Re:House Oversight Committee Report on Equifax Breach [pdf]
by txcwpalpha on Monday December 10, 2018 @06:25PM
(#18652045)
> It's almost inconceivable that they could let seventy nine certificates that are required for security monitoring expire for months on-end.
Even worse, the "seventy nine" figure was just the certs that were associated with "critical" systems. The total number of expired certs was at least 324.
> At the time of the breach, however, Equifax had allowed at least 324 of its SSL certificates to
expire. Seventy-nine of the expired certificates were for devices monitoring highly business
critical domains.
Even worse, the "seventy nine" figure was just the certs that were associated with "critical" systems. The total number of expired certs was at least 324.
> At the time of the breach, however, Equifax had allowed at least 324 of its SSL certificates to expire. Seventy-nine of the expired certificates were for devices monitoring highly business critical domains.
(from pg 70 of the report)