Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

9/10/2018
12:47 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

The Equifax Breach One Year Later: 6 Action Items for Security Pros

The Equifax breach last September was the largest consumer breach in history. We talked to experts about lessons learned and steps companies can take to prevent and minimize future breaches.
3 of 7

3 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/18/2018 | 3:25:26 PM
Re: Passwords, people. Passwords.
GAO report - breach caused by a misconfigured device that monitored network traffic - and this device let encrypted data through and out.  This misconfig was caused by one ----- ONE FOLKS ----- expired certificate.  There, just one thing.   Incredible.  SANS INSTITUTE NEWSLETTER: 

QUOTE

A report from the US government Accountability Office (GAO) on the Equifax breach found that the company had to look at the attackers' database queries to determine exactly what information had been compromised. (The breach affected more than 165 million people worldwide.) The report found that "while Equifax had installed a device to inspect network traffic for evidence of malicious activity, a misconfiguration allowed encrypted traffic to pass through the network without being inspected." The misconfiguration was due to an expired certificate.
DorisHuntley
50%
50%
DorisHuntley,
User Rank: Apprentice
9/17/2018 | 10:23:18 AM
Re: Passwords, people. Passwords.
Rignt
lunny
100%
0%
lunny,
User Rank: Strategist
9/13/2018 | 12:58:06 PM
Passwords, people. Passwords.
The core problem was that it was easy for the attackers to obtain the credentials to access the databases.  The Struts vulnerability was simply the unlocked bedroom window the theives used to enter the house.  It could have been one of any number of access points.  If the IDs and credentials for the database systems were properly protected, this would have never become news.  There was initial focus on some poor scapegoat IT director who didn't patch in time.  But I'll bet you a dollar on a doughnut that if he had tried, his application owners would have screamed, "We can't patch now!  We have a major product release that day/week/month that can't be delayed!"  These are the same application owners who think it's just fine to still be running their applications on obsolete operating systems, etc.  Until this industry gets credential security management under control, everyone's just whistling past the graveyard worrying about patching a million vulnerabilities.  Almost every breach boils down to easily obtained passwords to key data assets.  It's still too easy for the bad guys.  Heaven help the enterprise where the attacker is an insider.
BradleyRoss
100%
0%
BradleyRoss,
User Rank: Moderator
9/11/2018 | 4:42:22 PM
Admit you have a problem and that it must be fixed
I think the main need is for a change in attitudes.  You have to decentralize the operation, but also have to understand what decentralization means.  You have to assume that one of the major components of the system will be completely compromised.  You have to decide how you can prevent a compromised component from damaging the integrity of the whole system.  Being able to convince upper management that the system is secure is not enough, it actually must be secure.  Upper management can't rely on people telling them the truth, especially if it is felt that telling the truth will get you fired.  If the people under you say that making the system secure will cost money, you have to be willing to spend money.  I had a manager that he didn't like working with experienced people because they kept telling him about things that needed to be fixed.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd