Apache Struts Statement on Equifax Security Breach
Apache Struts Statement on Equifax Security Breach
Posted Sep 11, 2017 20:43 UTC (Mon) by ssmith32 (subscriber, #72404)In reply to: Apache Struts Statement on Equifax Security Breach by drag
Parent article: Apache Struts Statement on Equifax Security Breach
There's no need for one service to have access to ALL the data:
1) each service should only manage a slice of the data; ssn, DL, address, etc. All information is merged on the front end, not in a single service.
2) per connection/per user/per session quotas. It should not be possible to request more than X records, even in the slice of the data that the service manages.
1) each service should only manage a slice of the data; ssn, DL, address, etc. All information is merged on the front end, not in a single service.
2) per connection/per user/per session quotas. It should not be possible to request more than X records, even in the slice of the data that the service manages.
So, yes, it looks like there may have been some really dumb mistakes made.