Slashdot Mirror
Equifax Was Warned (vice.com)
Lorenzo Franceschi-Bicchierai, reporting for Motherboard: Months before its catastrophic data breach, a security researcher warned Equifax that it was vulnerable to the kind of attack that later compromised the personal data of more than 145 million Americans, Motherboard has learned. Six months after the researcher first notified the company about the vulnerability, Equifax patched it -- but only after the massive breach that made headlines had already taken place, according to Equifax's own timeline. This revelation opens the possibility that more than one group of hackers broke into the company. And, more importantly, it raises new questions about Equifax's own security practices, and whether the company took the right precautions and heeded warnings of serious vulnerabilities before its disastrous hack. Late last year, a security researcher started looking into some of the servers and websites that Equifax had on the internet. In just a few hours, after scanning the company's public-facing infrastructure, the researcher couldn't believe what they had found. One particular website allowed them to access the personal data of every American, including social security numbers, full names, birthdates, and city and state of residence, the researcher told Motherboard.
Except most of the harmed never signed any agreement that includes FORCED ARBITRATION in their relations with Equifax, because the harmed are NOT Equifax customers. That means that all effected US citizens who are not Equifax customers CAN sue directly or via class action.
The issue will be showing that you were damaged specifically by Equifax's negligence. They will likely defend themselves via all the reports of the similar losses of the same and similar personal data via other corporations also piss poor security practices.
It will be very hard for any specific individual or class to show losses specific to Equifax. Sure , you may be able to show identity theft and losses because of it, but was that specifically because of Equifax? Good luck proving that.
Equifax certainly does deserve the "Corporate Death Penalty." But there are many ways for them to avoid it, followed by a fresh coat of paint and likely a new name. Just watch....
Today there is no such thing as a responsible corporate citizen. There probably never was.
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
This is a classic example of perverse incentives. Equifax gets paid when people need fraud protection (directly and indirectly), so the more cavalierly they handle consumer data, the better off they are.
// This is not a sig.
You hit upon the real problem: Companies put more focus on the bottom line, than doing what is right for their customers. Hence operating with minimal IT workforce, and resorting to off-shoring and other cost saving methods that directly impact their ability to deliver quality code, and more importantly keep it updated to avoid zero day exploits (as studies have found most zero day exploits take 6 months to a year to find and a fix to be coded, yet the average time for systems in the wild to be updated is 3 to 5 years). IT should know every piece of code that is placed in the network and its source.
So, what's the fix, aside from reforming corporation and stock market rules? Corporations need to know that if they don't take security seriously there will be bad outcomes for them. Lawsuits are one mechanism for this. Another is through customer choices - boycott companies that don't take security seriously. For corporations that actually want to make changes to deal with this correctly, IT culture needs to change in the following ways:
* IT should know every piece of code that is placed in the network and its source. This means having an absolutely clear understanding of every library, framework, and any non-standard custom extensions deployed. This will serve two purposes. On the one hand it will ensure that IT is being proactive about patching to avoid zero day exploits. On the other hand it will drive simplification and good software engineering; another way of saying this is KISS (Keep It Simple, Stupid). The more complex systems you put into place - and more importantly the more that complexity comes from code that is generated outside of your own organization, the more likely there are for bugs (potentially exploitable zero days) to exist within the overall code base.
* IT costs need to be viewed as a cost of doing business, rather than something that can be dispensed with or minimized. To do security right takes resources, and this has increased relevance not only with breaches that we've seen happening, but also to meet corporate requirements from a legal and regulatory perspective (e.g. Sarbanes-Oxley). Costs can be managed, if companies are willing to invest in building automation to help them manage what they've got - and doing that first item above (weeding out overly complex designs).
* IT needs to also change their culture from what I call a 'shrink-wrapped' software mentality - where software is thrown over the wall to operations and the developers walk away and never work on it again, to a culture that values long term developer ownership and maintenance of systems they have created in partnership with operational teams. This is related to something else that I see a lot of in IT: brain drain. Basically, due to nomadic existence of developers in an organization either through rotation or vendor outsourcing, long term knowledge of integration between existing systems and new development is lost every year to 18 months - breaking the ability of the company to quickly patch or otherwise modify systems in response to security issues or simply the need for responses to competitive forces.
We could transform IT from a necessary burden to a much needed and appreciated partner in business. But, that will require the decisiveness on the part of CTOs, and CEOs to dedicate resources to that specific mission.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
Further deregulation will lead to even MORE piss-poor security situations like this. Our lawmakers are, at this point, willfully negligent to the point of being criminally culpable. This same situation happens again and again, at various private and government places, and yet nothing is really done. Oh, a law or two might be passed that says "unauthorized access is illegal" yet nothing dictating that any real effort must be done to stop said unauthorized access. Even if we passed a law to force some level of IT security, we lack the backbone to actually do any enforcement.
The US doesn't even have a current Cabinet-level person doing anything related to security in a real way. "Giuliani Security & Safety" does NOT count. Rob Joyce has TWO full time jobs, one as the "White House Cybersecurity Coordinator" and another as "acting deputy homeland security adviser to the President". While those may have overlapping duties, it's obvious that cybersecurity needs to be it's own separate gig. I would even go so far as to say we need a "Commercial Cybersecurity Czar" to separate out the government vs public, as these are quite different in scope and approach.
However, seeing the kind of people Trumps likes to appoint, I would expect someone who thinks cybersecurity is a "hoax" and believes that corporations will be forced to secure themselves "if only allowed to by the invisible hand of the free market"; who would then nullify HIPAA and censure / fire / dismantle the part of NIST that writes the 800 series.