Re:Equifax Releases Details on Cybersecurity Incident, Annou...
by eatboogers on Friday September 15, 2017 @08:57PM
(#15262118)
Failure to patch wasn't the cause of this breach. The causes of this breach were:
1. Reliance on a consumer-grade component in a security-critical system holding high-value data.
The portal should have had a small, audited code base with secure coding techniques and minimal reliance on third-party components.
2. Excessive attack surface on a system holding high-value data.
The machine hosting the portal should never have had read access to SSNs. Sensitive data should have been "thrown over the wall" to a secure backend with a constrained interface. This would have greatly reduced the scope of the breach.
1. Reliance on a consumer-grade component in a security-critical system holding high-value data.
The portal should have had a small, audited code base with secure coding techniques and minimal reliance on third-party components.
2. Excessive attack surface on a system holding high-value data.
The machine hosting the portal should never have had read access to SSNs. Sensitive data should have been "thrown over the wall" to a secure backend with a constrained interface. This would have greatly reduced the scope of the breach.