It's an ethical failure that this industry has so many examples of above.
Whether or not this information should be collected at all may be a moral question, but how it's secured is about technical competence.
I also think we should keep in mind that, even if it was well-secured, there could have still been a breach. Would that have been less bad? The result would be the same.
No security professional is going to argue that you can or will prevent every vulnerability from being exploited. However, when you leave a critical vulnerability open for months on end, you knowingly and unnecessarily expose yourself, and any parties associated with you (by choice or otherwise), to a level of risk that is unacceptable.
If this were a 0-day exploit, then the conversation would be different. If their exec's hadn't sold off so much stock a such a suspect moment, then the conversation would be different. If the IT department had appropriately began remediating the vulnerability within a respectable timeframe but had already been exploited, then the conversation would be different.
There is, however, a degree of respect for that hazard, demonstrated in concrete safety practices, that can override that presumption.
I don't think Equifax has demonstrated that respect. To a layman's view, not many companies do. It's possible that the amount of respect necessary for a hazard as large as the one Equifax created is too onerous for a for-profit entity to realistically implement, but I don't know that there's a fundamental reason that sufficiently paranoid engineering practices couldn't make this moral.
Would that have been less bad?
You can take proactive efforts to minimize the risk of breaches; they appeared to store large amounts of unencrypted (or encrypted in aggregate) personally identifiably information together and allowed a single struts vulnerability unfettered access.
For instance, one could not duplicate social security numbers, or could allow you to encrypt your data so you need to provide a key for others to access it. The possibilities are endless.
Yes.
As a professional engineer you are responsible for the systems you build and maintain. The security of the modern internet depends on engineers on the ground understanding and proactively fixing security issues.
There is no one else who can take responsiblity for code you deploy to production. The buck stops with you.
I'm not saying that such a model is the right one for devs, but it would certainly be an interesting move away from "not my fault - nobody would let me do it right".
CEOs would, of course, then have the choice to hire non-accredited engineers to work on their software, and then the buck does stop there because they made an active decision.
I would say I'm in a similar position, but that's because I'm more or less essential (no ego here, and can't explain obviously, but I am) and if I walk out, the company has a lot of BFPs to deal with.
Perhaps there should be some sort of guild? Some way that we could make it harder for ourselves to be replaced in such a way where we can actually stop bucks without just getting fired while they find some script kiddie to do what we wouldn't.
I mean how many firms do we read about a DAY on here who are collecting by the truckload consumer data, either to be used or sold later? And how many of said firms are taking proper steps to anonymize or secure (or both) said data properly?
* The executives selling stock before telling the public about the breach[1] — but "Equifax responded to TechCrunch’s questions about the timing of the transactions, particularly those of CFO John Gamble, with the following statement claiming that the executives in question were not aware of the hack which the company was made aware of on July 29"
* entering in phony name into the "Have I been breached?" site resulted in random answers; "Others have tweeted they received different answers after entering the same information."[2]
* Equifax hosted said "Have I been breached?" site, and services related to protecting oneself from the breach, on a domain that looked for all the world like a phishing site, and further, "What’s more, there is nothing tying the domain registration records for trustedidpremier.com to Equifax: The domain is registered to a WHOIS privacy service, which masks information about who really owns the domain (again, not exactly something you might expect from an identity monitoring site)." [4]
* Equifax wanted people to agree to a forced arbitration clause. [3]
* Equifax directed people to a fake phishing site [5]
…that it became a moral failing.
[1]: https://techcrunch.com/2017/09/07/equifax-managers-dumped-st...
[2]: https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...
[3]: https://theintercept.com/2017/09/08/equifax-is-proving-why-f...
[4]: https://krebsonsecurity.com/2017/09/equifax-or-equiphish/
[5]: https://www.theverge.com/2017/9/20/16339612/equifax-tweet-wr...
If this Struts vulnerability can lead to the personal information of literally half of America? I'm not a lawyer, but that sounds pretty damn negligent to me.
I agree with your larger point that the system probably shouldn't be built in the first place, at least not the way it is now, but there are still plenty of things they could have done, like not store it in plaintext at rest.
If now somehow the database gets exposed, good luck! You'll also need to get the individual keys to decipher everything.
Then, although still you can be blamed for not using a vulnerability scanner, there is much less at stake.
[1] https://www.compose.com/articles/encrypting-sensitive-data-i...
What part of that doesn't seem like a moral failure?