Equifax ‘s new CEO Mark Begor told senators Thursday that the credit ratings agency has made many changes since its 2017 breach of the personal information of 143 million people, but he also defended the company against a harsh new Senate report about the incident, saying in a prepared statement: “The fact that Equifax did not have an impenetrable information security program and suffered a breach does not mean that the company failed to take cybersecurity seriously.”
Marriott CEO Arne Sorenson to discuss private-sector data breaches at a hearing Thursday in front of the Senate’s Homeland Security and Governmental Affairs Subcommittee on Investigations.
“Before the cyberattack, I understand that the [Equifax’s] security program was well-funded and staffed, based on a robust set of policies, standards, and procedures, and supported by general and specialized training,” he said.
The Senate report says that unlike Equifax, the company’s competitors Experian and Transunion “were able to avoid a similar data breach.”
Begor said that in 2018, the over 1,200 data breaches against U.S. corporations showed that companies of all types were falling victim to these crimes.
“These attacks are no longer just a hacker in the basement attempting to penetrate a company’s security perimeter, but instead are carried out by increasingly sophisticated criminal rings or, even more challenging, well-funded nation-state actors or military arms of nation-states,” he said.
Equifax has added four new directors and created an “audit framework” meant to give the board of directors security benchmarks that they understand, and that can make it easier to record progress, Begor said. The company has also planned to spend $1.25 billion more between 2018 and 2020 on security and IT as a result of the incident.
The report also criticizes Equifax for improperly saving records of internal conversations about the breach. Employees used an internal chat service called Microsoft Lync, which was set to not preserve conversations. Although this is a typical data retention practice, companies often adopt different standards surrounding events that may lead to legal action, specifically enacting a “legal hold” on any employee conversations about the incident.
“During its investigation, the Subcommittee learned that Equifax employees conducted substantive discussions of the discovery and mitigation of the data breach using Microsoft Lync, an instant messaging product,” the report says. “After discovering the data breach on July 29, 2017, Equifax did not issue a legal hold for related documents until August 22, 2017. Despite the legal hold, Equifax did not change the default setting on the Lync platform and begin archiving chats until September 15, 2017.”
from Viral News Updates https://ift.tt/2EFuvps
0 Comments