As the fallout from the data breach of Equifax continues, there are many lessons privacy pros can learn from such an incident. So far, reports note the breach took place via an unpatched vulnerability in Apache Struts 2, an open-source web application framework used by Equifax. The vulnerability was known and patchable at the time of the breach, but it appears that Equifax had not yet implemented the patch, which can be a difficult operation. And with a rise in the use of open-source software by companies and vendors, the Equifax breach should serve as an important lesson for other companies, Amanda O'Keefe, CIPP/US, points out. In this post for Privacy Tech, O'Keefe describes what privacy pros should consider when vetting vendors that use OSS and why failure to ensure OSS vulnerabilities are patched will not be considered a reasonable risk any longer. 
Full Story