Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by wavegeek on Saturday September 16, 2017 @05:09AM (#15263725)

> stupid

I am not defending the totality of EFX's process by any means. I am just pointing out that "install every high severity patch right away" is not as easy as it looks.

Others have pointed out this patch was not available for all current versions, for example. So, to install the patch you need to upgrade. Oh, that breaks <dependency>. So we need to upgrade <other thing>. But that regresses a feature we use ....

The major issue with EFX was the fragility of their overall architecture. A single weakness should not be enough to lay the whole DBMS open.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by georgebarnett on Monday September 18, 2017 @01:24AM (#15273579)

There are great reasons for not installing patches right away.

"There might be an outage" is not one of them.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by speedplane on Saturday September 16, 2017 @07:38AM (#15264162)

The tech industry has to move more towards declarative systems, rather than procedural ones. Docker, Kubernetes and similar tech can auto-update in the background without any downtime. It's impossible to maintain thousands of VMs without some sort of declarative system.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by qaq on Saturday September 16, 2017 @07:59AM (#15264227)

Each thing you are listing increases complexity and attack surface.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by speedplane on Saturday September 16, 2017 @08:01AM (#15264232)

It actually decreases complexity. Updating 1000 VM servers using these technologies can be made automatic. True, it provides an additional attack surface, but the gains of having everything always patched are well worth it.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by qaq on Saturday September 16, 2017 @08:13AM (#15264278)

Everything does not include your actual app, so yes it's convenient but doesn't really help that much

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by speedplane on Wednesday September 20, 2017 @05:17AM (#15291899)

I'd argue that convenience is a security feature. The easier something is to do, the fewer mistakes you or your team will make.

Stand by my initial post, declarative systems will become more and more popular and will improve security.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by thehardsphere on Saturday September 16, 2017 @04:40PM (#15266622)

What is the non-tech industry supposed to do?

[ Parent | on HN ]