University Report: Equifax Data Breach of 2017 - Detailed Analysis

This report analyzes the 2017 Equifax data breach, detailing the background of the company and the industry, and providing an overview of the breach itself. It identifies the major happenings, including the use of Apache Struts and the delayed patching of vulnerabilities. The root cause of the breach is attributed to a web application vulnerability (CVE-2017-5638) and the time taken to apply patches. The report assesses the financial impact, estimating costs related to investigations, lawsuits, and security investments. Recommendations include credit freezing, fraud reports, credit monitoring, and ID theft protection. References to relevant sources are also provided, offering a comprehensive understanding of the event and its implications.

Equifax Data Breach of 2017
Name of the Student
Name of the University

Background and Industry
 It is a consumer credit reporting agency
 Equifax comprises of 800 million employees
 The company possesses $3.1 billion in annual revenue
 Over 9000 employees are situated in 14 countries
 They operate and have investments in 24 countries

Background of Data Breach
 The application vulnerability was discovered at Equifax on Sept 7,
2017
 Equifax had suffered the major data breaches that affected nearly 143
employees (DiGrazia, 2017)
 This data breach had occurred in the US, UK and Canada
 182,000 personal identifiable numbers and 209,000 credit card
numbers had been stolen

Data Breach Overview Report
Fig 1: (Ranking of the Equifax Data Breach)
(Source: DiGrazia, 2017)

Major Happenings in the Breach
 Apache Struts was primarily used in the incident
 The company was aware of the vulnerabilities within their systems
 This vulnerability was mainly detected and patched at a much
longer time
 Customers and stakeholders were alerted almost a month after the
attack

Root Cause of the Breach
 The attackers had penetrated the systems in mid-May
 The primary source was through a web application vulnerability. The
patch of the attack was available in March.
 The Apache Struts is a web-application software and a widely used
platform in the attack
 CVE-2017-5638 Apache Struts vulnerability is the prime cause of the
data breach

Analysis of the Breach
(Fig 2: Brief Analysis of GAO Report on Equifax 2017 Breach)
(Source: Analysis of the GAO Report on the 2017 Equifax Breach, 2019)

Root Cause of the Breach
 The patching time had consumed much amount of time
 The patching process is not simple and thus had complexities in
implementation
 Patch Deployment and verification process is difficult and time-
consuming (Miller, 2018)
 The data compromise was mainly due to failure in installing security
updates

Financial Impact of the Breach
 The data breach had affected a cost of $90 million to the company
 Further investigation proved that the organisation had been affected
by $600 million
 The overall costs had included costs based on civil lawsuits and
government investigations (Bouveret, 2018)
 Equifax forecasts to invest $60 and $75 million on implementation of
security strategies

Recommendation to the Breach
(Fig 2: Recommendations to Equifax based on Breach)
(Source: Analysis of the GAO Report on the 2017 Equifax Breach, 2019)

Recommendation to the Breach
 Credit freezing for the credit reports of an individual
 Placement of a fraud report based on credits
 Implementation of credit monitoring services for tracking
changes within credit reports
 ID theft protection should be installed within the application
systems

References
Analysis of the GAO Report on the 2017 Equifax Breach. (2019).
Retrieved from https://castraconsulting.com/GAO-Equifax-Breach-
Report
Bouveret, A. (2018). Cyber risk for the financial sector: a
framework for quantitative assessment. International Monetary
Fund.
DiGrazia, K. (2017). Cyber Insurance, Data Security, and
Blockchain in the Wake of the Equifax Breach. J. Bus. & Tech. L.,
13, 255.
Miller, L. (2018). Cybersecurity Insurance: Incentive Alignment
Solution to Weak Corporate Data Protection.