8 ms·

AFAIK, Nothing in PCI/PII/SOX would have explicitly prevented what we saw today (if the rumors are true).

SilasX 6y ago
Stupid questions: Did the attacks involve a duped Twitter employee changing high-value account emails? Without a second person reviewing? And wouldn't PCI have something against that?
- Avicebron 6y ago
  So far it seems it did involve a Twitter employee: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
- nemothekid 6y ago
  >And wouldn't PCI have something against that? AFAIK (the spec is huge) PCI-DSS doesn't have a two-man rule requirement. Twitter is arguably doing everything PCI-DSS requires as its good security hygiene anyways.
- coderintherye 6y ago
  PCI is about payment cardholder data (credit card data). So, no, cause Twitter is free and you are not sending credit card data to them. However, if you applied the principals of PCI to all user data then possibly yes. The more valuable practice would be anti-phishing training for CS employees.
  - lawnchair_larry 6y ago
    Anti-phishing training (and PCI in general) has made very little difference in my experience as a practitioner. Like most security remedies, there is no data to back up its efficacy, and no standard for how it should be done.
  - SilasX 6y ago
    > However, if you applied the principals of PCI to all user data then possibly yes. Yes, that is the charitable interpretation you could have safely assumed I meant.
- jobigoud 6y ago
  A single duped employee changing dozens of accounts emails? A dozen of duped employees? This feels very unlikely. Some sort of admin tool must have been used.
  - SilasX 6y ago
    I know the admin tool was involved (at least from the reports). I mean that an external party masquerading as legit users was duping employees into changing that stuff (possibly via the admin tool).
btmiller 6y ago
I'd love to be a part of that postmortem, and perhaps a new compliance standard could be formed if root cause turns out to be a technical shortcoming.

Stupid questions: Did the attacks involve a duped Twitter employee changing high-value account emails? Without a second person reviewing? And wouldn't PCI have something against that?

Avicebron 6y ago
So far it seems it did involve a Twitter employee: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...
nemothekid 6y ago
>And wouldn't PCI have something against that? AFAIK (the spec is huge) PCI-DSS doesn't have a two-man rule requirement. Twitter is arguably doing everything PCI-DSS requires as its good security hygiene anyways.
coderintherye 6y ago
PCI is about payment cardholder data (credit card data). So, no, cause Twitter is free and you are not sending credit card data to them. However, if you applied the principals of PCI to all user data then possibly yes. The more valuable practice would be anti-phishing training for CS employees.
- lawnchair_larry 6y ago
  Anti-phishing training (and PCI in general) has made very little difference in my experience as a practitioner. Like most security remedies, there is no data to back up its efficacy, and no standard for how it should be done.
- SilasX 6y ago
  > However, if you applied the principals of PCI to all user data then possibly yes. Yes, that is the charitable interpretation you could have safely assumed I meant.
jobigoud 6y ago
A single duped employee changing dozens of accounts emails? A dozen of duped employees? This feels very unlikely. Some sort of admin tool must have been used.
- SilasX 6y ago
  I know the admin tool was involved (at least from the reports). I mean that an external party masquerading as legit users was duping employees into changing that stuff (possibly via the admin tool).

btmiller 6y ago

I'd love to be a part of that postmortem, and perhaps a new compliance standard could be formed if root cause turns out to be a technical shortcoming.