Equifax securities fraud class action [pdf]
securities.stanford.edu
Equifax securities fraud class action [pdf]
1–10 of 227 posts
Re: Equifax securities fraud class action [pdf]
#2How is that possible with all the regulation?
Re: Equifax securities fraud class action [pdf]
#3Where does it say they used the defaults for their "main database"? As far as I'm aware it was "only" the password for a management portal for customer complaints, not the keys to the kingdom.
Re: Equifax securities fraud class action [pdf]
#4> "Furthermore, Equifax employed the username “admin” and thepassword “admin” to protect a portal used to manage credit disputes, a passwordthat “is a surefire way to get hacked.”"
The document does not state any further detail than this, so it is a bit unclear as to what exactly was located on this portal - does not seem like it was their main database anyhow.
Still incredibly incompetent though.
Re: Equifax securities fraud class action [pdf]
#5I’m genuinely curious how this happens. I remember my first job in the industry, just out of university. I knew nothing about security, but still wouldn’t have done that. My first gig was in a credit union software company, and the security standards were nonexistent, yet we still had more reasonable passwords than this (which sounds like an installation default).
Re: Equifax securities fraud class action [pdf]
#6How is that possible with all the regulation?
Because regulation is only as good as its enforcement.
Re: Equifax securities fraud class action [pdf]
#7How is that possible with all the regulation?
Regulation means nothing without proper auditing and enforcement. Question is how are countries (US in this case) not enforcing the most basic regulation...
Re: Equifax securities fraud class action [pdf]
#8I’m genuinely curious how this happens. I remember my first job in the industry, just out of university. I knew nothing about security, but still wouldn’t have done that. My first gig was in a credit union software company, and the security standards were nonexistent, yet we still had more reasonable passwords than this (which sounds like an installation default).
I'll tell you how this happens:
Colleague #1: "What password shall we set?"
Colleague #2: "Just leave it default for now as we're still testing, we will change it later".
Re: Equifax securities fraud class action [pdf]
#9How is that possible with all the regulation?
I work with financial software and you'd be surprised how much of all this "regulation" is based on self assessments. Auditors are looking for liability shifts, not real security.
Re: Equifax securities fraud class action [pdf]
#10At least they had a password /s