Before we get started talking about Equifax, I\u2019d like to apologize for the brief interruption in our regularly scheduled programming, err\u2026 blog\u2026 posting? As you may know, our company resides in beautiful St. Petersburg, FL, which recently found itself in the path of Hurricane Irma.<\/p>\n
We\u2019re glad to say that we made it out safe and relatively unscathed. Most of us have power back by now. I actually had mine back shortly after the storm but continued to eat room temperature beans out of aluminum cans by candlelight while living without electricity for fear of looters.<\/p>\n
Anyway, while we\u2019ve been bailing water, a lot has happened in the world of cyber security. Namely, the Equifax Breach. So I figured this would be an excellent opportunity to go over what happened and what we can learn from this whole situation.idUSKCN1BN1WN<\/p>\n
Equifax, an equestrian telecommunications company\u2026 [Editor\u2019s Note: This was the point that we sent Carl back to do some more research<\/em>] Scratch that. Equifax is one of the world\u2019s largest credit reporting agencies. It keeps information on over 800 million consumers and over 88 million businesses worldwide.<\/p>\n On July 29th<\/sup>, Equifax discovered that it had been breached. Over the coming days and weeks, it was discovered that over 143-million consumer records \u2013 including full names, addresses, social security numbers and other personal identifying information \u2013 had been compromised. As more and more scrutiny has been applied to Equifax, additional troubling information has emerged that raises serious questions about the company\u2019s security practices.<\/p>\n As far as data breaches go, this could be the motherload. Per a report by Reuters, verified credit card information \u2013 meaning a card that has been tested and is still active \u2013 can fetch 10-20 dollars per card on the dark web. Full ID dossiers \u2013 which include all the information to carry out identity theft \u2013 can fetch up to $10. It may seem like a trivial amount, but when you\u2019re pulling down 143-million records it can turn into a nice haul. Some experts are already calling this the worst breach in history.<\/p>\n From the sounds of it, Equifax really needs to overhaul its security policies and practices. A lot of what occured comes down to gross negligence. The vulnerability that was used against Equifax is called Apache Struts CVE-2017-5638. Apache Struts is an open-source framework for developing Java web applications. Researchers identified the vulnerability that was used against Equifax on March 6, 2017. It was patched a week later.<\/p>\n Now, if you do the math, Equifax had roughly four and a half months to patch its own systems and remove this vulnerability. It clearly didn\u2019t. Now, 143-million consumer records have been exposed.<\/p>\n And that just appears to be the tip of the iceberg. Hold Security, a Milwaukee-based security firm was able to crack one of Equifax\u2019s Argentinian database and harvest employee information with little more than guesswork. In this case, Equifax was using \u201cadmin\u201d as both a username and the accompanying password for the database. Let\u2019s pause for a second and appreciate a major international credit monitoring agency that has secured its database with the same level of sophistication as the average internet user sets up a router with\u2014using just the default settings.<\/p>\n Let\u2019s just put it this way. I\u2019ve been tricked, duped and ripped off on the internet so much that my coworkers have sarcastically taken to calling me \u201cCautious Carl.\u201d I got ransomware my first day working here. To this day, I’m considered such a danger I have to ask permission just to use the internet at work. The point I\u2019m making is that when I can look at your company\u2019s security implementation and tell you it\u2019s awful\u2014it must really be bad.<\/p>\n There used to be a great baseball player named Gary Sheffield that had an amazing swing, which, ironically enough, was also a pretty textbook example of how not to swing a baseball bat. Commentators used to remark that you could look at him in action and teach a young player exactly what not to do. Equifax\u2019s security is a lot like Gary Sheffield\u2019s swing, except for rather than using it to mash 509 career homers like Gary did, Equifax just took a fastball in its daddy bits.<\/p>\n Actually, that\u2019s probably a terrible analogy for a number of reasons, the least of which is that I\u2019m trying to talk to the cyber security community using an example that includes the word \u201cbaseball.\u201d (It\u2019s the game with the bases and the outs and the wooden bats\u2014no, not Cricket. Nevermind. Just nevermind.)<\/p>\n Anyway, the point I\u2019m making is that we could probably write a book on how not to secure a company or organization just using Equifax examples. In fact, someone probably will. The infosec community is petty like that. For our purposes though, there is one big lesson we can take away from Equifax.<\/p>\n Always stay up to date on Security Updates<\/strong><\/p>\n Apache Struts had been patched for months before Equifax was breached. This wasn\u2019t some zero day exploit where nobody had any warning, this was a well-documented vulnerability that should have been dealt with immediately. Or, at least within four and a half months of its disclosure. Granted, this kind of feels like your newly eclipse-blind friend telling you that this was a great lesson about not staring at the sun \u2013 it\u2019s that obvious \u2013 but it\u2019s still good advice. Advice that goes unfollowed far too often, even in this day and age. You just can\u2019t ignore patches and updates. I mean, I guess you can, but this is what happens.<\/p>\n Of course, there are other smaller, more specific lessons that you can glean from this fiasco as well. Like, for instance, don\u2019t ever use admin as a password for anything. Ever. Especially if your username is also \u201cadmin.\u201d Or how about maybe don\u2019t offload $2-million worth of stock before your company has a chance to disclose a security breach<\/a>. Again, that\u2019s very specific but it\u2019s sound advice.<\/p>\n Let this serve as a lesson to you. The next time you get a notification about updating new security settings, spend the minute or so it takes to implement them. Granted, chances are the personal data of 143-million consumers doesn\u2019t hang in the balance, but don’t let that stop you from updating.<\/p>\n And hey, at at least if you learn this one lesson you\u2019ll be able to say you gained something from this entire debacle when your identity inevitably gets stolen sometime around Christmas.<\/p>\n Thanks, Equifax.<\/p>\n","protected":false},"excerpt":{"rendered":"What Happened with Equifax?<\/h2>\n
What Can We Learn From Equifax?<\/h2>\n
A Final Word<\/h2>\n