Equifax’s Maddening Unaccountability • Hacker News Board

Re: Equifax’s Maddening Unaccountability

#11

Post by bob1029 » Mon, Sep 11, 2017, 11:20 PM UTC

cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

>but I doubt this leak will have any lasting financial impact.

I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There will be new PII regulations around the corner for sure.

I also question the extent of the leak... I keep hearing it was just basic PII, but if someone got a dump of the entire credit history database, a huge range of financial products (e.g. Knowledge-Based Authentication) become entirely compromised.

Re: Equifax’s Maddening Unaccountability

#12

Post by maxxxxx » Mon, Sep 11, 2017, 11:21 PM UTC

cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

I thought about that too but it could also be possible that they may get bankrupted by lawsuits. I don't see Equifax as victim. I hope they will go down and be warning for the rest of the financial industry.

Re: Equifax’s Maddening Unaccountability

#13

Post by kahnjw » Mon, Sep 11, 2017, 11:21 PM UTC

iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy.

Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked, whatever, just a few hundred million customers data exposed to identity fraud. It takes a chunk out of Equifax stock but they'll probably survive. What is the incentive for congress to enact laws regulating corporate handling of consumer data?

Put it this way. Who do you think is louder in Washington: consumer advocacy groups or corporate lobbyists?

Re: Equifax’s Maddening Unaccountability

#14

Post by snarf21 » Mon, Sep 11, 2017, 11:22 PM UTC

iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

So true, keep your head down and wait for your bonus. Everyone in middle management is too busy with self preservation to bother doing what's best for the company.

Re: Equifax’s Maddening Unaccountability

#15

Post by KGIII » Mon, Sep 11, 2017, 11:26 PM UTC

kahnjw wrote: post #13

iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked…

I'm not sure they actually care in Washington. I was impacted by the OPM breech. I got a form letter and some credit monitoring. All that outrage and, as near as I can tell, not a damned thing has changed.

I might be biased and jaded.

Re: Equifax’s Maddening Unaccountability

#16

Post by drawkbox » Mon, Sep 11, 2017, 11:26 PM UTC

iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

It is sometimes a maddening fight to get software quality shipped and not ship a maintenance nightmare in certain orgs. This especially depends on if the company is engineering led or more bizdev/mba led or how much the latter values engineering.

Equifax is a business that is not engineering led today and probably will never be as it is a credit agency and not consumer focused. For a company that has been around since 1899 and through many technological changes, they should have really focused more on cyber security in this age. Then again, Equifax is not a consumer company, they are a credit agency and only answer to their customers that probably don't value spending on securing personal data as the ones that are accessing Equifax want that data.

The question is, should a company that doesn't care (nor their stakeholders) about securing data as a way they make their money, should they be in control of all that data?

Re: Equifax’s Maddening Unaccountability

#17

Post by alexasmyths » Mon, Sep 11, 2017, 11:27 PM UTC

iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

To be fair, it's not 'technical competency' but rather a broad range of operational, process, product and engineering competencies.

Also, a lot of companies just don't have a thoughtful process for this.

Think of how much data Google and FB have, and they've never been breached. As much as I loathe them, I actually feel more 'secure' with the data that is supposed to be secure with FB than with my local bank.

FB depends on talent, banks depend on thick process, regulation and massive risk aversion.

Equifax depends on mediocre eng, product, ops etc..

Re: Equifax’s Maddening Unaccountability

#18

Post by kahnjw » Mon, Sep 11, 2017, 11:27 PM UTC

KGIII wrote: post #15

kahnjw wrote: post #13

Earlier quoted context omitted.

You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked…

I'm not sure they actually care in Washington. I was impacted by the OPM breech. I got a form letter and some credit monitoring. All that outrage and, as near as I can tell, not a damned thing has changed. I might be biased and jaded.

Thats exactly what I'm saying. There is near zero incentive for congress to enact consumer protection legislation.

Re: Equifax’s Maddening Unaccountability

#19

Post by cloakandswagger » Mon, Sep 11, 2017, 11:29 PM UTC

bob1029 wrote: post #11

cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There w…

Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M?

Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.

Re: Equifax’s Maddening Unaccountability

#20

Post by mbesto » Mon, Sep 11, 2017, 11:30 PM UTC

iamleppert wrote: post #7

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...