Equifax Data Breach

p class=BodyIn recent days the world has become familiar with perhaps the largest data breach event ever known to humanity. I’m referring, of course, to the Equifax data breach./pp class=BodyThe incident, as summarized by a href=https://www.equifaxsecurity2017.com/Equifax Security/a, potentially impacts personal information relating to 143 million U.S. consumers – primarily names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. In addition, credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed./pp class=BodyInformation potentially stolen by the hackers, including Social Security numbers and dates of birth and names, could put people at risk of identity theft for the rest of their lives, credit experts warn. /pp class=BodySo how did such a massive breach happen?/pp class=Bodya href=https://www.usatoday.com/story/money/2017/09/14/equifax-identity-theft-h... Today/a notes that hackers took advantage of an Equifax security vulnerability two months after an industry group discovered the coding flaw and shared a fix for it, raising questions about why Equifax didn't update its software successfully when the danger became known:/pp class=BodyThe Equifax data compromise was due to (Equifax's) failure to install the security updates provided in a timely manner, The Apache Foundation, which oversees the widely-used open source software used by Equifax, said in a statement./pp class=BodyAt the time of USA Today’s article publication, Equifax had not responded to questions about when the patches were used to fix the security weak point, or if the patches were used at all./pp class=BodyIt only made this statement: We continue to work with law enforcement as part of our criminal investigation and have shared indicators of compromise with law enforcement.”/pp class=p-textUSA Today also reported the critical comments of other cybersecurity professionals:/pp class=p-text“They should have patched it as soon as possible, not to exceed a week. A typical bank would have patched this critical vulnerability within a few days,” said Pravin Kothari, CEO of CipherCloud, a cloud security company./pp class=p-textBy all accounts it appears that one of the fundamental reasons for the Equifax data breach stemmed from a failure or lack of timely attention to applying critical software patches. Arguably, had the patches been applied in a timely fashion none of the ensuing issues would have occurred./pp class=p-textspan style=text-decoration:underlineExamples of Preventive Measures For Avoiding a Data Breach/spanspan style=text-decoration:underline/span/pp class=p-texta href=https://iprsecure.com/7-preventative-measures-for-avoiding-a-data-breachIPR Secure/a notes that companies should take the following measures to avoid becoming another Equifax:/ppspan style=text-decoration:underline1. Stay Up-To-Date On Software/spanspan style=text-decoration:underline/span/pp class=p-textInstall anti-virus software on servers and implement application firewalls. Any software or programs that are not up to date can increase risk and serve as an entryway for hackers./ppspan style=text-decoration:underline2. Credit Freeze/span span style=text-decoration:underline/span/pp class=p-textNearly half of Americans may have had their information stolen in the massive Equifax data breach recently, and experts say freezing your credit is one line of defense. /pp class=p-textAccording to the Federal Trade Commission, this tool lets you restrict access to your credit report, which in turn makes it more difficult for identity thieves to open new accounts in your name. That’s because most creditors need to see your credit report before they approve a new account. If they can’t see your file, they may not extend the credit./pp class=p-textIf you opt for a temporary lift because you are applying for credit or a job, and you can find out which credit reporting company the business will contact for your file, you can save some money by lifting the freeze only at that particular company./ppspan style=text-decoration:underline3. Monitor Access to Your Data/spanspan style=text-decoration:underline/span/pp class=p-textRequire multi-step authentication processes for employee access, verifying business reasons for each system access, logging and monitoring employee use to identify unusual system patterns or behaviors, installing secure internet access points, and using IP address profiling to prevent any unauthorized access. Be aware of any unusual network activity and data transmissions to unknown hosts./ppspan style=text-decoration:underline4. Change Passwords Frequently/spanspan style=text-decoration:underline/span/pp class=p-textThere are many preventative actions when it comes to passwords, including using longer passwords with a variety of numbers and symbols, different passwords for different systems, mandatory password changes every 90 days, or requiring employees to “sign out” a specific administrator password so passwords aren’t floating around and easily obtainable by a hacker, both internal or external./ppspan style=text-decoration:underline5. Take Physical Security Measures/spanspan style=text-decoration:underline/span/pp class=BodyPhysical measures for safeguarding information can involve restricting access to facilities to prevent physical intrusions, monitoring computer equipment, locking up particular rooms or file cabinets housing sensitive information, and also shredding documents./ppspan style=text-decoration:underline6. Educate Employees On Security Threats/spanspan style=text-decoration:underline/span/pp class=BodyIt is important to educate employees on data security to reduce breaches from negligent behavior./ppspan style=text-decoration:underline7. Periodic Risk Assessments/spanspan style=text-decoration:underline/span/pp class=BodyWith periodic assessments, whether through internal audits or third party expertise, you can assess new areas of concern for potential security risks./ppspan style=text-decoration:underline8. Implement an Incident Response Plan/spanspan style=text-decoration:underline/span/pp class=BodyFor example, you should be prepared with resources your customers can access following a breach to prevent fraudulent charges to their accounts or phishing attempts./pp class=BodyIn conclusion, while it appears that data breaches seem to be on the rise, there are practical solutions that can be taken that will go a long way toward mitigating the risk of data breaches in the future. The first step for any company is to change its mentality. Companies must become proactive, not reactive—aggressive, not passive. Take dramatic action now instead of waiting for a crisis to hit./p