements, and the CTO wasn't managing up the requirements.

When you look at BoA where security is king; they'd rather have a production outage, break something and then scream at the vendor to fix it, than lose customer data. A customer facing production outage costs them a lot less than the loss of customer data, where they're concerned the whole company could go to the wall.

This is a management fuck up, of the highest order. This was business risk 101 and they failed to identify it, quantify it and migitate it.

Mandiant may not have sent their A team, but from the sounds of things their C team would have been enough to start to deal with their issues. Unpatched systems, c'mon are we still in high school?

Re:Leadership is top down and bottom up

[Todd Knarr]

They probably did quantify the risk. In terms of it's effect on their revenue, of course, since that's what's at risk for them. And that risk is close to zero, since consumers can't block reporting of their data to Equifax and there are only 2 competitors Equifax has to worry about and the majority of them already use all 3 bureaus. So why expend money mitigating something that poses negligible risk to your business? It poses no risk to the executives either, their future income doesn't depend on Equifax continuing in business. At worst they'll collect a hefty severance package and spend a few weeks relaxing until they get picked up at another company. This is what I refer to as the difference between a businessman and an MBA: the businessman's livelihood is at stake, whereas the MBA is just a glorified W-2 employee.

Risk to consumers? Equifax doesn't do business with consumers, why would anything that happens to those consumers bother it? At most Equifax will spend a few years arguing with regulators and maybe some fines will be levied, but odds on the cost of the fines will be less than the cost of good security. More likely they'll be able to claim they were following all the recommended practices (shoddy as those are) and it's Apache's fault for having left the bug in the version of Struts in question, which (especially given the current administration) will be enough for them to skate even though everybody reasonable knows it's BS.

Re:Leadership is top down and bottom up

[Anonymous Brave Guy]

And that risk is close to zero, since consumers can't block reporting of their data to Equifax and there are only 2 competitors Equifax has to worry about and the majority of them already use all 3 bureaus.

As a general point of interest, that situation might change next year for consumers within the EU, when new and very heavy-handed data protection regulations come into force. Those regulations have been very transparently aimed at big data hoarders like Google and Facebook, but I can't immediately see why they wouldn't hit the likes of Equifax and the other credit reference agencies just as hard. Since there were reportedly a large (though not as large) number of EU citizens affected by the leaks here as well, under the incoming regime it looks like Equifax could have been on the hook for a significant percentage of its total annual revenues in penalties for something like this. I believe the credit system works somewhat differently in the US from over here as well, so having no or a limited credit history with the agencies isn't likely to be as crippling for your personal financial situation as it seems to be for our friends across the pond.

Re:Leadership is top down and bottom up

[Anonymous Coward]

gack - how much budget do you need to patch an open source framework that's a java library available through a package manager like maven?

More...

[Anonymous Coward]

BULLSHIT!

fuck this shit

[Anonymous Coward]

nation state source will divert equifux's responsibility.

Burn equifux with extreme prejudice and take every penny from every exec. These mother fuckers deserve to be homeless as I'm positive they are responsible for many of those.

Marquee Security Company

[phantomfive]

Mandiant had sent an undertrained team without the expertise it expected from a marquee security company...

No, that is exactly the level of competence I expect from a 'marquee security company,' specially several years after they've been bought out by a large corp.

You'd expect about the same level of quality that you'd get from a development team at Oracle.

Re:Marquee Security Company

[Anonymous Coward]

It sounds in tents to me.

Equifax = Hillary

[Anonymous Coward]

Are they just going to blame everybody else?

It seems like they are in the process of trying to figure out which people to place the blame on. Once they have figured out which bits are the bad bits, they will cut them off and pretend they are clean again. Every institution that goes through a scandal does this.

Step 1: Suffer from bad code.
Step 2: Blame the hardware instead of the software (Obviously it's not the code since I know I'm perfect).
Step 3: Replace the hardware you decided to blame and pretend the problem is fixed.
Step 4: Run the same shitty code.

