Question

5. One of the biggest attacks that occurred recently is the breach of Equifax. Please read articles about this breach and answer the following questions:

a) What is considered personal identifiable information (PI)?

b) Identify the business risks to Equifax that resulted as a result of the breach.

c) Describe how Equifax was breached.

d) Did you agree with how the company handled the problem? Why or why not?

Answer 1

Answer)
The Equifax data breach is the case wherein 147 million people were impacted as a result of the breach and the customers took little or no actions. As the hack was done and posed a risk of identity theft, much security flaws were there. The company stated that the identities of U.S. consumers driver’s license information were taken. Thus personal information about the customers was leaked. There could have been various steps which could have been taking by Equifax to prevent this incident such as:
a) Active monitoring of the incidents should have been done
b) A fraud alert should have been sent within the company asap to work on the fraud
c) Customers should have been notified to make their accounts safe before the fraud occurred
d) Encryption had to be performed, as in why the information was leaked in plain text and no encryption was performed
e) Freezing and locking out the customer information so that hackers cannot access any data.
Encryption should have been included in the Equifax, if that would have been done, then the data would not have been in the plain text. The data would have been encrypted which would have made the data much more useless to the hacker and would have required much more expertise and actions to gain access to the plain text data. Usage of Advanced Encryption Standard which is a symmetric encryption algorithm, should have been done to protect the information. 256 bits encryption should have been implemented here.