3 ms·

I wanted a discussion about it. I'm just a random developer who doesn't have the perfect answer. Yet some obvious things that might help would be to increase

by slg 5y ago

I wanted a discussion about it. I'm just a random developer who doesn't have the perfect answer. Yet some obvious things that might help would be to increase penalties for breaches and potentially require more stringent security auditing for companies of a certain size.

azinman2 5y ago
I think the reality is security is really hard, and you only need 1 weakness for someone to drive a truck through. The biggest weakness time and time again is humans, and that's exactly what was attacked here with Twitter via social engineering. You can put all the penalties you want, but ultimately business needs and reality will make it so certain humans have powers that are high-up, which then creates unavoidable weaknesses. Just look at what happened with Ubiquiti and their head of cloud basically blackmailing the company in secret... they were attacked from within. How could that have been prevented assuming the person passes background checks and has years of relevant experience? Many sectors (finance, health care, etc) have all kinds of auditing requirements. I've helped answer some of these audits. It's largely just a bunch of checkboxes for obvious stuff, and in general, isn't how anyone would attack a company that's moderately competent. I've seen and fixed security vulnerabilities in startups that no one else recognized where there, despite passing all these 3rd party audits. I don't know what more could have been done without extremely knowledgeable people look at every aspect of your business in absolute depth that in part only comes from actually working/building it in the first place. Such experts are rare finds, yet the number of companies with computers attached is far greater. I'm not against legislation, and I think good legislation would look like taking companies such as Equifax out of business. We don't need total incompetence continuing to be central to society's function. But we also need to be realistic about what can be achieved.
- slg 5y ago
  You can never eliminate the possibility of a security incident, but there are easy steps that can be made to reduce the risk. Clearly Twitter didn't do enough of them. For example, they had too many people with too wide permissions which increased their surface area for a social engineering attack. They didn't have an enhanced security policy for highly targeted users such as requiring approval from multiple people which would reduce the success rate of social engineering attacks. They also didn't have the proper monitoring of these high permissioned accounts to quickly identify the source of the breach and therefore they couldn't easily stop it after it begun. These might just sound like "checkboxes for obvious stuff", but they would have helped if Twitter checked those boxes.
  - azinman2 5y ago
    What audit has checkboxes for 'do you require approval from multiple people for basic profile manipulation of highly targeted users?' I've never seen one on any security compliance that I was apart of, and the reason being is that this is so specific to Twitter and very few other companies. Every product will end up being like this -- their own domain and product offering will create their own checkboxes that simply don't apply to the vast majority of other companies.
    - slg 5y ago
      Regulation that requires signoff from multiple individuals is nothing new. The only piece that is unique is the "highly targeted users" callout, but that can be generalized too. For example, there could be heightened requirements for social media accounts based off their reach. A million followers, subscribers, fans, patrons, or whatever term you use and that account now requires heightened security. But either way, you are getting too bogged down in the specifics of my hypotheticals. Like I said originally I don't have the answer on the perfect solution, but the fact that we didn't use this incident as motivation to have a discussion about potential solutions is disappointing. Can you at least agree with that?
      - azinman2 5y ago
        My issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve your goal having already seen HIPAA in action in law, the systems behind the scene, and the ways in which compliance works. Is it better than nothing? Sure! Does it actually create truly secure systems? I don’t think so. If liabilities are severe where companies could go under or people go to jail, then I’m still not sure that would be enough to secure systems because you’re always a 0-day away from breach. But if the result is twitter going under or their CSO jailed, all I think that happens is you remove global competitiveness. I agree with you more should be done. But perhaps in different ways. For example, requiring everyone to take basic security classes before you can be a software engineer might help. Creating societal incentives where bug bounties are required, white hats cannot go to jail or be sued, DARPA spends big on defensive security strategies, and stating the US will take cyber attacks the same as physical attacks are ways that I think would produce better outcomes (but would risk war).

by slg 5y ago

azinman2 5y ago

I think the reality is security is really hard, and you only need 1 weakness for someone to drive a truck through. The biggest weakness time and time again is humans, and that's exactly what was attacked here with Twitter via social engineering. You can put all the penalties you want, but ultimately business needs and reality will make it so certain humans have powers that are high-up, which then creates unavoidable weaknesses. Just look at what happened with Ubiquiti and their head of cloud basically blackmailing the company in secret... they were attacked from within. How could that have been prevented assuming the person passes background checks and has years of relevant experience? Many sectors (finance, health care, etc) have all kinds of auditing requirements. I've helped answer some of these audits. It's largely just a bunch of checkboxes for obvious stuff, and in general, isn't how anyone would attack a company that's moderately competent. I've seen and fixed security vulnerabilities in startups that no one else recognized where there, despite passing all these 3rd party audits. I don't know what more could have been done without extremely knowledgeable people look at every aspect of your business in absolute depth that in part only comes from actually working/building it in the first place. Such experts are rare finds, yet the number of companies with computers attached is far greater. I'm not against legislation, and I think good legislation would look like taking companies such as Equifax out of business. We don't need total incompetence continuing to be central to society's function. But we also need to be realistic about what can be achieved.

slg 5y ago
You can never eliminate the possibility of a security incident, but there are easy steps that can be made to reduce the risk. Clearly Twitter didn't do enough of them. For example, they had too many people with too wide permissions which increased their surface area for a social engineering attack. They didn't have an enhanced security policy for highly targeted users such as requiring approval from multiple people which would reduce the success rate of social engineering attacks. They also didn't have the proper monitoring of these high permissioned accounts to quickly identify the source of the breach and therefore they couldn't easily stop it after it begun. These might just sound like "checkboxes for obvious stuff", but they would have helped if Twitter checked those boxes.
- azinman2 5y ago
  What audit has checkboxes for 'do you require approval from multiple people for basic profile manipulation of highly targeted users?' I've never seen one on any security compliance that I was apart of, and the reason being is that this is so specific to Twitter and very few other companies. Every product will end up being like this -- their own domain and product offering will create their own checkboxes that simply don't apply to the vast majority of other companies.
  - slg 5y ago
    Regulation that requires signoff from multiple individuals is nothing new. The only piece that is unique is the "highly targeted users" callout, but that can be generalized too. For example, there could be heightened requirements for social media accounts based off their reach. A million followers, subscribers, fans, patrons, or whatever term you use and that account now requires heightened security. But either way, you are getting too bogged down in the specifics of my hypotheticals. Like I said originally I don't have the answer on the perfect solution, but the fact that we didn't use this incident as motivation to have a discussion about potential solutions is disappointing. Can you at least agree with that?
    - azinman2 5y ago
      My issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve your goal having already seen HIPAA in action in law, the systems behind the scene, and the ways in which compliance works. Is it better than nothing? Sure! Does it actually create truly secure systems? I don’t think so. If liabilities are severe where companies could go under or people go to jail, then I’m still not sure that would be enough to secure systems because you’re always a 0-day away from breach. But if the result is twitter going under or their CSO jailed, all I think that happens is you remove global competitiveness. I agree with you more should be done. But perhaps in different ways. For example, requiring everyone to take basic security classes before you can be a software engineer might help. Creating societal incentives where bug bounties are required, white hats cannot go to jail or be sued, DARPA spends big on defensive security strategies, and stating the US will take cyber attacks the same as physical attacks are ways that I think would produce better outcomes (but would risk war).