{"id":4821,"date":"2017-10-06T02:11:01","date_gmt":"2017-10-05T18:11:01","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4821"},"modified":"2017-10-06T02:11:32","modified_gmt":"2017-10-05T18:11:32","slug":"equifax-hack-blamed-on-single-employee","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2017\/10\/equifax-hack-blamed-on-single-employee\/","title":{"rendered":"Equifax Hack Blamed On Single Employee"},"content":{"rendered":"<p>We wrote about the Equifax Hack, Data Breach and Leak <a href=\"https:\/\/www.darknet.org.uk\/2017\/09\/equifax-data-breach-hack-due-to-missed-apache-patch\/\">last month<\/a>, which happened due to a flaw in Apache Struts that for some reason hadn&#8217;t been patched.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/Equifax-Hack-Blamed-On-Single-Employee-640x400.jpg\" alt=\"Equifax Hack Blamed On Single Employee\" width=\"640\" height=\"400\" class=\"aligncenter size-medium wp-image-4822\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/Equifax-Hack-Blamed-On-Single-Employee-640x400.jpg 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2017\/10\/Equifax-Hack-Blamed-On-Single-Employee.jpg 960w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Now it seems the CEO Rick Smith is basically placing the blame on a single employee that failed to pass a message on to the right people, rather than taking responsibility for an organisational failure. It&#8217;s also interesting there was a scheduled security scan not long after the flaw was disclosed and it wasn&#8217;t detected.<\/p>\n<blockquote><p>Recently-and-forcibly-retired Equifax CEO Rick Smith has laid the blame for his credit-check biz&#8217;s IT security breach on a single member of the company&#8217;s security team.<\/p>\n<p>In testimony on Tuesday before a US House subcommittee on consumer protection, Smith explained that Equifax has a protocol whereby news of important software patches is communicated to the appropriate people within a certain time. When details of security vulnerability CVE-2017-5638 landed in March 2017, bearing bad news about Apache Struts, that protocol broke down at Equifax due to human error, meaning no one was told to apply patches for the flaw. And, astonishingly, this is all one person&#8217;s fault rather than an obvious failure for the business as a whole, according to Smith.<\/p>\n<p>\u201cThe human error was the individual who is responsible for communicating in the organisation to apply the patch, did not,\u201d Smith told the subcommittee at around the 1:05:15 mark in the video below.<\/p>\n<p>Congressman Greg Walden sought clarification of that statement, asking \u201cDoes that mean that that individual knew the software was there, and it needed to be patched, and did not communicate that to the team that does the patching? Is that the heart of the issue here?\u201d<\/p>\n<p>Smith&#8217;s reply was: \u201cThat is my understanding, sir.\u201d<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>This Equifax hack was so avoidable, do they not use some kind of issue tracking or ticketing system, did someone not just need to create a Jira ticket and someone else checks that they created it, how can such a huge multi-million dollar corporation with such critical user data not have simple, industry standard check and balance procedures.<\/p>\n<p>It&#8217;s sad, and it&#8217;s messed up and honestly, it&#8217;s also depressingly unsurprising.<\/p>\n<blockquote><p>Smith said the company had otherwise followed its protocol of distributing information on necessary patches and that in the case of CVE-2017-5638 its procedures were observed, except by the individual mentioned above.<\/p>\n<p>The former CEO said the second cause of the attack was a failure of automated scanning conducted a week after the patch should have been applied. For as-yet-unknown reasons, scans did not detect the presence of un-patched Struts implementations.<\/p>\n<p>Smith spent more than two-and-a-half hours testifying and, after apologising and taking responsibility for the hack, spent much of that time defending Equifax&#8217;s decision to withhold news of the hack for many days after discovering it. Smith repeatedly justified the delay on grounds of avoiding further attacks and ensuring consumer protection measures could be in place.<\/p>\n<p>\u201cIt did not help that hurricane Irma took down two of our larger call centres in the early days after the breach,\u201d he said.<\/p>\n<p>Committee members were not kind to Smith, who did not flinch in the face of stern criticism of Equifax&#8217;s security practices and response.<\/p><\/blockquote>\n<p>I hope the committee comes down like a tonne of bricks on all of those negligently involved in this travesty that has affected the majority of American citizens.<\/p>\n<p>I&#8217;m also curious to see if the details are exposed of why the subsequent scan did not detect the vulnerability that caused the Equifax hack.<\/p>\n<p>The law is also pretty sad, under current law they are required to alert those whos accounts have been hacked..but there&#8217;s no penalty if they dont.<\/p>\n<p>Source: <a href=\"https:\/\/www.theregister.co.uk\/2017\/10\/04\/sole_security_worker_at_fault_for_equifax_fail_says_former_ceo\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We wrote about the Equifax Hack, Data Breach and Leak last month, which happened due to a flaw in Apache Struts that for some reason hadn&#8217;t been patched. Now it seems the CEO Rick Smith is basically placing the blame on a single employee that failed to pass a message on to the right people, [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"We wrote about the Equifax Hack, Data Breach and Leak last month, which happened due to a flaw in Apache Struts that for some reason hadn't been patched.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[10627],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4821"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4821"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4821\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4821"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4821"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4821"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}