Lessons that all business leaders can learn from the Equifax data breach, exploited by cyber criminals in 2017.

1. Lessons Learned from Equifax Breach
Dr Chaditsa Poulatova
Cyber Rescue
International Advisor
16th May 2018
These sides can be downloaded from our LinkedIn page:
www.linkedin.com/company/cyber-rescue-alliance
Or at this short URL: www.tinyurl.com/cyber999

2. LESSONS TO BE LEARNT AND
MISTAKES NOT TO BE REPEATED
1. Mitigating the Cyber Risks is a Cross-departmental issue
2. Good Governance vs Poor Governance
3. A well thought response plan in place: who to be informed and when?
4. Communication channels should be prepared in advance
5. Cyber Security Ethos is needed across all sectors
Who should be in charge?
All employees should get the ‘basics’ right!

3. WOULD YOU INVEST IN THIS BUSINESS?
Things looked good for the leadership of Equifax:
a $17 billion market value, and praise for innovation.
Share Price since start of2017

4. HOW THINGS LOOKED BEFORE BREACH
Things looked good for the leadership of Equifax:
a $17 billion market value, and praise for innovation.

5. VIEW FROM THE INSIDE = DISTINGUISHED!
John J. Kelley III
Mr. Kelley achieved a rating of “Distinguished” on his
individual objectives for 2016. These objectives included:
• Directing and improving the effectiveness and efficiency of the
Company’s regulatory and government relations operations
• Continuing to improve business unit support and alignment.
• Continuing to refine and build out the Company’s global
security organization.
Mr Kelley received $2.8m compensation including performance
bonus, an 8% increase on the previous year.
Mr Kelley’s contract guarantees a $758,000 pension contribution
if terminated for cause, or $11.3m if terminated without cause.
Senior management were confident.
They were getting results. “Distinguished” results… .

6. VIEW FROM THE OUTSIDE = VULNERABLE!
John J. Kelley III
But what could hackers see?
The above shows vulnerabilities visible from outside.

7. HOW WAS TEAMWORK IN THE MIDDLE?
John J. Kelley III
Equifax says their CFO (above) wasn’t told in a timely way about the breach.
Which is unfortunate, as he sold some shares a few days later… .
Were cyber
vulnerabilities
always reviewed
in a timely way
by the Board?
Was there a plan
for informing
senior execs
about material
cyber incidents?

8. WHAT DID THEY KNOW, WHEN DID THEY KNOW IT?
May 16th
July 29th
August 2nd
Sept 7th
Equifax now believes it was breached before this date
Equifax managers discovered the data breach
Equifax CFO sold 13% of his shares in Equifax
Equifax consultants register domains like equihax.com,
(to prevent some of the fraud that often follows a
breach announcement: criminal phishers spoofing its
domain to get money & data by fraud)
Equifax announces “cybersecurity incident” (after
markets close, and 41 days after breach discovered)
Breach
Identified
Trading
Preparation Sept 5th
Notification
Is 41 days fast enough? When should the CFO be told?
Did Equifax’s leaders pull together to fix things?

9. HOW DID THEY ANNOUNCE?

10. HOW DID THEY ANNOUNCE? TO WHAT RESPONSE?
Breach affects 143 million people = half the USA
Social Security number, credit card numbers,
home address and birth dates among data lost.
Allegedly, data taken via open-source software,
Apache Struts (for building web applications).
(Two thirds of Fortune 100 companies are using
Apache Struts.)

11. Breach affects 143 million people = half the USA
Social Security number, credit card numbers,
home address and birth dates among data lost.
Allegedly, data taken via open-source software,
Apache Struts (for building web applications).
(Two thirds of Fortune 100 companies are using
Apache Struts.)
Social media reacts within seconds.
HOW DID THEY ANNOUNCE? TO WHAT RESPONSE?

12. AND HOW GOOD WAS THE HELP THEY ANNOUNCED?
Some browsers blocked access
to the site, as it looked like a
scam. (The site wasn’t registered
to Equifax, & its certificates didn’t
perform proper revocation).
The site runs WordPress, which
isn’t very secure.
Frustrations: On Sept 8th the site
told many users to check back on
13th to see if they were affected.

13. THEIR GESTURE OF CREDIT MONITORING
Free credit monitoring is offered on site.
Conflict of interest? Some complain the
monitoring services is owned by Equifax,
and is often used to sell other services.
Legal Conflict? Those who accept the
credit monitoring seem to automatically
give up their right to sue Equifax.
A credit freeze is recommended by many
experts (eg Brian Krebs).

14. WHEN THINGS COULDN’T GET ANY WORSE…

15. WHAT DID THE MEDIA THINK?

16. SOME RISKS THE 143 MILLION INDIVIDUALS NOW FACE
Tax Refund Fraud Loan Account Fraud
Credit Card Fraud Benefits Fraud

17. Equifax Share Price
since start of2017
Each share was worth$142
at the start of Sept 2017,
giving Equifaxa market
value of $17.2billion.
In 3days, the value fell
exactly a third, wipingout
over $5billion ofvalue.
VALUE DOWN $5 BILLION IN 3 DAYS TRADING

18. CALLED IN FRONT OF THE SENATE
“AsCEO I was ultimately responsible….
“An unpatched vulnerability allowed hackers toaccess
personal identifying information….
“We struggled with the initial effort to meet the
challenges that effective remediation posed….
“Experts told usto prepare for exponentially more attacks
after the notification, from “copycat”attempts….
“The challenge of building a website to notify consumers
proved overwhelming. Regrettably, mistakes weremade.
143 million consumers were notified of the breach, and
7.5 million have registered for ourremediation offer.
Before I decided to step down as CEO, our CIO and CISO
also left thecompany.
Full transcript: https://www.cyberrescue.co.uk/library/response#equifaxoct2017

19. WHAT DOES THE EQUIFAX EXPERIENCE
INSPIRE YOU TO DO, TODAY?
If you were Mark L. Feidler, what would you have done differently?
What actions should your organisation take?
• Provide Online Training about Cyber Risks to staff
• Run Security Scorecard on your (supplier) systems
• Every department needs to prepare to mitigate the
operational, commercial and reputational damage
from a breach.

20. Lessons Learned from Equifax Breach
Dr Chaditsa Poulatova
Cyber Rescue
International Advisor
16th May 2018
These sides can be downloaded from our LinkedIn page:
www.linkedin.com/company/cyber-rescue-alliance
Short URL: www.tinyurl.com/cyber999