Introduction

The Equifax data breach has been called “one of the worst security mishaps ever” (CNN, 2017). The massive data leak is estimated to have affected over 145.5 million people in the United States alone. The Equifax data breach occurred on July 29, 2017, when an unknown hacker or group of hackers managed to break into an Equifax server and steal personal data from thousands of Americans. The stolen information included names, social security numbers, and birth dates (Wiener-Bronner & Danielle, 2017). This information can be used for identity theft purposes or sold on the black market for a high price (Refer to appendix 1 for the data breach process).

The previous finding reveals that the Equifax hack was made possible because the company failed to secure its network and servers properly, allowing attackers to access sensitive customer information efficiently. This case study will examine the actions taken by Equifax after the breach occurred and what it could have done differently to prevent this situation from happening in the first place.

Body

Significance

Data breaches are not a new phenomenon. They have been going on for quite some time now. This is despite the security measures put in place by companies and governments to protect sensitive information from being accessed by hackers. Data breaches have become more common as technology has advanced, making it easier for hackers to access sensitive information. The Equifax data breach case is one among many other data breaches that have been reported in the recent past. The significance of this research is to help other companies learn from Equifax’s mistakes to keep their customers safe and secure. This study will also allow other companies to build stronger relationships with their customers by being transparent about what they are doing to protect them from cybercriminals like those who attacked Equifax in 2017.

Root Cause

The root cause of the breach was not a “0-day” vulnerability in Apache Struts 2. It was a failure to apply a critical patch for the vulnerability available since March 7, 2017. That patch should have been applied within 30 days and would have prevented the attack. The Equifax data breach occurred because Equifax failed to install security updates for three months after Apache released them (Wiener-Bronner & Danielle, 2017). Equifax did not have patch management; they ran vulnerable software without patches or updates. Equifax did not have proper access controls to prevent unauthorized users or systems from accessing sensitive data.

Lessons

The data breach wasn’t not just about the number of records stolen but also how much each record is worth when it comes to identity theft. Moreover, it is essential to remember that you cannot rely on a single company for your information protection; you need to take steps yourself to protect your data. Another important lesson is that there is no such thing as 100% security; even if you follow best practices, there are still risks involved in data breaches and cyberattacks. Therefore, it is necessary to stay vigilant and keep an eye out for suspicious activity in your accounts or credit report (O.G.R, 2018). Finally, it takes individual responsibility to regularly check your credit report and make sure there are no fraudulent accounts opened under your name.

In response to this incident, Congress held hearings and issued a report on the incident; it included recommendations for how Congress might better protect Americans from future cyber security threats. The following are some of the key lessons we should take away from this experience: Companies need to be more transparent about data breaches when they happen, not just when they are forced by law or public pressure to do so. Consumers should have better tools available to them to protect themselves from identity theft. Moreover, companies should have more substantial legal incentives to secure customer data, and Congress needs to pass legislation that provides for more accountability in cases like Equifax’s (Wiener-Bronner & Danielle, 2017).

This research has significant implications for cybersecurity incident response and cyber workforce preparation. It is critical to swiftly notify and disclose discovered data breach events following compliance requirements to prevent legal consequences and unfavorable public opinions of the firm in the event of a underlying discovery of responsibility. Effective communication skills are essential components of educational programs and the evaluation of student learning outcomes (Primoff & Kess, 2017). Public communication competencies and abilities should be included in cybersecurity curricula and courses, given the growing need for competent cybersecurity workers. Furthermore, cybersecurity program evaluation and certification should cover public communication capability for cyber incident response and management (Wang & Park, 2017).

Steps to Secure Personal Data

Following the Equifax data breach, consumers need to take steps to protect themselves from identity theft. The following are some tips for doing so: A credit freeze allows one to prevent the credit bureaus from releasing your information to creditors, insurance companies, and other businesses that request it. A freeze must be lifted temporarily if you want to apply for a new loan or credit card. However, doing so requires contacting each of the three major credit bureaus individually. A security freeze will not block access to existing credit accounts or services; it will only prevent new lines of credit from being opened in your name without authorization. Also, individuals should consider placing a fraud alert on personal accounts. A fraud alert means that anyone who requests your information must take additional steps, such as calling you directly or sending you a letter asking for confirmation of the application before providing it. Fraud alerts are free but only last 90 days unless renewed by filing an affidavit with all three credit bureaus.

Results of the Investigation

The investigation results confirm that the attackers exploited a vulnerability in Apache Struts CVE-2017-5638 to gain access to Equifax’s systems (Wiener-Bronner & Danielle, 2017). The vulnerability was patched on March 6, 2017. However, Equifax did not install the patch for over two months.