You are not Equifax's Customer

[FeelGood314]

Security is only an expense for them. Losing data they have on people doesn't affect their business. Hell the data only needs to be accurate 90% of the time for them to make a profit. Don't be surprised by this. Equifax is acting completely rationally. If you really cared maybe we should have an organization that is run by the public to do things that can't efficiently by private companies because their motivations don't align with how they are paid. I suggest we give this organization a cool name like "government".

Re: You are not Equifax's Customer

[Anonymous Coward]

Yeah. Didnt the gobbermint Just recently lose all their own personell records to a Cyber attack ?

Face IT, US Computers and Software are unfixably BROKEN.

Re:You are not Equifax's Customer

[Anonymous Coward]

You propose that Donald Trump solves this problem?

Equixpertise

[elrous0]

Equifax believed Mandiant had sent an undertrained team without the expertise it expected from a marquee security company.

So I guess they weren't as well-qualified as the music major you hired as your chief security officer?

Re:Equixpertise

[Anonymous Coward]

I'll bet they believed Mandiant was a qualified trained team when they selected the lowest negotiated price from a cadre of competing bids. You can't delegate responsibility. Equifax picked them, it was Equifax's fault.

In fact, Equifax's efforts to divert blame are proof (in my eyes) that they are an inherently untrustworthy company. Feeling guilty is a good indicator of trustworthiness. Equifax keeps acting like they did nothing wrong, it was "someone else."

Re:Equixpertise

[Anonymous Coward]

So, er, what happened to Slashdot?

The story about the CSO being a music major was filled with support for her.

Yet now we're getting snide remarks about that in every Equifax story. And it gets modded up too...

YOU are the guy who did????

[Anonymous Coward]

I have personally never met anybody who signed a contract with TRW, Equifax, etc authorizing them to spy and monitor and store.

You must be the singular idiot who did slap his John Hancock onto a contract with these evil companies telling them they could data mine and monitor you for your entire life, selling everything they learned to the highest bidder and potentially ruining your chances of buying a home or getting a job.

Thanks a lot, dude.

Irrelevant

[Anonymous Coward]

This is completely irrelevant.

It doesn't matter who is at fault, Equifax is ultimately responsible.

You'd be surprised ...

[jfgob]

... or possibly not how unbelievably common this is. And most of the time, in my experience, the management is not even aware of the issues. The last security assessment I did were shot down as "unpractical and impossible to execute on" by the IT managers or directors. Simply because it started with "take XXX days to level all systems to a known updated state" along with the report from a vulnerability scanner. These IT managers/directors were actually the ones saying "if I go to my management with this proposal, I will lose my job", not the top management itself, happily thinking that everything was hunky-dory. My experience is that many CTOs do not like telling their CEO "we need to talk" or "we need to fix up things and that involves changing the way people think too."

Re:You'd be surprised ...

[Anonymous Coward]

I found a gaping security flaw in the software of the company I used to work for. It was enterprise time and attendance software, and the flaw was that the password to the central database was stored in plaintext on every client PC. Any person on the network could edit their IN and OUT times directly in the server's database without triggering any alarms or audit trails. I was told "nobody's going to find that." So I wrote a little shell script that punched me in and out at a random time plus or minus three minutes from the times I was supposed to do so and I could come and go from work as I pleased and never had to worry. I was there even when I called in sick :) Of course I spoofed my boss' MAC for those edits just in case they did do an audit.

So?

[Opportunist]

Still no reason to let Equifax continue to exist.

Re:Correct Headline - Nailed it!

[Cederic]

Described a potential problem, how to fix said problem. Rather then act on the information provided equifax said they knew better and asked for a "better team' that would do as they were told.

It's fucking easy to walk into a company the size of Equifax, run a vulnerability scan or three, and go, "You have unpatched vulnerabilities! You need to patch all these systems!!"

What I want from a professional security firm is a fuck of a lot more. E.g., how do I keep those systems sufficiently secure and manage those security risks without investing half a billion dollars into my IT estate, making half my product line unprofitable.

Any cunt can spot the issues, I'm not surprised Equifax were seeking actual security expertise on how to manage and deal with them.

