2 min read
Equifax, one of the big-three US credit bureaus, has disclosed a major data breach. It affects 143 million individuals — mostly Americans, although data belonging to citizens of other countries, for the most part Canada and the United Kingdom, were also hit.
It’s known the data was stolen, not just exposed. Equifax disclosed it had detected unauthorized access. So this isn’t simply a case of potential compromise of data inadvertently exposed on the web. Someone came in and took it.
How the breach occurred remains publicly unknown, and Equifax has been close-mouthed about the details. But there’s considerable speculation online that the hackers exploited a patchable yet unpatched flaw in Equifax’s website.
Quartz suggests an Apache Struts vulnerability. Markets Insider says it’s unclear which vulnerability may have been exploited. The Apache Struts team has issued a statement which says: Regarding the assertion that especially CVE-2017-9805 is a nine year old security flaw, one has to understand that there is a huge difference between detecting a flaw after nine years and knowing about a flaw for several years. If the latter was the case, the team would have had a hard time to provide a good answer why they did not fix this earlier. But this was actually not the case here –we were notified just recently on how a certain piece of code can be misused, and we fixed this ASAP. What we saw here is common software engineering business –people write code for achieving a desired function, but may not be aware of undesired side-effects. Once this awareness is reached, we as well as hopefully all other library and framework maintainers put high efforts into removing the side-effects as soon as possible. It’s probably fair to say that we met this goal pretty well in case of CVE-2017-9805.
So where to turn? Is it reasonable to assume that Equifax should be rigorous in updating its systems, especially public facing ones with access to such valuable data? Yes, of course. But it frankly doesn’t matter what it was written in, how it was deployed, or whether it was up to date. How do you explain (apparently) no controls to monitor unusual activity? That’s dereliction of duty, in 2017.
Perfect protection is not practical, thus monitoring is necessary. Rinse and repeat, ad nauseam, it seems.
Looking for an expert set of eyes to monitor your assets? SIEMphonic can help. See what we’ve caught.
