7 ms·

A recent thought I had. Before a service can be authorized for use by public officials, it should go through security compliance similar to PCI, PII, or SOX. Mo

A recent thought I had. Before a service can be authorized for use by public officials, it should go through security compliance similar to PCI, PII, or SOX. Most public offices obviously don't command armies nor nuclear codes, but ones that do should be subject to more rigorous vetting of the services they are authorized to use. Had the recent vulnerability been a different message from, say, a certain prominent Twitter account, there could be very, very, very disastrous results.

mc32 6y ago
I’m not sure. All those things do is ensure you check lots of boxes, but they don’t necessarily increase security.
nemothekid 6y ago
AFAIK, Nothing in PCI/PII/SOX would have explicitly prevented what we saw today (if the rumors are true).
- SilasX 6y ago
  Stupid questions: Did the attacks involve a duped Twitter employee changing high-value account emails? Without a second person reviewing? And wouldn't PCI have something against that?
  - Avicebron 6y ago
    So far it seems it did involve a Twitter employee: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
  - nemothekid 6y ago
    >And wouldn't PCI have something against that? AFAIK (the spec is huge) PCI-DSS doesn't have a two-man rule requirement. Twitter is arguably doing everything PCI-DSS requires as its good security hygiene anyways.
  - coderintherye 6y ago
    PCI is about payment cardholder data (credit card data). So, no, cause Twitter is free and you are not sending credit card data to them. However, if you applied the principals of PCI to all user data then possibly yes. The more valuable practice would be anti-phishing training for CS employees.
    - lawnchair_larry 6y ago
      Anti-phishing training (and PCI in general) has made very little difference in my experience as a practitioner. Like most security remedies, there is no data to back up its efficacy, and no standard for how it should be done.
    - SilasX 6y ago
      > However, if you applied the principals of PCI to all user data then possibly yes. Yes, that is the charitable interpretation you could have safely assumed I meant.
  - jobigoud 6y ago
    A single duped employee changing dozens of accounts emails? A dozen of duped employees? This feels very unlikely. Some sort of admin tool must have been used.
    - SilasX 6y ago
      I know the admin tool was involved (at least from the reports). I mean that an external party masquerading as legit users was duping employees into changing that stuff (possibly via the admin tool).
- btmiller 6y ago
  I'd love to be a part of that postmortem, and perhaps a new compliance standard could be formed if root cause turns out to be a technical shortcoming.
bjornedstrom 6y ago
This is the most well-intended (I hope, assuming no ill intent on your part) but dangerous message I've read today. What you are really saying here that public officials should only be allowed to publish on approved enterprise communications systems that has the budget to pay for compliance certifications. I think Facebook and Twitter would love this kind of regulatory capture because it would cement their position, hindering startups from taking over in their space (which, we know, is prone to being out-innovated every 5 years or so). Having worked professionally in information security for a while now, let me tell you these kinds of certificates mean very little for actual security.
- the-pigeon 6y ago
  I say just the opposite. Let's remove the blue checks and make it difficult to know who's legit and who's impersonating people again. Twitter is used way too seriously. I know that's the opposite of what Twitter as a company wants. But it'd be nice as a user.
- btmiller 6y ago
  Oof yeah you're not wrong! It was well-intended for sure, but you've made a good point regarding regulatory capture. How can we achieve both a) increased security beyond a your basic acronym certificate* and b) democratized access to startups? Which set of levers can we pull to achieve the best outcome for everyone, I have no idea. Is it fair to compare this to the current aviation dilemmas? I don't want just anyone building a passenger jet, slapping a compliance sticker on it, and hop on board; very high stakes system. Yet at the same time, it's clear to see how Boeing infected the FAA to simply get their way and lockout newcomers. * are PCI, PII, SOX, et. al. really that trivial and meaningless?
  - davinic 6y ago
    Knowing that absolute security is a myth, it makes more sense to assume all the systems are insecure and proceed from there, placing only the appropriate level of trust in any system.
- adrianN 6y ago
wh-uws 6y ago
Given the fact that no sitting federal representative was tweeted from (i.e. Pres, VP, congress person etc.) I think they probably have a different authorization method. One that might be wholly separate from the ones of regular or blue check mark users. Likely monitored by the NSA or something like that.
- jobigoud 6y ago
  If that's the case I wonder if heads of state and aministrations of other countries have similar protections. It's crazy how Twitter has become a channel for broadcasting important messages and PSA by administrations all over the world.
indymike 6y ago
How about no? The cure to bad / fake speech is more speech. (which is exactly what happened here). There's little to prevent a newspaper or TV station from doctoring media, selectively quoting, or just making something up completely and claiming that Joe Biden or Donald Trump said it. Why should twitter be regulated when other operators of the press are not?

mc32 6y ago

I’m not sure. All those things do is ensure you check lots of boxes, but they don’t necessarily increase security.

nemothekid 6y ago

AFAIK, Nothing in PCI/PII/SOX would have explicitly prevented what we saw today (if the rumors are true).

