Two top Equifax execs to retire after security breach
I think it&#x27;s important to take a step back, take a breath, and look at this rationally.<p>Look at what actually happened. Equifax was using the Struts framework. This is a very safe, popular choice. They were using what everybody else uses.<p>There was a critical vuln in the framework, and they failed to update their box for N months. But we&#x27;re talking only a few months. N is very small -- maybe four? And yeah, you can argue that four months is an absurdly long time to have a known critical vuln in production. But I guarantee you that most people reading this work at companies that are similarly vulnerable. Attacks are simply rare.<p>Whatever company you work for, if you do not have regular pentests, you are no better off. And even if you do, it&#x27;s overwhelmingly likely that you&#x27;ve overlooked some lonely outdated server that&#x27;s still running on your network because Bob set it up a year ago and forgot about it and oh look now you have a pivot into your whole network.<p>It seems very strange to choose this one company and crucify them just because they lost your data. Everybody is insecure everywhere always, and we&#x27;ve learned to tolerate this by pretending it&#x27;s not true or that it doesn&#x27;t exist or that it&#x27;s not a big deal. But you know what? It is true. That truth will continue to manifest itself in the years to come. No matter how much you&#x27;d like it not to be true, your stuff will still get stolen. Usually you just don&#x27;t hear about it.<p>Yes, it was stupid for them to have everybody&#x27;s PII attached to that one webserver. A single point of failure should never result in compromising the whole system. But think about how that architecture would work in practice. A customer service rep still needs to get at most of your data. It&#x27;s a credit bureau. Where would the data be stored in a way that a remote code exec wouldn&#x27;t be able to snag it?<p>Equifax&#x27;s crime boils down to &quot;they failed to run the equivalent of sudo apt-get upgrade on their framework.&quot; When you&#x27;re managing a fleet of hundreds or thousands of machines, this is a situation that almost all of us have wound up in. If we can&#x27;t get it right, why do you want the execs&#x27; heads to roll? Are you sure you won&#x27;t be next on the chopping block?<p>Think about it this way: the time between &quot;someone discovered a vuln in Spring&quot; and &quot;the attackers stole 150M credit reports&quot; was just a few months. Are you sure Equifax wasn&#x27;t a victim here? Someone threw a cinderblock through their window and made off with their trove of data.<p>Except of course, it wasn&#x27;t a cinderblock through a window. It was completely silent. Even if your firewall is great, you can still smuggle data out of a network using DNS alone.<p>Food for thought.