{"id":26702,"date":"2017-11-15T22:48:45","date_gmt":"2017-11-16T03:48:45","guid":{"rendered":"https:\/\/digital.hbs.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/"},"modified":"2017-12-01T22:56:20","modified_gmt":"2017-12-02T03:56:20","slug":"equifax-lessons-to-be-learned-about-online-security","status":"publish","type":"hck-submission","link":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/","title":{"rendered":"Equifax \u2013 lessons to be learned about online security"},"content":{"rendered":"

“As we move into the era of digitalization, are we ignoring the risks that come with it”<\/p>\n

The Equifax data breach<\/strong><\/p>\n

In September 2017, Equifax (a consumer credit reporting agency) announced that it was a victim of a cyber security breach with more than 143 million customer records compromised [1]. In October 2017, they announced that a further 2.5 million users may have had their information stolen from the Equifax servers [2].\u00a0In the age of digitalization as more and more companies move their assets and operations online, Equifax can serve as a wake up call regarding the importance of understanding the risks associated with this move.<\/p>\n

Exhibit 1.\u00a0<\/strong>Equifax homepage sharing the details of the cybersecurity incident [3].<\/p>\n

\"\"<\/a><\/p>\n

Equifax operates in the business to business space providing consumer credit information to its customers, ranging from insurance firms to banks and other financial institutions. While Equifax publicly announced about the breach in September, reports suggest that the hack took place months earlier in May-June 2017 [4] and that Equifax may have even known about the issue as early as July 2017, based on the fact that key executives ended up selling their stock options right after the data breach took place [5]. But were there visible signs that Equifax ignored that might have helped them mitigate the risks and prevent this attack from happening? The hackers exploited a security vulnerability,CVE-2017-5638 [6], associated with Apache struts, a software framework used by Equifax. The security issue was published on March 10 and was rated as a risk based on a CVSS score of 10 (please see Exhibit 2). Equifax had a lot of time to address the issue and in multiple instances security analysts reported the lack of support for security updates [7].<\/p>\n

Exhibit 2. <\/strong>The security issue that led to the Equifax breach(published on March 10,2017) [6].<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Some lessons to be learned<\/strong><\/p>\n

As a company moves into the digital space, all the positives that come along with it may conveniently drown out all the risks. Equifax made the same mistake and failed to acknowledge the inherent risks that came with the domain that they operated in. The annual report released by the company had zero keywords mentioning the risks associated with data breaches and Equifax may not be the only company at fault in this regard [8].<\/p>\n

Going through the list of all the companies that have had to deal with hacking incidents, from Yahoo to Sony, a common trend that a lot of companies have followed is that they first ignore the issue, then try to hide the issue once they become aware of the consequences and finally try to deny the extent of impact. This is exactly what happened in the case of Equifax as well.<\/p>\n

Equifax didn’t have the firewall to protect itself and the fact that they only announced the breach 3-4 months after it took place does not inspire confidence in their ability to even detect fraud, let alone protect against it. Some of the steps that companies exposed to security attacks should do is to understand the industry that they are in and have a well trained security team to keep their systems up to date. As security issues are exposed, it is extremely important to involve the community of white hats, a term used to describe an ethical computer hacker, by setting up bug bounty programs that rewards security experts for finding and reporting risks associated with your system. It is also extremely vital to have pre-set processes to deal with cases of security breaches and be in a position to protect your customers.<\/p>\n

Equifax may have been one of the largest security breaches but we have seen security issues affecting a whole range of well reputed companies ranging from JP Morgan Chase to Ebay, LinkedIn and Yahoo. Going through the list of officially reported security vulnerabilities, we can see that there are multiple security issues released every month and it requires a lot of time and effort to get on top of these issues [9]. Companies who have not updated their systems for a while, could find themselves in a situation in which they may have to re-configure a big part of their systems.<\/p>\n

As we go forward in this era of digitalization, we need to think about a few questions : Is Equifax a mere representation of an entire range of companies exposed to the risk of security breach? While it is imperative for companies to be aware of the inherent risks and damages which a security incident can cause, how can companies protect themselves in the time of the dark web and tor ? How should companies deal with the aftermath of a hacking attack ?<\/p>\n

[Word count : 785]<\/p>\n

Sources:<\/strong><\/span><\/p>\n

[1] https:\/\/www.cnbc.com\/2017\/09\/07\/credit-reporting-firm-equifax-says-cybersecurity-incident-could-potentially-affect-143-million-us-consumers.html<\/p>\n

https:\/\/www.theatlantic.com\/business\/archive\/2017\/09\/equifax-cybersecurity-breach\/539178\/<\/p>\n

[2] https:\/\/www.forbes.com\/sites\/winniesun\/2017\/10\/02\/what-you-should-do-now-after-the-equifax-security-leak\/#1ca73e482123<\/p>\n

