Equifax Data Breach Due to Negligence
News of the Equifax data breach broke last week sending ripples across the global cybersecurity community. This data breach is arguably the most severe private data breach to date. Some 143 million Americans’ private data was exposed and stolen. Social security numbers credit card numbers composed the majority of the data breach.
When non-public information is stolen from an organization, very often cyber attackers will auction off the sensitive data across clandestine, anonymous Dark Net markets. The purchasers can then use the stolen data to conduct identity fraud, financial fraud, or perform targeted attacks against individuals. In general, data breaches are very dangerous.
The Equifax data breach lasted from Mid-May throughout July 2017. Although the incident is still under investigation, some information has been made public. The breach included the loss of 143 million records, and serves as a reminder that every link in the software supply chain must be continuously monitored by information security programs.
Equifax data security team has confirmed that a vulnerability found in Apache Struts software was the attack vector used by hackers, into which other layers of security were circumvented. This is another example of a known vulnerability being used as a break in, the Apache Struts vulnerability was made public by the National Vulnerability Database in March of 2017. For more information on this vulnerability please visit the National Vulnerability Database and search for CVE-2017–5638, https://nvd.nist.gov/vuln/detail/CVE-2017-5638
In order to maintain information security, it is crucial for organizations to implement comprehensive and organized cybersecurity programs. This includes regular penetration and vulnerability testing, and vulnerability remediation. The reason for this breach is negligence. Equifax did not properly safeguard their customer’s information, or implement proper information security programs.
Here are some reliable cyber security tips from A2 Cybersecurity [ https://a2cybersecurity.com ]
Safeguard access to sensitive data storage, limit access to as few employees as possible, deploy physical and virtual access logs, and deploy multifactor authentication.
Ensure proper data encryption ciphers are up to date and free from known exploits and vulnerabilities.
Keep only data that you need, and safely destroy all data that is not needed. The less data that you have to protect, the easier it is to safeguard against attacks.
Educate employees on information security risks and internal information security policies.
Employ a managed security service provider to handle routine risk analysis checks, third party information security audits, and cybersecurity program management.
About the Author: Louis Powers is an information security consultant and works for A2 Cybersecurity in Stony Point, New York.
lpowers@a2cybersecurity.com
146 S. Liberty Stony Point, NY 10980
