Important Lesson from Equifax: You’re not Secure Until You’re Sure

I remember watching a film, years ago, in which the two protagonists go hunting. They are both carrying shotguns and the dialogue goes something like this:

“Is your gun loaded?”

“Nope.”

“Break it.” [the other guy does as he’s told, breaking the shotgun open to show there are no shells loaded]

“Good. Now you’re sure.”

I don’t know if the recently-departed CEO of Equifax, Richard Smith ever saw this film. But when he blamed a single individual for the largest data breach in American history because they allegedly failed to apply a patch, he certainly forgot the cardinal rule of gun safety – and cyber safety.

Be sure.

Applying a patch without being sure is like carrying a gun you think isn’t loaded. Sure, you checked it a while back. But someone could have had access to it, and played around with it. You don’t know until you break that gun open and look. Now you’re sure.

As with gun safety, cyber safety isn’t rocket science. There are three key steps to being sure.

Step 1. Know where you are today

Managing security patches starts, of course, by knowing exactly what patches you DO have installed and on what systems. You should start here with a risk analysis and ensure that your systems mitigate all potential risks. Let’s enumerate some of the obvious ones

You don’t have an accurate picture of your estate, because:

You don’t have the capability to monitor certain patches because:

Step 2. Verify your position with regard to any vulnerability

You need to be sure that, for any security vulnerability, you can reliably answer these three simple questions, ideally in real time.

Step 3. Close the loop

Once you’re confident that you can reliably answer these questions you need to close the loop with patches or other affirmative actions (e.g uninstalling software completely or disabling subsystems).

In this case the processes involved can’t rely on people getting it right. They have to be automated so that, having applied patches, you should be able to repeat the previous two steps above in real time and get answers. This closes the loop. Now you’re sure.

In the case of Equifax it looks as though this ‘closed loop’ process simply didn’t exist. As a consequence, it could only hope it was secure, and could not verify it.

Hence, even if someone failed to apply a patch, the root cause of the problem wasn’t human error. Automated, closed loop systems compensate for human error by detecting the failure.

The root cause of the problem was not having these systems in place. If you don’t have this level of control, you may be secure. Or you may not. Simply put, you aren’t secure until you’re sure.