Equifax’s internal controls failed to detect and block unauthorized access to sensitive data for over two months. The company’s intrusion detection system (IDS) was misconfigured, and expired encryption certificates further weakened security monitoring. As a result, critical alerts went unnoticed, allowing attackers to exfiltrate data without immediate detection.

A is incorrect. Equifax had a cybersecurity framework in place, but it was not effectively implemented. The breach resulted from weak security monitoring, not a complete absence of cybersecurity policies.

C is incorrect. There is no evidence that Equifax employees intentionally disabled security alerts. Instead, poor security oversight and expired encryption certificates contributed to the failure in detecting the breach.

D is incorrect. Equifax, as a large financial institution, had the financial capacity to invest in cybersecurity. The breach was not caused by a lack of funds but by poor risk management and weak internal controls.

Things to Remember:

• Effective monitoring systems are essential for detecting cyber threats in real time.
• Expired security certificates weaken network defenses and prevent proper alerting.
• Weak internal controls allow breaches to go undetected for extended periods.
• Organizations must continuously update and test security controls to ensure effectiveness.