Equifax Breach: Key Insights and Lessons

The video discusses the 2017 Equifax data breach, highlighting the company's failure to patch a known vulnerability, which led to unauthorized access to sensitive data of millions. The breach exposed security lapses, including poor system segmentation and failure to renew encryption certificates. The investigation revealed multiple unpatched systems, and the video concludes with lessons on network security and data governance.

What percentage of the U.S. population was affected by the Equifax breach?

• 60%

• 50%

• 44%

• 30%

When did Equifax publicly announce the breach?

• November 7th

• October 7th

• September 7th

• August 7th

What vulnerability did the attackers exploit to initially hack Equifax?

• Apache Struts

• Cross-Site Scripting

• SQL Injection

• Buffer Overflow

How long did Equifax take to patch the Apache Struts vulnerability?

• 120 days

• 100 days

• 146 days

• 160 days

Which firm did Equifax hire to assess their systems after the breach?

• CrowdStrike

• Symantec

• FireEye

• Mandiant

What was one major reason the data exfiltration went undetected?

• Weak passwords

• Expired encryption certificate

• Unpatched software

• Lack of firewalls

What is a key lesson learned regarding network security from the Equifax breach?

• Networks are always secure

• No network is invulnerable

• Firewalls are unnecessary

• Encryption is optional

What should Equifax have done to prevent unauthorized access to database content?

• Allow open access

• Use stronger passwords

• Implement need-to-know basis access

• Disable encryption

What was a major flaw in Equifax's system segmentation?

• Too many firewalls

• Over-segmentation

• No segmentation

• Poor segmentation

What should systems monitor to detect potential breaches?

• Normal database queries

• None of the above

• Suspicious database queries

• All network traffic