[3] https:\/\/www.equifax.com\/personal\/<\/p>\n

[4] http:\/\/money.cnn.com\/2017\/09\/08\/technology\/equifax-hack-qa\/index.html<\/p>\n

[5]\u00a0https:\/\/www.npr.org\/sections\/thetwo-way\/2017\/09\/08\/549434187\/3-equifax-executives-sold-stock-days-after-hack-that-wasnt-disclosed-for-a-month<\/p>\n

[6] https:\/\/www.cvedetails.com\/cve-details.php?t=1&cve_id=CVE-2017-5638<\/p>\n

[7]\u00a0https:\/\/securityboulevard.com\/2017\/09\/the-equifax-breach-the-signs-were-there\/<\/p>\n

[8]\u00a0https:\/\/www.huffingtonpost.com\/entry\/the-equifax-breach-and-5-years-of-missed-warning-signs_us_59bf2480e4b06b71800c3b07<\/p>\n

[9]\u00a0https:\/\/www.cvedetails.com\/vulnerability-list\/year-2017\/vulnerabilities.html<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Equifax security breach- a few lessons that we can learn about online security<\/p>\n","protected":false},"author":9601,"featured_media":26703,"comment_status":"open","ping_status":"closed","template":"","categories":[4171,599,4169,4170],"class_list":["post-26702","hck-submission","type-hck-submission","status-publish","has-post-thumbnail","hentry","category-data-breach","category-digital-platform","category-equifax","category-internet-security","hck-taxonomy-organization-equifax","hck-taxonomy-industry-financial-services","hck-taxonomy-country-united-states"],"connected_submission_link":"https:\/\/d3.harvard.edu\/platform-rctom\/assignment\/rc-tom-challenge-2017\/","yoast_head":"\nEquifax \u2013 lessons to be learned about online security - Technology and Operations Management<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Equifax \u2013 lessons to be learned about online security - Technology and Operations Management\" \/>\n<meta property=\"og:description\" content=\"Equifax security breach- a few lessons that we can learn about online security\" \/>\n<meta property=\"og:url\" content=\"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Technology and Operations Management\" \/>\n<meta property=\"article:modified_time\" content=\"2017-12-02T03:56:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/security.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"3827\" \/>\n\t<meta property=\"og:image:height\" content=\"2870\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/\",\"name\":\"Equifax \u2013 lessons to be learned about online security - Technology and Operations Management\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2017\\\/11\\\/security.jpeg\",\"datePublished\":\"2017-11-16T03:48:45+00:00\",\"dateModified\":\"2017-12-02T03:56:20+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/#primaryimage\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2017\\\/11\\\/security.jpeg\",\"contentUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2017\\\/11\\\/security.jpeg\",\"width\":3827,\"height\":2870},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/equifax-lessons-to-be-learned-about-online-security\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Submissions\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Equifax \u2013 lessons to be learned about online security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/#website\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/\",\"name\":\"Technology and Operations Management\",\"description\":\"MBA Student Perspectives\",\"potentialAction\":[{\"@type\":\"性视界Action\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Equifax \u2013 lessons to be learned about online security - Technology and Operations Management","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/","og_locale":"en_US","og_type":"article","og_title":"Equifax \u2013 lessons to be learned about online security - Technology and Operations Management","og_description":"Equifax security breach- a few lessons that we can learn about online security","og_url":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/","og_site_name":"Technology and Operations Management","article_modified_time":"2017-12-02T03:56:20+00:00","og_image":[{"width":3827,"height":2870,"url":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/security.jpeg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/","url":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/","name":"Equifax \u2013 lessons to be learned about online security - Technology and Operations Management","isPartOf":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/#website"},"primaryImageOfPage":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/#primaryimage"},"image":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/#primaryimage"},"thumbnailUrl":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/security.jpeg","datePublished":"2017-11-16T03:48:45+00:00","dateModified":"2017-12-02T03:56:20+00:00","breadcrumb":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/#primaryimage","url":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/security.jpeg","contentUrl":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2017\/11\/security.jpeg","width":3827,"height":2870},{"@type":"BreadcrumbList","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/equifax-lessons-to-be-learned-about-online-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/d3.harvard.edu\/platform-rctom\/"},{"@type":"ListItem","position":2,"name":"Submissions","item":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/"},{"@type":"ListItem","position":3,"name":"Equifax \u2013 lessons to be learned about online security"}]},{"@type":"WebSite","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/#website","url":"https:\/\/d3.harvard.edu\/platform-rctom\/","name":"Technology and Operations Management","description":"MBA Student Perspectives","potentialAction":[{"@type":"性视界Action","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/d3.harvard.edu\/platform-rctom\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission\/26702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission"}],"about":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/types\/hck-submission"}],"author":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/users\/9601"}],"replies":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/comments?post=26702"}],"version-history":[{"count":0,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission\/26702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/media\/26703"}],"wp:attachment":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/media?parent=26702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/categories?post=26702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}