Charta is on Google Play: practise on the go. Get the app
Charta

Outline what the Equifax case study teaches.

FRM® Part II · Operational Risk and Resilience · Case Study: Cyberthreats and Information Security Risks · FRM2.ORR.9.b

The idea

The 2017 Equifax breach exposed the personal data of roughly 147 million consumers held by a major credit reporting agency. Attackers entered through a public-facing dispute portal running an Apache Struts web framework with a known flaw. A patch for that flaw had already been published. The vulnerability was not remediated because patch ownership and asset visibility failed, and scanning did not find the affected system. Weak network segmentation let the intruders reach many databases. An expired certificate on a traffic inspection device left the outbound data theft unseen for weeks. The lesson is that a chain of ordinary control failures, not an exotic attack, caused the loss. Keep a complete asset inventory, verify patches, monitor encrypted traffic, segment networks, and assign clear accountability with senior oversight.

A practice question

From the question bank, with the reason each wrong option is wrong.

What was the technical weakness through which attackers first entered Equifax in 2017?

  1. A ransomware infection delivered by a phishing email sent to employeesWhy not: Wrong attack type: the breach was an exploited web application flaw, not ransomware delivered by phishing.
  2. A distributed denial-of-service attack on the customer-facing portalWhy not: Equifax's loss was theft of data through intrusion, not a flood of traffic aimed at availability.
  3. A compromised third-party payroll vendor with trusted access to systemsWhy not: The documented entry point was Equifax's own public-facing web application, not a vendor connection.
  4. A known Apache Struts flaw for which a patch had already been published - correct

The intruders exploited a publicly known Apache Struts vulnerability in a consumer dispute portal. A fix was available weeks before the attack, which is why the case is treated as a failure of basic patch management.

A harder one

Equifax received an internal alert about the vulnerable software, yet the affected system was neither patched nor found by scanning. Which weakness does this best illustrate?

  1. The lack of a disaster recovery site able to restore the portal quickly after an outageWhy not: Confuses recovery capacity with vulnerability management; a recovery site would not have stopped the intrusion.
  2. Incomplete asset visibility and patching that was never verified - correct
  3. The absence of cyber insurance to cover the cost of notification and credit monitoringWhy not: Insurance addresses financial loss after the event and has no bearing on why an alert did not lead to a patch.
  4. Weak encryption of the customer database, which allowed it to be read once copiedWhy not: The failure here concerns finding and patching a vulnerable system, not the strength of data encryption.

The case shows that having a policy and an alert is not enough: the firm must know what it runs, route patch tasks to accountable owners and confirm by rescanning that fixes were applied. Recovery sites and insurance do not prevent this type of lapse.

The hardest tier

Which statement best summarises what the Equifax case study teaches about managing information security risk?

  1. Ordinary control failures chained together, so layered controls and accountability matter - correct
  2. A previously unknown vulnerability made the breach unavoidable, so spending should shift from prevention to insuranceWhy not: The flaw was publicly known and patchable; calling it unavoidable ignores the control failures the investigations found.
  3. Encrypting data in transit is sufficient protection, so monitoring of internal traffic is optionalWhy not: Encryption without inspection actually helped hide the exfiltration; monitoring tools need valid certificates to see inside encrypted traffic.
  4. Meeting regulatory compliance requirements is the same as being secure, so audits of controls add littleWhy not: Compliance is a floor, not a guarantee; Equifax had policies on paper that were not executed in practice.

Equifax is a hygiene case: an unpatched known flaw, poor asset visibility, expired monitoring certificate, weak segmentation and unclear ownership combined. Any one control working would probably have broken the chain. Sophistication of the attacker was not the main factor.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Case Study: Cyberthreats and Information Security Risks