<story><title>Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes</title><url>https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832</url></story><parent_chain><item><author>azurezyq</author><text>If a hacker can use just one CVE to break into your system and do a database dump (or equivalent), the system is architecturally wrongly designed and only being protected by a single layer of security. Which means, any one from the inside can access pretty much the info as the hacker, which is horrible.&lt;p&gt;For example, are the items in DB encrypted? Are database backups encrypted? Are different items encrypted using different keys? I don&amp;#x27;t think EFX did it right.</text></item></parent_chain><comment><author>sillysaurus3</author><text>&lt;i&gt;If a hacker can use just one CVE to break into your system and do a database dump (or equivalent), the system is architecturally wrongly designed and only being protected by a single layer of security. Which means, any one from the inside can access pretty much the info as the hacker, which is horrible.&lt;/i&gt;&lt;p&gt;This is how it works at almost every company. Call it horrible if you want, but everyone stops short of describing &lt;i&gt;in detail&lt;/i&gt; the exact architectural replacement. And when someone does, it inevitably has flaws that make it impossible to meet business goals.&lt;p&gt;It&amp;#x27;s too easy to handwave this away as &amp;quot;well, get a better architecture.&amp;quot; Everyone knows that; the hard part is, what architecture? How does your architecture work in practice? Encrypting items won&amp;#x27;t help when the keys need to be stored in the same place to access the data. The attackers will just go after that box instead of the DB.&lt;p&gt;You can guard it more carefully, but the point is that &lt;i&gt;some&lt;/i&gt; box &lt;i&gt;somewhere&lt;/i&gt; needs access to a substantial amount of the data at any given time. It&amp;#x27;s the nature of a credit bureau.</text></comment>
<story><title>Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes</title><url>https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832</url></story><parent_chain><item><author>azurezyq</author><text>If a hacker can use just one CVE to break into your system and do a database dump (or equivalent), the system is architecturally wrongly designed and only being protected by a single layer of security. Which means, any one from the inside can access pretty much the info as the hacker, which is horrible.&lt;p&gt;For example, are the items in DB encrypted? Are database backups encrypted? Are different items encrypted using different keys? I don&amp;#x27;t think EFX did it right.</text></item></parent_chain><comment><author>patcheudor</author><text>&amp;quot;the system is architecturally wrongly designed&amp;quot;&lt;p&gt;Like:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.fastcompany.com&amp;#x2F;40468811&amp;#x2F;heres-why-equifax-yanked-its-apps-from-apple-and-google-last-week&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.fastcompany.com&amp;#x2F;40468811&amp;#x2F;heres-why-equifax-yanke...&lt;/a&gt;</text></comment>