Equifax bolsters border security

Equifax, the company that compiles credit reports, has chosen network-access-control technology to make sure contractors and employees access its network with machines that meet the firm's security requirements.

Maintaining such control is key because it helps reduce the risk to breaches that could undermine customers' confidence in Equifax as a repository for confidential financial data, says Tony Spinelli, chief compliance and security officer for the $1.8 billion company headquartered in Atlanta. "We can't have a loss of reputation or we suffer," he says.

That means securing the network against possibly infected contractor machines and making sure those used by Equifax employees are properly configured to the latest corporate desktop image, he says.

To that end Equifax deployed Juniper Networks' NAC gear -- which Juniper calls unified access control -- to check every endpoint for compliance as it tries to connect to the network. (Compare NAC products.) The deployment consists of the Juniper NAC client that checks the endpoint configuration that is evaluated by its NAC policy server and enforced by Juniper perimeter firewalls and firewalls placed in front of the corporate data center, Spinelli says.

Spinelli included NAC in the second year of the company's three-year network-security plan that he wrote two years ago hoping to put more controls on the outsourcers -- totaling about 100 users in all -- the company uses to handle call centers and to develop and maintain applications. About three months ago, the firm finished deploying NAC to its contractors and more than 6,000 Equifax employees at about 100 sites in 13 countries.

"We want to have some way of knowing that only our assets are joining the network," Spinelli says. Also, he wants to be able to make sure managed devices have the appropriate security profile -- encryption in use, antivirus protection at the right level, host intrusion-prevention turned on, and so forth.

Click to see: Diagram of Equifax's network access

To accomplish a uniform software image, the company insisted outsourcers use machines managed and owned by Equifax  -- a stipulation that took some negotiating with the vendors but to which they ultimately agreed.

Spinelli didn't want to rely on outsourcing contracts to stipulate compliance with the security standards, with penalties for noncompliance. "Penalties really aren't going to do a lot for us," he says. "It's a great deterrent, but we developed an assured model."

That means outsourcers can buy their own laptops but Equifax gets to impose its standard software-image. "They are not allowed to have any software, security or systems that are theirs," Spinelli says. "They have to be ours."

The vendors pushed back, but Equifax was able to overcome their resistance. Business units and senior management stuck to their guns because the importance of the company's reputation as a trusted steward of information overrode any protests about inconvenience, Spinelli says. "I think a lot of the premier outsourcing vendors are getting used to working in this manner," he says.

As a tool to convince the outsourcers, Equifax tied their agreeing to use Equifax-managed machines to the guarantee of multi-year contracts, Spinelli says.