SilasX 6y ago
Stupid questions: Did the attacks involve a duped Twitter employee changing high-value account emails? Without a second person reviewing? And wouldn't PCI have something against that?
- Avicebron 6y ago
  So far it seems it did involve a Twitter employee: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
- nemothekid 6y ago
  >And wouldn't PCI have something against that? AFAIK (the spec is huge) PCI-DSS doesn't have a two-man rule requirement. Twitter is arguably doing everything PCI-DSS requires as its good security hygiene anyways.
- coderintherye 6y ago
  PCI is about payment cardholder data (credit card data). So, no, cause Twitter is free and you are not sending credit card data to them. However, if you applied the principals of PCI to all user data then possibly yes. The more valuable practice would be anti-phishing training for CS employees.
  - lawnchair_larry 6y ago
    Anti-phishing training (and PCI in general) has made very little difference in my experience as a practitioner. Like most security remedies, there is no data to back up its efficacy, and no standard for how it should be done.
  - SilasX 6y ago
    > However, if you applied the principals of PCI to all user data then possibly yes. Yes, that is the charitable interpretation you could have safely assumed I meant.
- jobigoud 6y ago
  A single duped employee changing dozens of accounts emails? A dozen of duped employees? This feels very unlikely. Some sort of admin tool must have been used.
  - SilasX 6y ago
    I know the admin tool was involved (at least from the reports). I mean that an external party masquerading as legit users was duping employees into changing that stuff (possibly via the admin tool).
btmiller 6y ago
I'd love to be a part of that postmortem, and perhaps a new compliance standard could be formed if root cause turns out to be a technical shortcoming.

bjornedstrom 6y ago

This is the most well-intended (I hope, assuming no ill intent on your part) but dangerous message I've read today. What you are really saying here that public officials should only be allowed to publish on approved enterprise communications systems that has the budget to pay for compliance certifications. I think Facebook and Twitter would love this kind of regulatory capture because it would cement their position, hindering startups from taking over in their space (which, we know, is prone to being out-innovated every 5 years or so). Having worked professionally in information security for a while now, let me tell you these kinds of certificates mean very little for actual security.

the-pigeon 6y ago
I say just the opposite. Let's remove the blue checks and make it difficult to know who's legit and who's impersonating people again. Twitter is used way too seriously. I know that's the opposite of what Twitter as a company wants. But it'd be nice as a user.
btmiller 6y ago
Oof yeah you're not wrong! It was well-intended for sure, but you've made a good point regarding regulatory capture. How can we achieve both a) increased security beyond a your basic acronym certificate* and b) democratized access to startups? Which set of levers can we pull to achieve the best outcome for everyone, I have no idea. Is it fair to compare this to the current aviation dilemmas? I don't want just anyone building a passenger jet, slapping a compliance sticker on it, and hop on board; very high stakes system. Yet at the same time, it's clear to see how Boeing infected the FAA to simply get their way and lockout newcomers. * are PCI, PII, SOX, et. al. really that trivial and meaningless?
- davinic 6y ago
  Knowing that absolute security is a myth, it makes more sense to assume all the systems are insecure and proceed from there, placing only the appropriate level of trust in any system.
adrianN 6y ago

wh-uws 6y ago

Given the fact that no sitting federal representative was tweeted from (i.e. Pres, VP, congress person etc.) I think they probably have a different authorization method. One that might be wholly separate from the ones of regular or blue check mark users. Likely monitored by the NSA or something like that.

jobigoud 6y ago
If that's the case I wonder if heads of state and aministrations of other countries have similar protections. It's crazy how Twitter has become a channel for broadcasting important messages and PSA by administrations all over the world.

indymike 6y ago

How about no? The cure to bad / fake speech is more speech. (which is exactly what happened here). There's little to prevent a newspaper or TV station from doctoring media, selectively quoting, or just making something up completely and claiming that Joe Biden or Donald Trump said it. Why should twitter be regulated when other operators of the press are not?