https://rietta.com/tags/data-breach/ Recent content in Data Breach on Rietta Cybersecurity Hugo -- gohugo.io en-us 1999-2026 Rietta Inc. All Rights Reserved. https://rietta.com/blog/equifax-defense-in-depth/ Mon, 18 Sep 2017 00:00:00 -0400 https://rietta.com/blog/equifax-defense-in-depth/ <p>Equifax has confirmed that the main vector that lead to the data breach was a remote code execution vulnerability in Apache Struts that had been known for months [<a href="https://rietta.com/blog/equifax-defense-in-depth/#equifax-announcement">1</a>]. Equifax had not yet patched it within the production environment. This is not just a lesson in the importance of patch management but one of defense in depth. The weakness in Equifax&rsquo;s design was set in motion years before when they failed to design with the assumption that the front-end web server would be compromised.</p> <p>The attacker was able to obtain the massive trove of private data because the web application was the only gatekeeper. Once the remote code execution vulnerability was exploited, the attacker was able to access data unfettered by additional access controls. Equifax chose to use a typical web application architecture without defense in depth.</p> <p>Defense in depth has to start as part of the development process. All developers should be aware of the OWASP Top 10 (<a href="https://rietta.com/blog/equifax-defense-in-depth/#owasp-top10">#3</a>) and their work should be audited against the OWASP Advanced Security Verification Standard (ASVS) [<a href="https://rietta.com/blog/equifax-defense-in-depth/#owasp-asvs">#3</a>] for the level appropriate for the risk faced by an organization in the event of a security breach.</p>