3 ms·
You can never eliminate the possibility of a security incident, but there are easy steps that can be made to reduce the risk. Clearly Twitter didn't do enough
by slg 5y ago
You can never eliminate the possibility of a security incident, but there are easy steps that can be made to reduce the risk. Clearly Twitter didn't do enough of them. For example, they had too many people with too wide permissions which increased their surface area for a social engineering attack. They didn't have an enhanced security policy for highly targeted users such as requiring approval from multiple people which would reduce the success rate of social engineering attacks. They also didn't have the proper monitoring of these high permissioned accounts to quickly identify the source of the breach and therefore they couldn't easily stop it after it begun. These might just sound like "checkboxes for obvious stuff", but they would have helped if Twitter checked those boxes.
- azinman2 5y agoWhat audit has checkboxes for 'do you require approval from multiple people for basic profile manipulation of highly targeted users?' I've never seen one on any security compliance that I was apart of, and the reason being is that this is so specific to Twitter and very few other companies. Every product will end up being like this -- their own domain and product offering will create their own checkboxes that simply don't apply to the vast majority of other companies.
- slg 5y agoRegulation that requires signoff from multiple individuals is nothing new. The only piece that is unique is the "highly targeted users" callout, but that can be generalized too. For example, there could be heightened requirements for social media accounts based off their reach. A million followers, subscribers, fans, patrons, or whatever term you use and that account now requires heightened security. But either way, you are getting too bogged down in the specifics of my hypotheticals. Like I said originally I don't have the answer on the perfect solution, but the fact that we didn't use this incident as motivation to have a discussion about potential solutions is disappointing. Can you at least agree with that?
- azinman2 5y agoMy issue is with you saying: > legislative changes in order prevent that worse version from happening in the future. I’m not convinced legislation achieve your goal having already seen HIPAA in action in law, the systems behind the scene, and the ways in which compliance works. Is it better than nothing? Sure! Does it actually create truly secure systems? I don’t think so. If liabilities are severe where companies could go under or people go to jail, then I’m still not sure that would be enough to secure systems because you’re always a 0-day away from breach. But if the result is twitter going under or their CSO jailed, all I think that happens is you remove global competitiveness. I agree with you more should be done. But perhaps in different ways. For example, requiring everyone to take basic security classes before you can be a software engineer might help. Creating societal incentives where bug bounties are required, white hats cannot go to jail or be sued, DARPA spends big on defensive security strategies, and stating the US will take cyber attacks the same as physical attacks are ways that I think would produce better outcomes (but would risk war).
- staticassertion 5y agoFWIW, jumping in here, I agree with you that we should be having this conversation. It's just that the conversation is going to be an inherently slow one since it's talking about very sweeping, broad changes. So it happens in little pieces and little changes over time.