Equifax key security control failures built up over time

A nonpartisan agency analysis of Equifax breach via incident report review and interviews of Equifax's largest federal customers, IRS, SSN Administration and USPS revealed:

1. Web/system Apache vulnerabilities that had BOT been patched (or out of date) and weekly scan failed to identify the vulnerability
2. Failure to inspect traffic because the digital certified had expired nearly 1 year ago so all encrypted traffic could NOT be inspected / reviewed (both attack as well as data exfiltration)
   
3. Lack of segmentation allowed for uninterrupted passage through multiple databases / systems without triggering any alerts (or other access control lists / rules)
   
4. Credentials were stored in clear-text and NOT encrypted which was easily accessed / stolen
5. No limit on database queries so large volumes were retrieved / exfiltrated without obstruction or alerts

And so Equifax supposedly but MANY new security requirements in place [not all yet] and reached a voluntary consent order with banking regulators in 8 states" meaning "Equifax will avoid state fines."

https://www.databreachtoday.com/postmortem-multiple-failures-behind-equifax-breach-a-11480