I think we can significantly improve the situation though with increased data collection laws, and then also more cryptography. Equifax shouldn't have all that data in the first place. A lot of the reasons that companies need data (besides machine learning) can be covered with cryptographic arguments that exclude the data itself.
For example, cryptography exists that would allow me to use my driver's license to prove to you that I am over 21, without ever actually showing you my real birthday or name. You could be 100% convinced that I both have a valid ID and that ID indicates that I am over 21 without learning anything more than those two facts.
If you can do things like that, you can make it illegal for companies to hold more sensitive information. If there's a big data breach that loses sensitive information, the company at fault can be charged for illegal data collection.
I know it's a big step from the data driven world we currently live in, but I think it's the only way to avoid a scenario where pretty much all details of every person's life (including politicians, secret agents, military figures) are public knowledge. We're just collecting far too much data, putting it in far too many places, and it's technologically infeasible to protect all of that.
The very fact that all this data was accessed from their public site is very troubling. What's the chances this is a basic SQL injection issue? What's the chances they didn't invest in security at all?
What makes you think lack of investment in IT & security is the main reason they get hacked?
Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do they immune from data breaches and being hacked? The answer is a big NO!
Hacking humans is quite often the easiest point of entry.
[1]: https://www.equifaxsecurity2017.com/
This is inexcusable in 2017. Hacking humans may be easier but it's up to Equifax to figure out how to mitigate that risk. "It's hard" doesn't excuse their behavior.
However this is not an excuse for Equifax to not put more focus and investment on their security.
Sure, nothing is totally secure against a dedicated, motivated attacker with unlimited resources. Thankfully those are few and far between.
Based on that Equifax has said that this doesn't seem to be the case.
People pay credit rating agencies to retrieve their credit reports, get credit scores, and open disputes, and the best way to do all that is online.
An excellent example is how many companies are in panic mode right now to get GDPR compliant before next year. There's a lot of security engineers and developers that finally get the budgets and time they've asked for to improve customer privacy, because the potential fallout of non-compliance is too big to ignore.
If it isn't a solvable problem then we need to start talking about getting this data off the Internet.
If you're really so terrified of the government that you're against security regulations for the website of one of the largest credit card information collectors in America, then you deserved to be hacked too.
The problem lies in that security and efficiency have been historically at odds with each other.
This is what inspired us to work on bringing a novel data security technology from the University of Harvard to the market: www.f-lock.ca . Essentially we are allowing for querying functionality, while achieving homomorphic-level of security. Would love to connect with any people here who share the same vision!
1. Collect the minimum amount of information you actually need
2. Hash and salt the data you store
3. Tell the people the truth about what happened to their data within a reasonable time
These are all things that can potentially be enforced.
my point being, without guidelines, or regulations, or some sort of security rating standard, managers will continue to make these mistakes.
I think there's a few things that could be done:
1. Invalidate all SSN numbers.
2. Force people to get a new ID card; make it like the smart-card passport card (or make people get such a card). That becomes your ID and number.
3. Getting that card requires you to be present physically for fingerprinting. Put the fingerprint data on the card, and no where else.
4. Make regulations that only allow for loans to be done in person - no more mailings, nothing online - if you want credit, you have to show up in person.
5. To prove who you are: Fingerprint, your card (with picture - and fingerprint data on the card), plus your pin number. Essentially chip and pin identification, with a fingerprint scan (and maybe a face scan too).
6. Make it so if you want to do online transactions - or any transaction for that matter - you must provide all of this. Basically, at home, a card reader that can read the chip, allow you to enter the pin, scan your fingerprint and face, and if all of that matches what's on the card, then an "acknowledgement" is sent.
Essentially the above would implement a 3-factor auth. I am not saying the above is perfect (I am absolutely certain I have screwed something up there - but the basic idea is what I am trying to convey), but we essentially have to do a clean break away from all current ID and credit/loan/payment systems - and move to a system that introduces a TON of friction.
Physical Presence (Something you are)
Physical Token (Something you have)
PIN (Something you know)
And all the data about "who you are" (face scan, fingerprint) stored on the card (hashed of course) only, no where else. Basically - the card, your presence, and your knowledge all have to be present, and the card's processor authenticates you.
And these factors need to be presented each and every time you do a transaction of any sort involving money or identification.
And no online or by-mail signup for credit. That should be done in physical form only.
Finally - allow for at-will changes of the PIN, and yearly a forced change of the PIN.
The problem with the above, though, is many-fold. It would be extremely costly - for everyone. It is also (seems in a way) draconian. But something of the above nature would need to be done, post haste, if we wanted this to go away.
And basically not allow any kind of storage of credit information or whatnot by -any- entity (and I am not sure how that would even work or if it could). Maybe all they have is a hash value and your name, and the card can generate that hash value as "authentication"/"identity" - but you have to have everything there (you, card, pin), and only the card holds the information, and only generates a hash.
I dunno - but again, this is the idea. I'll leave the details to people smarter than I on these things.
I don't expect something like this to be ever implemented, though. One would think this breach would do it, but it won't.
A lot of us here are engineers and coders. It's our responsibility to design better architecture, security conscious protocols and write securer softwares. And it's up to all of us (regardless which country you are in) to voice up and resist the idea of weakening encryption or allowing backdoors and instead advocate for adopting better and more securer encryptions to safeguard private and sensitive personal information.