Re: Here's another idea

[tomhath]

Ever heard the old joke about the three guys on a safari that piss off a lion?

First guys says "We're all dead". Second guy says "I only need to outrun one of you". Third guy takes his walking stick and cracks the second guy in the knee.

In Equifax's case, the CEO, CIO and CSO left the company and took their parachutes to the bank. Not their problem anymore.

Tired of the sponsored by a nation-state excuse.

[CptLoRes]

Why is that whenever a hack turns out to be even remotely complicated, it suddenly it has to be "sponsored by some state" or whatever? This makes no sense. Nobody is more motivated to learn and use the latest techniques then people doing this for fun and sports. Especially if it can be coupled with some personal vendetta or political view to keep the fire alive.

Re:Correct Headline - Nailed it!

[Anonymous Coward]

Any cunt can spot the issues

Apparently not the cunts at Equifax.

Re:Correct Headline - Nailed it!

[DarkOx]

Incident response, vulnerability scanning, and pen-testing are all different things.

Vuln scans as you describe are a useful service if your organization does not have the resources perform them, and consume the resulting data. Equifax sized organizations should have an internal security that are able to do that. If the hired Mandiant to do it; that indicates a defective security organization right there. A vulnerability scan is a bottom drawer service that is generally sold to small shops and shops that are aware they have seriously immature security posture.

Its not possible to make much in the way of recommendations based on a vulnerability scan. A systemic pentest will usually reveal things hey your admins are doing web surfing and e-mail reading with accounts that map to uid-0! It will let you make some intelligent recommendations to isolate compromises, limit lateral movement, and prevent large data leaks; maybe without investing half a billion dollars.

  With a vulnerability scan all you get is "hey all this software is unpatched with published CVEs and POCs." Other than prioritizing mitigation there is little you can say as a security professional other than patch it or update it. You don't have the information needed to diagnose or offer intelligent advice on other issues.

So what happened here. Did Mandiant show up and do a VS when Equifax hired them to do incident response? Did Mandiant's sales team sell them wrong service? Did Equifax cheap out and buy the bottom draw offering, despite it not meeting their needs against advice? Who knows!

The reality of the InfoSec consulting industry is its extremely immature. The sales folks don't understand what they are selling, the customers don't know what they need, the practitioners bias very young, they tend to have the technical know how but not the communications experience. The also lack the industry experience to know how to get from point A to point B organizationally. They know what a well run textbook program looks like but they don't know how to manage people and which changes to try and make first.

It always comes down to money

[Monoman]

Security done correctly is expensive and management hates that. They also hate things they do not understand so security so when somebody tells them they need to spend money on something expensive that they don't understand they resist. They hire people that understand security to take care of it but they rarely give them the real resources and backing they need to do things properly.

Compliance standards help some but the trend I've been seeing is that compliance is merely a checkbox for management and their defined maximum. Whereas, security professionals often see compliance as a minimum.

Security is a hot topic right now and the industry is doing well. Management thinks they are being taken advantage of and to some extent they are but only because security has been largely ignored.

NOT

[Anonymous Coward]

For me IT Looks AS if mandiant did a proper Job, but the Equifax losers wanted a magic pixidust Security solution. One which was cheap instead of correct.

Re:NOT

[HornWumpus]

As far as they went. They found the vulns. It's not clear if they had anyone on team experienced enough to see the syptoms (live systems unpatched for months) then diagnose the cultural problem and pass that information, loudly and clearly, to the level it needed to get in Equifax (the Board via the CEO, on the record).

Based on my experience with corporate 'contractors' (been one), they put their results through channels. Which is just as good as burning them as far as results go, covers ass though.

As this matures, we'll eventually get to the point where there's something like a structural engineer ticket for network security. Won't be for decades. The 'responsible professional person' model can work.

No, it didn't

[DaMattster]

Hubris, ego, and ass covering are responsible for the delay. The head shed was concerned about its own collective assess and jobs.

Re:Correct Headline - Nailed it!

