Prison for CEO and the board should be the least we need to do.
Just because something you don't like happened doesn't mean someone goes to jail. This is the hard but important idea you have to learn in a civilized nation. Bad stuff happens, and you don't just get revenge on whoever is nearby. This was a crime entirely perpetrated by another party. You don't get to transfer their guilt onto someone who may have been reasonably diligent.
Now the issue on aggregating the data in the first place is another conversation.
In US we have a lot of what's called regulatory crimes. For example, https://www.law.cornell.edu/uscode/text/42/1320d%E2%80%936
Similar laws can be created to deter people from violating privacy of financial information. We can call what's happened a negligent disclosure financial information.
> This was a crime entirely perpetrated by another party.
I think I didn't make myself clear. I, personally, do not think the people who actually exploited the vulnerability should be the main target of any law enforcement investigation.
What I want to build are strong incentives to ensure that vulnerable data is as secure as possible. Unless the pressure goes to the top, this will not happen. This means that it is not enough to find a scapegoat in mid-management who might not have much of a say in how things run.
I don't even hate credit rating agencies. If the CEO and the board go to prison (or a slightly less desirable outcome if they don't and we get strong regulations to make sure people do in any such future incidents) will make the rating agencies stronger. They will be able to go to investors and say look, we have to do things this way and it won't hurt your bottom line because everyone else has to follow the same regulation as well! It is just the cost of doing business. If they disagree, they are more than welcome to go to prison themselves for anything that happens.
You can disagree with that, but you'd be hard-pressed to justify that position. Six decades of computing history would contradict you. And as someone who saw the landscape of real-world codebases and deployments at nearly a hundred companies, there is almost always a way in. People are smug thinking their code is great till you show them an SQL injection that works, or pop up an alert(1) on their favorite front end framework.
The moment the world freaks out about this lack of security, we've all lost. Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees. You might think that's how it already is, but we can move way farther in that direction. Just look at how hard it is to run a simple medical study.
We just expect a company that stores the highly personal information of hundreds of millions of people to have better security than that of a random blog site maintained by one guy in his basement.
If you don't feel that way, I propose asking some of your pentester friends how they feel about the breach. Somewhere between unsurprised and shrug, probably.
It doesn't change a thing that this situation demands higher security. We're fighting against forces of nature. Except instead of extinguishing forest fires, we're asking for the equivalent of no forest fires, ever, and arguing vehemently that modern technology is so good that forest fires should not have been allowed to happen.
No need to read the rest of your comment. I'm not biting.
What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. The legal consequences of a leak will be moderated if it is proven, by fellow professionals, that a company took every standard precaution necessary based upon the sensitivity of the data in question. Nobody (except for perhaps yourself) seems to be claiming that Equifax's technical chops were anything but inept.
> Six decades of computing history would contradict you.
Feel free to actually cite anything at all supporting your position, rather than glibly appealing to inevitability.
> The moment the world freaks out about this lack of security, we've all lost.
As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order.
> Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees.
I welcome this dystopia with open arms, if it means it can save us from defeatists who have given up on the idea that software doesn't have to be completely terrible.
I have personally breached companies that fit this description. That was my job, and it's why I was hopefully the last person to breach that particular facet of their landscape.
But pentests can't catch everything. That's the dirty secret that is also somehow not a secret. The very next commit could make that pentest obsolete. Ditto for spinning up a server.
As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order.
Well, what do you think will happen from this? That may be true, yet the world will go on. We've been trained to accept the current system as inevitable, but SSNs aren't a security mechanism. The underlying absurdity is that we view leaking them as a disaster rather than recognizing and replacing the fact that we all rely on their secrecy.
If someone wants to impersonate your identity, they can usually find a way. This breach will certainly make that easier, but I'm not sure it will affect the actual fraud rate. Time will tell.
(I'm aware far more than SSNs were leaked. The point is that it was a bad idea to have this central point of failure in the first place. If it wasn't Equifax, it would've been someone else.)
This is addressed by "vigilance". And no, we still aren't asking for perfect security. Even on human-scale timeframes, the odds of a single exploitable vulnerability being introduced in any aspect of the software, for even a moment, are 100%. But if it takes only a single vulnerability to completely exfiltrate the whole of a company's sensitive data, then you're going to be hard-pressed to find anyone calling that a securely-designed system. I'm sincerely sorry that a career spent in the trenches has left you so jaded and cynical, but we can do better, and hopefully we as an industry do so before the government looks at our inability to self-regulate and imposes double-secret-hyper-SOX on all of us.
Everyone either goes silent or describes an idealized architecture that has glaringly obvious flaws in regards to meeting business goals.
I think maybe the top ten companies in our industry do this at scale well enough to work. Maybe.
2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year.
3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate
Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.
We hold Equifax to a higher standard because of the nature of the data that it collects.
> Everybody is insecure everywhere always
Some of us think that's neither necessary nor inevitable.
> If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block?
In some professions, including many engineering ones, gross negligence is punished with the removal of one's ability to practice professionally. It's imaginable that if there were consequences for one's actions, things wouldn't be "insecure everywhere always".
Really, how am I still finding people taking time out to defend the incredible ineptitude of a privacy-oblivious company in a hated industry?