In March 2017 a serious flaw in Apache Struts, a common web framework, was published along with a fix. Equifax, one of the three big US credit bureaus, did not apply it to a public-facing website. Attackers used the flaw from May to late July, taking names, Social Security numbers, birth dates and addresses of about 147 million people.
Settlements, remediation and legal costs passed US$1.4 billion — the most expensive breach on record. A security device with an expired certificate meant the data theft went unseen for weeks.
Patching fails for ordinary reasons: incomplete inventories, no clear owner, missed change windows. Verizon's breach reports still show stolen credentials and unpatched systems as the main ways in. The fixes are not exotic; the discipline is.
What it means for your business
- Keep a live list of internet-facing systems, each with a named owner.
- Patch critical vulnerabilities within days, and measure it.
- Monitor the monitors — expired certificates and silent sensors hide breaches.
How MTH can help: Our Managed Services and Security Operations cover patching, vulnerability management and monitoring under clear SLAs.
This briefing is original commentary by MTH based on public reporting; figures are as reported by the sources named above and may be revised over time.
