Having read the Equifax Data Breach Congress Report from December 2018, one can see that the alleged Chinese attackers did not need to work very hard. All they did was take advantage of a few expired security certificates, a non-patched Apache Struts software and utilize a few web shells that led into additional databases.
Before you even ask, the answer is yes, it could have been prevented. If only there was an effective way to continually pen-test the entire network and point to these non-critical vulnerabilities that can lead to a disastrous breach. Well, now there is – automated penetration testing. And it is here to stay.