[Cederic]

So what happened here. Did Mandiant show up and do a VS when Equifax hired them to do incident response? Did Mandiant's sales team sell them wrong service? Did Equifax cheap out and buy the bottom draw offering, despite it not meeting their needs against advice? Who knows!

Well, exactly. This is why I'm reluctant to make too many assumptions here.

It's very possible that Mandiant were completely shit.
It's equally possible that Mandiant were pragmatic, insightful, informed and informative, and Equifax were incapable of understanding this.

They know what a well run textbook program looks like but they don't know how to manage people and which changes to try and make first.

Worse, there are no right answers. The business benefit of not having a data breach is extremely hard to give a line-item on the balance sheet but the prevention costs are very apparent in the P&L. So how and where to prioritise the resources available is a properly difficult business decision for which you'll get no thanks from anybody.

Problems

[Anonymous Coward]

When your under the gun to meet the numbers, it's amazing how many "problems" you can find in a customer's system. Selling unnecessary "solutions" is a great way to boost commissions.

It's buyer beware in this industry.

Re:Problems

[chihowa]

If you start out with the implication that "take XXX days to level all systems to a known updated state" is an "unnecessary solution", then we all have a better idea of why the state of the industry is such a clusterfuck.

Re:Problems

[HornWumpus]

It's a short sighted, non-solution anyhow.

If your systems aren't being consistently patched, it's because patching is not a priority. The update 'test and deploy' teams is understaffed (likely headcount 0).

Freezing everything and patching like crazy for a few days is likely break things, giving MBAs exactly the wrong data. (Think of MBAs as really buggy, flakey machine learning algorithms. You have to curate what they 'learn'.),

In six months you'll be right back where you started, unless staffing and responsibilities are changed.

Re:Problems

[HiThere]

That may be so, but if you don't start with the system in a known state, any further efforts are possibly worthless. You can't be sure that they're worthless, but you can't be sure that they aren't.

Back in the old days the solution was to set up a duplicate system, update it, test it, and then switch to it. That doesn't work for a highly interactive system. So all that's left as possible is to pick a decent time, say 11PM EST on a Friday, and take the entire system down for "scheduled maintenance". Back it up. Fix everything you know is wrong, test it, back it up again, and then bring it back up. Then, with a system starting from a known state that's as good as can be managed, then you address the more permanent problems. But you need management solidly behind you to do that kind of thing.

Re:Problems

[HornWumpus]

We know how to patch systems. That's not the issue. The issue is systems _not_ getting patched, which is pure culture/priorities.

Until you fix the issue, running around patching will always be playing catch up.

Known state? Again, not much point of getting to a known patched state if you know it will just be ignored after.

Also 'Known patched state' isn't easy, especially in a culture where no one is responsible (and has the time). You'll be finding additional servers upto the last minute of the patch process, perhaps after. Big companies can make big messes.

Re:Problems

[HiThere]

I think the problem is a net of systems. Think of it as a problem in concurrent programming. If you don't know the state of the system, you can't really fix it. Often systems known to be infected need to be recovered from backup. This system sounds as if they didn't *have* any reliable backups.

You are right that it's a matter of culture/priorities, which is why I said things like "you need strong management support". But for anything to work you need to START from a known state.

Re:Problems

[HornWumpus]

Getting to a known state for a moment in time is exactly useless.

Even the 'good end state' isn't having every system patched instantly.

If a system is in a truly unknown state, it needs to be rebuilt from the ground up anyhow. You don't know what's in there.

Sounds like more FUD

[Anonymous Coward]

FUD 1: Sure, our execs ended up on easy street, but we are going to investigate that ourselves, so don't worry.

FUD 2: It can't be us, we had a problem with an outside contractor we used for security.

Can't wait for #3.

So Equifax is doubly guilty

[jenningsthecat]

Not only did they know about the breach long before they told anybody, they knew about the likelihood of a breach at a time when they might have drastically curtailed the damage of the one that was already in progress. All while they were arguing the equivalent of how many angels can dance on the head of a pin. Such is corporate hubris.

Re:Correct Headline - Nailed it!

