News

9/10/2018
12:47 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Equifax Breach One Year Later: 6 Action Items for Security Pros

The Equifax breach last September was the largest consumer breach in history. We talked to experts about lessons learned and steps companies can take to prevent and minimize future breaches.
Previous
1 of 7
Next

Image Source: Shutterstock via Piotr Swat

Image Source: Shutterstock via Piotr Swat

Large breaches have become such a fact of everyday life for the past few years that it’s easy to pass off the Equifax breach last September as just another in a long string of bad security news. But make no mistake about it: this was a huge breach that will take several years to sort out.

When the dust settled earlier this year, Equifax finally disclosed that 147.9 million people were affected in some way. Sensitive personal information was stolen, including the names, Social Security numbers, and dates of birth of the victims, as well as phone numbers, email addresses, and genders.

George Avetisov, CEO of HYPR, says while the breach itself caused great harm, rank-and-file consumers and companies not directly affected by the Equifax breach are still at risk because all that personal data still resides on the Dark Web and can be used for future account fraud, synthetic identity attacks and credential re-use.

"We know how many consumers had their data stolen," Avetisov says. "But it's difficult to quantify the impact, as we may never know the full extent of the account fraud and credential re-use that will stem from the Equifax breach for years to come."

Avetisov and other experts say companies must do all the security hygiene basics: such as more patching more effectively, deploying encryption and tokenization, and above all, taking better care of their data.

"Companies have to start treating data as something of value," says Brian Vecci, technical evangelist at Varonis. "Start by turning on the lights and finding what data you have."

In putting together this slideshow, we talked to Avetisov and Vecci; Julie Conroy, research director for Aite Group’s Retail Banking practice; and Peter Firstbrook, a research vice president at Gartner who focuses on security. 

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
BradleyRoss
100%
0%
BradleyRoss,
User Rank: Moderator
9/11/2018 | 4:42:22 PM
Admit you have a problem and that it must be fixed
I think the main need is for a change in attitudes.  You have to decentralize the operation, but also have to understand what decentralization means.  You have to assume that one of the major components of the system will be completely compromised.  You have to decide how you can prevent a compromised component from damaging the integrity of the whole system.  Being able to convince upper management that the system is secure is not enough, it actually must be secure.  Upper management can't rely on people telling them the truth, especially if it is felt that telling the truth will get you fired.  If the people under you say that making the system secure will cost money, you have to be willing to spend money.  I had a manager that he didn't like working with experienced people because they kept telling him about things that needed to be fixed.
lunny
100%
0%
lunny,
User Rank: Strategist
9/13/2018 | 12:58:06 PM
Passwords, people. Passwords.
The core problem was that it was easy for the attackers to obtain the credentials to access the databases.  The Struts vulnerability was simply the unlocked bedroom window the theives used to enter the house.  It could have been one of any number of access points.  If the IDs and credentials for the database systems were properly protected, this would have never become news.  There was initial focus on some poor scapegoat IT director who didn't patch in time.  But I'll bet you a dollar on a doughnut that if he had tried, his application owners would have screamed, "We can't patch now!  We have a major product release that day/week/month that can't be delayed!"  These are the same application owners who think it's just fine to still be running their applications on obsolete operating systems, etc.  Until this industry gets credential security management under control, everyone's just whistling past the graveyard worrying about patching a million vulnerabilities.  Almost every breach boils down to easily obtained passwords to key data assets.  It's still too easy for the bad guys.  Heaven help the enterprise where the attacker is an insider.
DorisHuntley
50%
50%
DorisHuntley,
User Rank: Apprentice
9/17/2018 | 10:23:18 AM
Re: Passwords, people. Passwords.
Rignt
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/18/2018 | 3:25:26 PM
Re: Passwords, people. Passwords.
GAO report - breach caused by a misconfigured device that monitored network traffic - and this device let encrypted data through and out.  This misconfig was caused by one ----- ONE FOLKS ----- expired certificate.  There, just one thing.   Incredible.  SANS INSTITUTE NEWSLETTER: 

QUOTE

A report from the US government Accountability Office (GAO) on the Equifax breach found that the company had to look at the attackers' database queries to determine exactly what information had been compromised. (The breach affected more than 165 million people worldwide.) The report found that "while Equifax had installed a device to inspect network traffic for evidence of malicious activity, a misconfiguration allowed encrypted traffic to pass through the network without being inspected." The misconfiguration was due to an expired certificate.
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.