Slashdot Mirror
Following Equifax Breach, CEO Doesn't Know If Data Is Encrypted (techtarget.com)
An anonymous reader quotes a report from TechTarget: Equifax alerted the public in September 2017 to a massive data breach that exposed the personal and financial information -- including names, birthdays, credit card numbers and Social Security numbers -- of approximately 145 million customers in the United States to hackers. Following the Equifax breach, the former CEO Richard Smith and the current interim CEO Paulino do Rego Barros Jr. were called to testify before the Committee on Commerce, Science, and Transportation this week for a hearing titled "Protecting Consumers in the Era of Major Data Breaches." During the hearing, Sen. Cory Gardner (R-Colo.) questioned Smith and Barros about Equifax's use of -- or lack of -- encryption for customer data at rest. Smith confirmed that the company was not encrypting data at the time of the Equifax breach, and Gardner questioned whether or not that was intentional. "Was the fact that [customer] data remained unencrypted at rest the result of an oversight, or was that a decision that was made to manage that data unencrypted at rest?" Gardner asked Smith. Smith pointed out that encryption at rest is just one method of security, but eventually confirmed that a decision was made to leave customer data unencrypted at rest. "So, a decision was made to leave it unencrypted at rest?" Gardner pushed. "Correct," Smith responded.
Gardner moved on to Barros and asked whether he has implemented encryption for data at rest since he took over the position on Sept. 26. Barros began to answer by saying that Equifax has done a "top-down review" of its security, but Gardner interrupted, saying it was a yes or no question. Barros stumbled again and said it was being reviewed as part of the response process and Gardner pushed again. "Yes or no, does the data remain unencrypted at rest?" "I don't know at this stage," Barros responded. "Senator, if I may. It's my understanding that the entire environment [in] which this criminal attack occurred is much different; it's a more modern environment with multiple layers of security that did not exist before. Encryption is only one of those layers of security," Smith said.
Gardner moved on to Barros and asked whether he has implemented encryption for data at rest since he took over the position on Sept. 26. Barros began to answer by saying that Equifax has done a "top-down review" of its security, but Gardner interrupted, saying it was a yes or no question. Barros stumbled again and said it was being reviewed as part of the response process and Gardner pushed again. "Yes or no, does the data remain unencrypted at rest?" "I don't know at this stage," Barros responded. "Senator, if I may. It's my understanding that the entire environment [in] which this criminal attack occurred is much different; it's a more modern environment with multiple layers of security that did not exist before. Encryption is only one of those layers of security," Smith said.
Big Sister Corporation collecting information on you is just as invasive, just as evil, as Big Brother Government.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
that's how dumb he sounds
Why the heck would anyone expect a CEO to know the details of the software implementation? It's not his job to know, nor would I expect him to know, and whatever understanding he might have is probably not to be trusted.
Other people in the company should know, but this, come on?
Not only are they ROT-13-ing the data, they're doing it twice for double strength security!
Check your premises.
What does he mean he doesn’t know whether the data is encrypted? It’s easy to tell...
Unencrypted data looks like this: “Customer 14523 Name Joe Lunchbucket DOB 4 Feb 1979”.
Encrypted data looks like this “5793af6 14be896a 76eed35c fe3723bc”
Any questions?
well since all my info was used for new accounts and my cards got hit as well 2 days after this announcement I'm gonna go with no. it is not encrypted.
Outside of somebody stealing your drives to look at them, encryption at rest isn't that vital since when the system is live the data are going to be effectively unencrypted for use. Considering the hack had nothing to do with physical theft of drives, it's kind of off topic.
It's like how Truecrypt can't protect your live database server from dumping data due to a SQL injection attack even if it protects the contents of the DB from physical hard drive theft.
AntiFA: An abbreviation for Anti First Amendment.
<O
(\
X
8===D
If I may, let me ask a possibly silly question: Why do these companies always have to be interviewed by some Congressional committee? What's the point? I mean, the damage is already done, nothing Congress can do to change that. If a crime has been committed, those responsible should be prosecuted. If civil damages occurred, they should be sued. What's the point of the grandstanding by Congresscritters?
That said, a CEO who knows he is going to get publicly grilled ought to have all of his ducks in a row. There's no excuse for not knowing something as basic as "is your data encrypted".
And on the gripping hand, depending on how something is hacked, "at rest" encryption may just be totally useless. It will protect you if someone gets a raw copy of your database, but if they have access to your application infrastructure, that infrastructure will happily decrypt the data for them, because that's what it does. Meanwhile, you will take a *huge* performance hit on a lot of database operations. Really, I have trouble imagining the small additional security being worth the cost in performance. But maybe I'm not familiar with enterprise-scale operations - anyone who is care to comment?
Enjoy life! This is not a dress rehearsal.
And it's poorly written, poorly managed, poorly understood and completely under-appreciated by the C-suite until something goes pear-shaped.
if you have access to the server you have all the tools and information to decrypt the data so it doesn't matter if the data is encrypted or not.. they could export it decrypted from the server in plain text.. or they could copy it and decrypt it on their end once they have it.
Must be another Music Major, perhaps he and the CIO studied opera together.
I hate equifax with a passion, but their CEO is probably correct in that most of their info comes from from third party end points (like your bank, or the utilities) directly, they might be encrypting data as it passes through them, but they are only as secure as their third party endpoints and adopted software (in this case, they say it was a bug in Apache Struts that allowed someone access).
This whole thing is one rotten contract with no oversight, just a bunch of people cashing in on private data. Multiple layers! Hah! Multiple layers of greed, shady data mining, and companies selling their customer up the river is more like it.
if you have access to the server you have all the tools and information to decrypt the data so it doesn't matter if the data is encrypted or not.. they could export it decrypted from the server in plain text.. or they could copy it and decrypt it on their end once they have it.
Here you point out the most salient point: encryption is only as strong as your protocol.
If you keep your unprotected decryption keys right next to the encrypted data, that's not security.
Uh, no, we're not their "customers". Used to be "product", now we're simply known as the "victims".
Do you have ESP?
if you have access to the server you have all the tools and information to decrypt the data so it doesn't matter if the data is encrypted or not..
Yes exactly just as normal users have all the tools they need to decrypt the root password!
You're just way past stupid if you are unaware that computers have internal security
Lots of Monday morning quarterbacks in this thread. They keep putting so much money in his bank account he barely even has time to spend it. When you're the CEO you have to prioritize your time and lots of small things simply don't make the cut.
it's a more modern environment with multiple layers of security that did not exist before. Encryption is only one of those layers of security
Translation: Someone told me we have security but I know nothing about how it works or what it actual is.
That's why you don't leave your keys in the lock.
It's also why you don't put the decryption keys in the same place as the data and you enforce what process/id has access to the encrypted data.
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
Correct!!!
Encrypt a drive - than if that drive is removed from the system the data is unavailable.
Encrypt a file (say DB) - than if that file is removed from reading / writing tools (SQL) then the data is unavailable.
Encrypt a table - similar result to file or db
Encrypt a row - now you getting some where.
Encrypt a column - now you really securing
Encrypt column at entry - then database just not know how to decrypt - tools not keep on database server.
Use all of the above - rotate keys constantly. Multiple keys for single column. Data size increases but securty also.
The breach took 'live data', e.g. that data actively used by the system, given the access the hackers had 'encrypting data actively used' would have 0 affect on security.
Now, if the hackers stole data from backups (actually OFFLINE/at rest), on laptops that were off etc THAN 'encryption of data at rest' would matter.
Data 'actively used by the system' is NOT 'at rest' & if you have administrative access to the system while running encrypting it will only slow the hacker down not stop them in any way.
12345
What the hell does " encrypting at rest" prevent in this context? The data is constantly being queried in a thousand different ways. So sure you could encrypt it and if someone gained access to the raw data then it would be useless but since every process is decrypting it anyway and that's the vector the attacker will come in on it doesn't do you any good.
Some controls could be put in place like storing address and personal identifiable information encrypted and only giving the decryption keys to processes that add data to the database and not ones that pull data but that's work, complexity and well it's the credit bureau's business to sell the data and there isn't a single piece of data they won't try and monetize.
Aside - I used to carry the entire backup of the data, unencrypted to the offsite storage.
It is a dream of mine to be able to ask hard questions to these industry clowns and force them, on the spot, to provide clear, unambiguous answers.
For real. This gets worse and worse every time you get to hear about it. How can he NOT know this MONTHS after the breach? I could see that this isn't something he needs to know for everyday business, his background is probably in finance, legal or business administration, that's where most CEOs come from and that's also what they deal with in day-to-day business.
This isn't fucking day-to-day business!
How it is possible that MONTHS after the breach he obviously still doesn't know at least the crucial, important bits about the breach is beyond me! I know that I'm the odd idiot who does actually prepare for such situations, I created whole binders for PR to keep the press occupied until we're ready for a public statement so they can send them on a wild goose chase without us looking like we're stalling should something like this ever happen to us, with similar folders for the relevant C-Levels that could possibly be asked for statements, along with pretty much me only having to tell you which folder to pull out of their desk and learn (or at least read at the inevitable PK), I know that few go to those lengths but it is valuable. When the shit hits the fan, you do not have time for this bullshit.
But, FUCK, even after ... what has it been now? 2 MONTHS? Two fucking months nobody bothered to brief the CEO so he doesn't look like a total and utterly worthless piece of junk with the only quality of being far too high maintenance to be kept alive because he might waste valuable O2 that someone could put to better use? For real?
I mean, ok, his CISO was what? An opera singer or someone equally qualified? Ok, one could argue that it's his own fault if he has no clue how to pick and choose his C-Levels, but FUCK, how the heck is that guy still outside of a prison cell? How is it even possible that directorate and board didn't rip him a new one up so far that even a turtleneck couldn't cover it anymore?
What the hell is going on here?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
information -- including names, birthdays, credit card numbers and Social Security numbers -- of approximately 145 million customers
When did we become "customers" of the credit reporting agencies? We are the product.
If this is data that was online ("at rest" is also irrelevant here, it just means "stored in some way"), then it does really not matter whether the storage device contains it in encrypted form. If it is online, you can just access it in plain via standard OS interfaces. Storage encryption protects data that is offline, not data that is "at rest". Hence, storage encryption does fine for removed disks, tapes, etc. It can also work for disks that are online but not mapped in the decryption layer, but that is a rare situation.
Ask an irrelevant question - get an irrelevant answer.
Now, I have no intention to defend Equifax in any way, but at least accuse them of something where they actually did it wrong.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It does not matter at all for the type of attack we are talking about here. Storage encryption helps if somebody steals the physical disks out of the server, but it does not help at all for file-systems that are online where the OS will nicely decrypt everything you ask for before giving it to you. It also helps if, say, backup tapes get stolen or laptops that are off (not hibernated or suspended) get stolen. The question just reveals that the person asking it is clueless.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
We should probably treat the executive levels in any given company as we treat high level officers in the various branches of the Military.
Something goes wrong, at the bare minimum, the Officer in Charge takes full responsibility and is removed. Read that: CEO.
No instant-retirement allowed to dodge the repercussions.
Golden Parachute revoked.
No profiting of any kind from screwing everyone else over.
YOUR GD FAULT. Directly or indirectly it doesn't matter.
You were in charge when it happened, you suffer the consequences for it.
It might actually force the company to do things the right way if their own ass is on the line.
Doesn't so much matter if it's encrypted at rest if you expose it publicly via an insecure website or API, right?
What the hell does " encrypting at rest" prevent in this context? ...
Aside - I used to carry the entire backup of the data, unencrypted to the offsite storage.
You answered your own question. Say you dropped, lost, or were robbed of those backups. Or say that someone at the off-site location did the same. Vola! 100% data leakage, quick & easy! Unencryped backups with personal info are just plain reckless- and sometimes illegal.
This is why you encrypt at rest.
Send Equifucks a cease and desist order for all their operations. They grossly abused the trust put into them and still have no leadership who takes these matters seriously. All that Equifucks deals with is data, the CEO not knowing if it is encrypted and the previous CEO not demanding encryption when his subordinates flubbed on it is prime evidence that they have absolutely not a single clue what they are doing as long as the cash rolls in regularly.
Congress must act and pass a law that any and all collection of personal information can only occur after explicit written consent and only for a very specific purpose. All data has to be encrypted in rest and in transfer. All practices have to be reviewed at least annually by an independent third party. Any data that is no longer needed for the purpose the consent was given has to be deleted. That also applies to all branches and organizations of governments. Exceptions can be granted to law enforcement after a decision by an elected judge (means no anonymous rubberstampers in back rooms). Or does the US really have to join the EU to get some decent privacy regulation in place?
Scale.
Lets say you have a database with 300m identities in it. Only a portion of those would actually be getting queried during any given period. If a breach happens against the data that isn't at rest, the exposure is limited by throughput and time...
If a breach happens against data that is at rest, exposure is 100%. It's a much more attractive bounty.