[DarkOx]

The business benefit of not having a data breach is extremely hard to give a line-item on the balance sheet but the prevention costs are very apparent in the P&L.

I could not agree with that more. How much should you spend on security specific efforts well many would argue: X = risk probability * cost of a breach

I think its actually the case an organization like Equifax probably has actually not invested to much in security. All the costs they have really incurred have mostly to do with dumb mistakes after the breach. Had they literally said and done nothing at all. What if when asked about it all the did was say "yup looks like, we are trying make sure it does not happen again, no further comment." Suppose they did not offer credit monitoring or freezes. Suppose they did not setup that stupid site to see if your info was leaked that did not even work? Suppose the CxOs had not been dumb and triggered a likely SEC investigation with their stock sales. What would have happened?

I would suggest most civil suits against them would fail, nobody can show direct harm. Even someone had their identity stolen right after the breach its pretty easy to show the information need to do that could have easily come from elsewhere. Consumers have essentially no recourse against them. Customers (lenders) have little real reason to care, what laws would they have broken for government to go after them on, none that I am aware of. If any regulation results from this, it will hit their competitors equally..

I am not sure this breach had to cost them much of anything. I really think almost all the price tag associated with this is missteps in the response.

Re:Correct Headline - Nailed it!

[Cederic]

I'd suggest waiting until their next financial announcement and admiring the trend in quarterly revenues.

The real price isn't the reparation costs, it's the reputational one. Equifax rely on other people's data and if that dries up because they're not trusted with it, the competition are eager to step in.

Re:Correct Headline - Nailed it!

[LifesABeach]

Lets see if I understand this. Equifax hires a company to check its security stuff.
Company: "ya, you've got problems."
Equifax: "fix'em."
Company: "lets talk price."
Equifax: "your not as good as we thought."
Company: "not for free? Yup."

Re:Correct Headline - Nailed it!

[LifesABeach]

Nobody knows anything; ya, got it. A company like Equifax doesn't do security checking by an outside source without a reason. Equifax's existence is based on good security, but now they need help? I question why are there 3 known upper management types that shorted their stocks when all this squabbling was going on. To many unknowns by folks who's job it is to know.

I'm buying Futures in micro wave popcorn, this looks good.

Re:Correct Headline - Nailed it!

[LifesABeach]

Repeal the 17th Amendment TODAY! That's funny.

Re:Correct Headline - Nailed it!

[LifesABeach]

3 known exec's didn't, that's says something.

Re: Here's another idea

[LifesABeach]

I've heard a lot about "block chaining." Could the Equifax event usher in a new business model for credit reporting?

Re:Correct Headline - Nailed it!

[geoskd]

I could not agree with that more. How much should you spend on security specific efforts well many would argue: X = risk probability * cost of a breach

In most cases, the company never pays the full cost of a breach because their customer are the victims, not them. The only way to ensure that this calculus is done correctly is to ensure that the company bears at least the true cost of the breach. The most effective way to do this is through fines that meet or exceed the actual cost of the failure. The problem with regulations in the United states, is not that they exist, but that they are not properly sized for the actual behavior they are there to prevent. Fines resulting from regulation must potentially be large enough to bankrupt a company if the violation is egregious enough. If they are not, then by definition they are not performing their intended function in society.

Re:Correct Headline - Nailed it!

[HiThere]

It's totally off-topic, but it does have some merit. The 17 amendment is one of the steps that limited the power of the states and increased the centralized power of the Federal Government. It's plausible that it was a mistake, though it was intended to address real existing problems. And the problems that it caused is one of the things making me hesitant to support efforts to remove the electoral college. I can see the clear problems that it causes, but what I can't see is the problems it prevents.

Re:Correct Headline - Nailed it!

[HiThere]

It's not *just* that they aren't adequately staffed and funded, though that is also true. Regulatory capture is an even worse problem. No regulator should be allowed to accept any remuneration from those they regulate, not even after they retire from the body. And I mean not allowed to accept *ANY* remuneration. No jobs. No dinners. No speaking fees. No consultant arrangements. No discounted apartments. No payments for stock owned. NOTHING. And not just while regulating, but also afterwards. (If they own stocks or bonds then they better sell it before they take the job as regulator, because afterwards they are allowed neither to collect dividends nor to sell it.)