The company failed to identify and address vulnerabilities in its system and software. This included unpatched software, known open-source vulnerabilities, and SQL injection flaws. The company also was unable to configure its firewall to prevent or detect unauthorized access properly. Moreover, the company did not conduct sufficient due diligence when choosing third-party vendors for network security, website hosting, and data analytics (Equifax, 2020). These deficiencies were compounded by Equifax’s failure to manage third-party vendors after the contract award adequately.

Equifax did not have sufficient policies and procedures in place to ensure that third-party service providers met its standards for information security controls. Equifax did not perform periodic reviews of third-party service providers to determine whether their practices were consistent with Equifax’s expectations or contractual obligations. Also, it didn’t require those service providers to report security incidents if they occurred on their systems (although Equifax did require those service providers to report certain types of incidents).

Additionally, the investigation found that when the attacker accessed an administrator account, they could use command-line utilities that are part of Equifax’s legacy operating system to take complete control over a server (Equifax, 2020). These utilities have root privileges by default and do not require authentication before being used by an administrator or an account holder.

Recommendations

The Equifax Data Breach Case is a study that illustrates the importance of data security and the risks associated with not having a firm I.T. policy in place. Data breach notification laws should be strengthened to require companies to provide timely, clear, and consistent information to consumers about any data breaches, including the types of information compromised, the number of individuals affected, and steps they can take to protect themselves (Gaglione Jr, 2019). Companies should also be required to report data breaches promptly. Companies should be required to provide notice within 30 days after discovering a breach if the personal information that compromises security or privacy is subject to unencrypted storage or transmission or stored on an unencrypted device. The FTC should have authority over the CFPB’s proposed rulemaking for data security standards for financial institutions and credit bureaus, including Equifax Inc., Experian PLC, TransUnion Corp, and other entities with access to large amounts of Americans’ sensitive personal information (Gaglione Jr, 2019). Congress should consider passing legislation that would require credit reporting agencies like Equifax Inc. Such companies hold vast amounts of personal information about Americans to notify consumers when their personal information has been compromised so they can take action to protect themselves from identity theft and fraud.

Individuals should be wary of their data. People should consider placing a fraud alert or credit freeze on their accounts. A fraud alert warns creditors that someone is trying to open an account in your name and asks them to verify your identity before issuing new credit. With a credit freeze, no one can open an account using your personal information unless they unfreeze it first by contacting you and providing proof of their identity (Gaglione Jr, 2019). Both are free and effective, but they have drawbacks: Fraud alerts last 90 days and may not stop every account application, while freezes require you to contact each bureau separately if you want to apply for new credit or get a loan.

Conclusion

The Equifax data breach is a defining moment for cybersecurity. It is one of the most significant data breaches to date, exposing the personal information of more than 145.5 million Americans (Davidson, 2018). The significance of this breach cannot be understated. The sheer scale of compromised personal information is staggering, and Equifax has acknowledged that it may not accurately picture how many consumers were affected by this breach. Equifax case study is an example of the many commercial business data breach cases experienced worldwide. Future research in this field may include cybersecurity incident response for government and non-profit businesses, such as healthcare institutions and learning institutions with a less economic incentive. Given the growth in ransomware cases, future research on cybersecurity incident handling should focus more on ransomware attacks.

Bibliography

Marinos, N., & Clements, M. (2018). Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach. United States Government Accountability Office, Report to Congressional Requestors. https://www.warren.senate.gov/imo/media/doc/2018.09.06%20GAO%20Equifax%20report.pdf

Primoff, W., & Kess, S. (2017). The Equifax data breach: What CPAS and firms need to know now. The CPA Journal, 87(12), 14-17. https://www.proquest.com/openview/920e319e470ab16320958d972ae8aa00/1?pq-origsite=gscholar&cbl=41798

Gaglione Jr, G. S. (2019). The Equifax data breach: an opportunity to improve America’s consumer protection and cybersecurity efforts. Buff. L. Rev., 67, 1133. https://heinonline.org/HOL/LandingPage?handle=hein.journals/buflr67&div=34&id=&page=

Equifax. (2020). Company Profile. https://www.equifax.com/about-equifax/who-we-are/

Wiener-Bronner, Danielle (2017, September 13). Equifax breach: How a hack became a public relations catastrophe. http://money.cnn.com/2017/09/12/news/companies/equifax-pr-response/index.html

Davidson, P. (2018, March 1). Equifax finds an additional 2.4 million Americans impacted by the 2017 data breach. https://www.usatoday.com/story/money/personalfinance/2018/03/01/equifax-findsadditional-2-4-million-americans-impacted-2017-breach/384381002/

Oversight & Government Reform, (Dec 2018). Report by U.S. House of Representatives Committee on Oversight and Government Reform; The Equifax Data Breach Majority Staff Report 115th Congress December 2018. https://republicans-oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf.