When two people are clearly intelligent but disagree, the reason is almost always a different set of experiences. My experience differs from yours; if I could Vulcan my brain to yours, you'd see why I feel this way. You might still disagree, but it would be far less clear cut.

Now, I've seen nearly a hundred codebases and they all looked pretty much like Equifax. I don't even need to see Equifax to know the kind of disaster their codebase facilitated.

Equifax's codebase is your code, and my code, and Bob's code. The only way to make this situation better is to talk openly about it. And the best way to do that is to actively defend the unpopular side in order to call attention to uncomfortable truths. It's a calculated strategy.

Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax. We need to (a) acknowledge that and (b) actively seek out solutions. That's what's happening here.

Ask yourself: "Why do I disagree when I've seen one or two enterprise codebases?" Those big, plodding institutions you mention are similarly vulnerable. Everyone is.

Why aren't data breaches happening almost daily? Because it's illegal. It's no coincidence that companies with public bug bounties are among the hardest targets to hit. When you make it not-illegal to attack you, surprise: you find the vulns.

A good question is, "is it illegal for a white hat to attack my business?" If the answer is yes, seek to change that. It's a low effort thing that will increase your security posture. But it's no substitute for $40k pentests.

> Everybody else looks like Equifax.

I don't doubt that there are other Equifaxes out there, nor do I doubt that there will be more leaks. But this wasn't a simple matter of a horrible code base. Heck, the leak wasn't even due to Equifax code, it was due to third party code. Other companies of Equifax's size apparently do better. Equifax should have done better, and I'll bet if the penalties for losing this data were more severe, would have done better.

(replying to your "What if $40k for a pentest becomes a rubber stamp?" question, which was an important observation)

Mm, it can become that. It's important to get a pentest from a reputable firm. At the one I worked at, it was a point of pride to come up with clever attacks. We'd make a sport of it and try to one-up each other. But it's easy to imagine some other pentest firm just going through the motions, running Nessus and calling it a day.

Unfortunately, that's where money really does make a difference. $40k is at the low end of how absurdly expensive pentests are. Yet they make all the difference -- one app that I pentested was at a trading firm. I took that app from "typing ' leads to SQLi in their Node backend," and "there was SQLi in their Java backend if you were clever" to "you'd have to be more clever than me if you want to breach this app."

Most attacks come from unsophisticated adversaries. This implies that raising the bar higher than these guys gets you 80% of the way home. The other 20% is much harder, but it's doable if your company has a culture of caring about security.

Thanks for replying and sorry for moving my comment.

It's all good. Just happy the world is starting to care about security.

> I think that more and more CISOs are becoming comfortable with the cloud and companies are insisting that CISOs become comfortable. So I always say that given enough time, we can secure anything and find a way to say yes to it and business-driven CISOs are of that mind.

> If a CISO can come up with a list of controls that he/she is comfortable with, then by and large the evidence proves that those controls are working effectively and are going to satisfy the elements of any framework that you use.

These are two soundbites from an interview with Susan Mauldin from over a year ago. Someone didn't want us to hear them, according to the timeline[1] of when someone remembered and reported that these interviews happened on September 9, and how soon after (on September 10) they were taken down (and then late last night, at least partially recovered again, further on down in this very HN thread!)

They are not even especially damning soundbites if you put them out of context and honestly evaluate them in a vacuum, but it does put some additional context on "it was due to third party code" and in the context of this whole discussion, it is clear why someone did not want us to see this interview.

If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position. So let's keep having these discussions and make it better! It is absolutely your codebase and my codebase, we are all in this kind of trouble (or, we could be... if we all similarly had 140 million involuntary "customers" entrusting us with their SSNs and credit histories.)

[1]: https://www.hollywoodlanews.com/equifax-chief-security-offic...

> If the job of the CISO is to deliver the project under budget and on time, rather than to do the job correctly as you and I understand it, then we are certainly more likely to find ourselves in this position

The same fault is responsible for the Space Shuttle Columbia crash. It's called "leadership without vision." If you put a manager in place and give them tight constraints on how they deliver the product, they will almost universally deliver a critically flawed product ... albeit, on time and under budget.

You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop.

Know what happens when you demonize something? People stop reporting it.

Look at the actual damage to actual people. You are arguing for prison time for the execs, if I remember correctly. Yet it's unclear that a single person has yet been materially damaged by these leaks. If you want to suck away N years of someone's life, you have a higher bar to clear.

(Meta: I think we edited our replies past each other.)

I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence.

How do we incentivize (or regulate?) companies to do a better job handling confidential data?

Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs.

A note of "Well, let's not be too hasty" would seem to be in order.

Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already.

Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be.

Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money.

One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.

From what I've seen people want jail time because of the insider stock trading, not because of the security problem itself. So a webdev wouldn't be responsible unless they also engaged in insider trading.

Why would all of the various criminal organizations across the world be deterred by something being illegal?

The logic you have laid out makes it sound like only white hats would ever try to attack a credit agency.

I'm pretty sure by the definition of black hat, and criminal organization, if these companies have something they want, and they have a technical means to get it, the fact that it's illegal is not a deterrent, it's actually their business model.

The vast majority of adversaries are incompetent or unmotivated. It's why breaches don't happen daily.

Look at it this way: If you get a pentest, you will immediately discover there were glaring security flaws that an attacker could have used to get into your network. This isn't true in every case, but for example I can count on one hand the number of companies I didn't get at least an XSS against.

I had no magic. I'm just a guy using Burp suite, working together with someone else using Burp suite. When two talented people work together to break your stuff, they pull out rabbits that nobody knew existed. Especially when they've been doing it full time every day for a year.

I'm sure black hats have talented people at their disposal. But they are selective. Launching a real operation against a US target is risky unless you live in Russia or work in China's army. And while it's valuable for Russian black hats to swipe Equifax's PII, other data troves typically aren't valuable enough to target.

To put it another way, if Russians got into Facebook, so what? They'd get everyone's sultry private messages. Yet Facebook cares more about security than almost anyone else. That's why it's almost impossible to swipe their data.

The vast majority of companies are in the "If Russians got in, it doesn't really matter; also we don't care" category. These are the mom and dad shops that use duct tape and glue for their payment processing. Above this are our companies: If Russians got in, it would be a minor disaster, but we care about preventing it. Except usually we don't care enough to put down $40k.

Then you have companies like Equifax. The worst of both worlds: They weren't careful enough with their security, and it was an unprecedented disaster when someone got in.

Yet even here, it's unclear how much this unprecedented disaster is going to materially harm people. Will those 140M SSNs show up on the black market for sale? Who will pay for them, and how much? (Hopefully it will be posted in full, in clear text, so we can all switch away from the stupid SSN system we've been relying on.)

So when it's a combination of not too valuable to attack you, very costly to improve your defenses, and not too harmful if you screw up, you get the present world: ~everybody is vulnerable, but few companies care enough to pay more than lip service. Why would they? Even if they lost everyone's data tomorrow, it would be little more than egg on their face.

This situation is changing, slowly. If the diff between 2008 and 2018 is like 2018 to 2028, we will be in excellent shape. But we have to avoid falling into traps like mandating regulation at every company, or sending people to prison. Those are tempting but misguided efforts: regulation would reduce the effectiveness of pentests, and sending people to prison will cause security breaches never to be reported.

It will be hard, particularly when the world reacts like this: https://i.imgur.com/g01f9vV.png But companies like Apple are paving the way forward. Even if they help no other companies, they are proof that security really can work at scale. The trick is to make it not cost Apple's resources to get remotely close to their security posture.

(I hate to pick on Russians specifically, but they have no extradition treaty with the US. It's uncontroversial to point out that many black hat attempts originate from there.)

It sounds more like, according to your thinking, these companies aren't compromised because they don't have anything that valuable.

I don't know... I think companies get penetrated often and are not aware. Or when they do know, they don't tell the public.

Facebook cares about security because there is something else at stake. Their trade secrets to start with avoiding being front run. But people will still care if they believe Facebook was not safe even if it's for superficial things.

> Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax.

Equifax did have good security hygiene. But they didn't have perfect security hygiene, and this particular gap cost them big time.

Most security incidents are like terror attacks that are averted. You read that authorities in Spain stopped an attack, and it means the system is working and people are safe. Then something explodes in London, and people are hurt, and you realize that there's no such thing as complete security.

It remains to be seen how much this will cost Equifax, IMHO. Public opinion aside, it may not come down to much in termw of dollars and it's dollars that drive behavioral changes.

Infosec guy here.

I don't believe those systems are necessarily any more secure than Equifax's. It may be that Equifax got breached first. But it's also partially because it's actually incredibly difficult to steal funds from traditional financial institutions. Not because of technical security measures. But because of procedure and regulations.

As an example, money illegitimately moved from bank A to bank B can (and in most cases must) be reversed. Even if done digitally.

I don't see sillysaurus3 defending Equifax. I see him talking about the elephant in the living room. No system is invulnerable yet the fortune and well being of half (or more) of the population of our planet depends on those systems being safe. We need a new paradigm. The basic principles of security, no matter how skillfully and deeply applied are inadequate to defend against a determined attacker. We need a new paradigm. I'm not sure what that is, and as long time Microsoft detractor, I'm loathe to say maybe Azure's just-announced secure enclave architecture just might be that new paradigm. Of course, I'm sure they'll fuck it up some way or another.

You're right. I mischaracterized sillysaurus3's position. I would only argue that there are different levels of competence in protecting data and some company has to be the worst. So far, Equifax seems to be that company. Right now, they are deserving of scorn. At the same time, sure, it's good to recognize that we're failing at security as an industry.

I agree with you 100%. I prefer to characterize our current security landscape as the "Bear Attack" model. If you run slow the bear will eat you first. But even if you run faster than anyone else the bear will still eat you when she catches you.

Like much of the infrastructure in the real world, the sad fact of cybersecurity is that in many cases, attacks aren't known merely because someone semi-informed has not committed much effort to getting in, or more likely, has not yet triggered an event that would publicize their intrusion.

sillysaurus may be overgeneralizing a bit but he is correct about the vast majority of companies. To me, the key differentiator between companies with serious security projects v. companies with me-too, mantlepiece-style security projects is active, engaged technical leadership at the very top.

This is not to defend Equifax as much as it's to desecrate the widespread dogma of the managerial class that an MBA qualifies a person to lead any project. Time after time after time, most of us who've worked in corporate America have seen security pushed to the bottom of the stack, only becoming a consideration for about 18 months after the last close call or underpublicized breach. There is virtually no appreciation for the problem itself at high levels, or the complexity involved in reasonably subjugating it.

CISO is something of a nightmare job because you're essentially the company's designated patsy/lightning rod. Most of the time, CISOs and those in analogous roles get stuck with the blame for the company's security without ever really being given the authority to do anything about it.

I knew a CISO who set up camp, including prop tent, outside of the CIO's office until he finally agreed to get his guys to patch a server. The CISO took a picture of himself doing so, because he knows the game; if the intrusion occurred, he would have apparent visual proof that would allow him to deflect blame onto the CIO.

Reckless disregard like this is absolutely common and routine, and if you have any doubt about that, a cursory inspection of the sites of companies that are not tech pioneers will easily disabuse you of any contrary notion. Equifax is not alone here, not by a long shot. Not even among large companies dealing with sensitive financial data (don't ask how I know).

The only reason we haven't seen (or, more likely, haven't learned about) widespread cyber-intrusion-apocalypse is because semi-competent people just have other things to do, and there is substantial legal risk if caught. I fully believe that 95% of America's biggest companies have systems that are easily penetrable.

Again, let me reiterate that this is not making an excuse for Equifax. It's just acknowledging that the problem supersedes this single instance. We need a revolution in system admin and application security before we'll solve these issues, because the plain fact is that companies simply can't be trusted to do it under the current conditions.