Being a regulator should entail a final and permanent severance of all connections with those regulated. If the regulatee is the spouse of the regulated, this should not only require a divorce, it should require that they never henceforth exchange any communications. Not even through intermediates...such as children. So in that case don't take the job.

Re:Tired of the sponsored by a nation-state excuse

[HiThere]

That isn't even what they said. What they said was "When the hack turned out to be unexpectedly valuable, they turned it over to a more skilled group", and that *this* indicated it was a nation-state.

To me that sounds like they found something valuable and sold it to someone else...who might have been a nation-state. Why not, they have deeper pockets than most.

Re:Correct Headline - Nailed it!

[wwphx]

Amusingly, I ran in to almost this exact scenario last month. A former co-worker went to her doctor, her doctor's practice had just been slammed by TWO ransomware hits. Their server was totally screwed. She gave them my name, I contacted them the next day. They never asked my price, I only charged them $30 an hour for 15 hours over two days, didn't even charge them for the time it took to put together a four page report describing what happened to them and the additional steps they needed to take.

They decided they didn't need my further services the next week or since.

When I lived in the Big City, my consulting rate was $50-125, and that was over a decade ago. But here, wages are horribly suppressed, and then people wonder why there's no good talent in the area. I'll discount my services depending on what I'm doing and how charitable I'm feeling, but no, I do not work for free.

They were running Windows Server 2008 R2 and unpatched SQL Server 2008 R2 with a CenturyLink-provided DSL router without an external firewall appliance, so it was pretty much child's play for the malware to root the server. Among the things that I was going to do the next week was inspect the 18 PCs (running Win 7 Home to Win 10 Pro -- but no domain model: it was all one big workgroup) with a bootable CD, but apparently they're happy with what they'll have. It would've been interesting to see what was lurking there. I wonder who is going to configure their brand-new Cisco firewall: I offered to help them find someone qualified to do it as it's outside of my area of expertise, haven't heard word one.

Why don't these companies encrypt the data?

[CyclistOne]

As a lay person I would like to ask the technical readers here: why don't companies with sensitive data encrypt the data in the databases and only decrypt it for processing? Wouldn't that make these thefts of data pointless?

Re:Correct Headline - Nailed it!

[Anonymous Coward]

What I want from a professional security firm is a fuck of a lot more. E.g., how do I keep those systems sufficiently secure and manage those security risks without investing half a billion dollars into my IT estate, making half my product line unprofitable.

The going rate for EIS IA solutions services in flyover country is $150-250 per hour per team member plus expenses. It would take 4-6 weeks, typically. Just the proposal and business analysis will take up several days for a company the size of Equifax. The total bill just for a report and associated presentation would be about 65-85k for a minimal, hands-off analysis. That would include pricey upper-level IR/DR/BC plan creation, either with the current setup or an expected implementation. The equipment, software, personnel, and implementation costs can't really be guessed at and all depend on the corporate risk tolerance culture.

Are you willing to pay what a professional costs? Many are not.

Major aside she's not a hacker.

[Anonymous Coward]

Yeah and it's unusual enough that you remember it to this day. Usually the music degree security guru has ear gauges or at least long hair.
This bitch was not some oddball hacker she was a manager who had so little interest in learning that she majored in her high school extracurricular activity. She's just a competent try-hard. Managers look down on tech people so much that CISO is a good spot to put a promising C-level executive and not a good place for a hacker to ride out the end of their career until retirement. You are less than her.

I see people all over the internet defending this bitch because they knew so and so who had a degree in karmic prostate massage and could [code/hack] circles around [someone else]. Yes we all know that guy and this is not that guy.

-jcr

Don't expect pay for doing what's right.

[Anonymous Coward]

He's one of the good ones he will defend master for free which is his duty as a prole.

-jcr