CPIS 621: Analysis of the Equifax Data Breach and Security Failures

This report analyzes the 2017 Equifax data breach, detailing the vulnerabilities exploited by attackers. The breach initiated through a consumer complaint web portal utilizing the CVE-2017-5638 vulnerability, allowing attackers to access multiple servers due to poor system segmentation. Further, usernames and passwords were stored in plain text, granting broader system access. The attackers were able to extract data undetected for months due to Equifax's failure to renew an encryption certificate. The report highlights the IT management problems and suggests recommended solutions such as applying patches, conducting vulnerability scans, system segmentation, employing innovative technologies, and renewing encryption certificates. The report concludes with a summary of the breach's implications and offers suggestions for improved security practices.

Running head: WEB APPLICATION SECURITY
WEB APPLICATION SECURITY
Name of the Student
Name of the University
Author Note:

1WEB APPLICATION SECURITY
Table of Contents
Introduction......................................................................................................................................2
Reason of Attack..............................................................................................................................2
Recommended Solution for each attack..........................................................................................3
Conclusion.......................................................................................................................................4
References........................................................................................................................................5

2WEB APPLICATION SECURITY
Introduction
The following report deals with Equifax, which is considered as biggest credit reporting
agencies for consumers in the whole United States. In 2017, the system of this organization was
breached, and all the sensitive personal data of Americans were compromised.
In the coming section of the report, reasons and possible recommendation of attack has
been discussed in brief.
Reason of Attack
1. Equifax was hacked by making use of consumer complaint on web portal where the
attack was widely using the vulnerability (CVE-2017-5638). In the beginning
announcement, the organization stated that their system was infiltrated in between May
and July of 2017. This particular vulnerability has enabled miscreants to enter into
Equifax system (Zou et al. 2018). It ultimately affected the data breach, which was due to
vulnerability named as Apache Struts CVE-2017-5638.
2. Equifax was initially hacked through consumer complaint web portal which has hackers
(Nurse 2017). Attackers were unable to find both user id and passwords, provided stored
in the form of plain text which provided them to have access the system further. In was
even reported that Equifax initial breach highlighted that web portal was secured by
making use of worst username and password combination. The used password can be
easily guessed and cracked.
3. The attackers can find to find both username and password, stored in the plain text, which
gained them to have access to the system completely (Zou and Schaub 2018).
4. The attackers were provided to take out data in the encrypted form of undetected for a
long time as the organization did not renew its encryption certificate. Equifax has certain

3WEB APPLICATION SECURITY
tools which were used for decrypting and analysis of the network. It comes up with the
power to sniff out the data exfiltration (Wang and Johnson 2018). To completely re-
encrypt the traffic, the public need public-key certification taken from a third party.
Equifax ultimately failed to renew one their certification near ten months ago.
5. Equifax does not publicize the whole data breach until the month when this discovered.
Most of the executives at Equifax sold the stocks of the company in the starting of
August (Kenny 2018). It merely gave rise to suspicious where they have an inevitable
decline in the stock price, which ensured all information came out (Berghel 2017).
Equifax cleared the whole thing by stating that one level of exec was wholly charged
with insider trading.
Recommended Solution for each attack
1. IT team at Equifax needs to apply the patch when the vulnerability came into the picture.
As per the reports from The Department of Homeland Security and software vendor, the
data breach occurred as the organization failed to apply the patch elimination
vulnerability. The security team at an organization need to conduct a scan if there is any
vulnerability existed in the system. The breach was due to IT management problem in the
organization. Equifax needs to have updated software scanning as it can detect any
vulnerability within the system.
2. Equifax was aware that vulnerability existed in their system, and another possibility is
that software used for scanning was completely ineffective. Attackers were complexly
able to completely from a web portal to another server, so they need to segment from one
system to another.

4WEB APPLICATION SECURITY
3. Equifax needs to make use of innovative technologies so that it can reduce the collection
of personal data. There were many initiatives to enhance privacy protection in data
science. In addition, Equifax needs to adopt and developed for protecting consumer data.
4. Equifax has tools which can be used for decryption, analysis and followed by re-
encryption of internal network traffic. The organization lacked proper public-key
certification as they do not renew on a yearly basis. The organization failed to renew one
of its certificates ten months ago.
5. Equifax failed from the perspective to ethically and lawfully at their management level.
The organization made a fraud that it does not notify its customers regarding the vital
information. Equifax should have focused on preserving the interest of their customers or
other stakeholders ultimately.
Conclusion
From the above of report, it can be concluded that Equifax credit card date breach was
reported organization in the whole United States. The system of this organization has been
breached of personal details of Americans.

5WEB APPLICATION SECURITY
References
Berghel, H., 2017. Equifax and the latest round of identity theft roulette. Computer, 50(12),
pp.72-76.
Kenny, C., 2018. The Equifax Data Breach and the Resulting Legal Recourse. Brook. J. Corp.
Fin. & Com. L., 13, p.215.
Nurse, S., 2017. The Equifax Data Breach. The New York Times.
Wang, P. and Johnson, C., 2018. CYBERSECURITY INCIDENT HANDLING: A CASE
STUDY OF THE EQUIFAX DATA BREACH. Issues in Information Systems, 19(3).
Zou, Y. and Schaub, F., 2018, April. Concern But No Action: Consumers' Reactions to the
Equifax Data Breach. In Extended Abstracts of the 2018 CHI Conference on Human Factors in
Computing Systems (pp. 1-6).
Zou, Y., Mhaidli, A.H., McCall, A. and Schaub, F., 2018. " I've Got Nothing to Lose":
Consumers' Risk Perceptions and Protective Actions after the Equifax Data Breach.
In Fourteenth Symposium on Usable Privacy and Security ({SOUPS} 2018) (pp. 197-216).