Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

9/22/2017
04:51 PM
Curtis Franklin
Curtis Franklin
Curt Franklin
50%
50%

Right & Wrong Lessons From the Equifax Breach

There are lots of lessons to learn from the Equifax breach. Just make sure you're learning the right ones.

Equifax, the gift that keeps on giving to hackers and journalists alike, continues to rain fallout over the security landscape. At the end of last week the fallout was the "retirement" of the CISO and CIO, and the subsequent learning of a great many lessons, most of them wrong.

Why do I say that people learned the wrong lessons? Because, in many cases, they were looking in the wrong direction. Like the sleight-of-hand in a magician's act, looking in the wrong direction both dazzles with meaningless fluff and distracts from the truly important issues. Let's look at some of the lessons that were wrong -- and some that you really should pay attention to.

Wrong lesson: the degrees matter
Susan Mauldin, Equifax's CISO, was found to have a pair of academic degrees, both in music. Some people latched on to this information with a loud, self-satisfied "A-ha!!" having identified the root of all Equifax problems. The problem with this is that, of all the company's problems, Mauldin's degrees rank somewhere below the status of the TP supply in the men's room on floor six.

Here's the thing: With rare exceptions noted, the academic degree someone possesses matters when seeking a first job. After that, it's irrelevant. What matters in the second job, and all subsequent jobs, is what you did in the preceding job. The Equifax C-suite wasn't Mauldin's first job so it's safe to assume that the executives at Equifax saw performance that warranted putting her into the office. There are plenty of problems to go around but this wasn't one of them.

Right lesson: responsibility matters
Two c-level executives lost their jobs over the breach and it seems that more resumes could change. And that's a very good thing.

People focus on the provisions within regulations that could lead to huge fines and jail terms for executives. The thing is, these penalties will be very rarely enforced. Still, there should be consequences for failure and job loss is a good one. It's non-lethal and shows that organizations take security seriously. Given the scope of Equifax's breach, the argument could be made that a large portion of the C-suite should be looking for new work. We'll see how this particular lesson continues to be applied.

Wrong lesson: cautious disclosure is best
Equifax took their time letting the public know about the breach -- time that, in an odd coincidence, included time required for a few executives to sell stock. The real lesson is clear: If you're going to keep personally identifiable information (PII) on customers and others then you should have plans and procedures in place for quickly alerting the public in case of a breach.

Airlines have plans in place for how to deal with first responders, government agencies, and the public in the case of a plane going down. No one likes to think of the possibility, and it doesn't happen very often, but the plans are there, and they're practiced. Organizations with PII should learn their lesson from the airlines, not Equifax.


You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

Wrong lesson: open source is evil
The basic vulnerability that allowed the Equifax breach has been traced to Apache strutsleading some people to decide that it was the open source nature of the software that's the problem. Not so much.

Open source software isn't inherently more vulnerable the commercial software. Neither is it inherently more secure. When it's part of your software infrastructure, you have to analyze and test it based on function, performance and security, just as you would any other software.

The lessons? Be careful. Use best software practices. And don't use the nature of software as an excuse.

There are many more lessons from the Equifax breach and the lessons will increase as our knowledge of the issues grows. It's good to learn lessons -- just be sure you're looking in the right directions and learning the proper lessons.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26814
PUBLISHED: 2021-03-06
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service sc...
CVE-2021-27581
PUBLISHED: 2021-03-05
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
CVE-2021-28042
PUBLISHED: 2021-03-05
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
CVE-2021-28041
PUBLISHED: 2021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
CVE-2021-3377
PUBLISHED: 2021-03-05
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.