Top 11 Things to Learn From Twitter Security
Twitter made the news twice in the last week for security-related events. The first time was for its proactive measure in suspending the accounts of users whose machines were apparently infected with the Koobface worm. The second time was for the leak of critical information. Both cases provide valuable lessons for organizations and individuals.
Wed, July 22, 2009
Computerworld — Twitter made the news twice in the last week for security-related events. The first time was for its proactive measure in suspending the accounts of users whose machines were apparently infected with the Koobface worm. The second time was for the leak of critical information. Both cases provide valuable lessons for organizations and individuals.
Twitter Bible: Everything You Need To Know About Twitter
(Just how that critical information was leaked by a hacker is an interesting story in itself, which you can read here.)
So, what are the lessons behind the attack and the Koobface account suspensions? I see 11 of them:
1. Don't be afraid to suspend accounts that present a risk to you and your users. It was great that Twitter suspended those user accounts that seemed to be infected. While it is possible that some uninfected accounts were erroneously suspended, the suspensions are the sort of proactive step necessary to protect other users from being infected. And users whose machines really were infected should be grateful to Twitter for saving their reputations. Their friends certainly wouldn't have appreciated getting a virus-laden tweet.
The suspensions also served as an alert for users who didn't know that they were infected, since worms like Koobface can go undetected.
Finally, the suspensions helped Twitter keep its operational costs down, since its systems could have been burdened with more and more infected tweets. As the virus spread, the number of illegitimate messages sent would have spiraled.
2. Doing one thing right doesn't make you good at -- does not even mean you understand -- security. While I do believe that Twitter's actions to stop Koobface were wise, the reality is that the hacking incident, and more specifically, the reaction to it, demonstrates that Twitter executives don't understand the fundamental nature of security.
Specifically, Biz Stone, Twitter's co-founder, stated that the hack wasn't a result of the insecurity of Web apps, but that it "speaks to the importance of following good personal security guidelines such as choosing strong passwords." That is a clueless statement, since the Twitter case involved the reuse of passwords and not necessarily "bad" passwords.
In fact, the hack demonstrates many vulnerabilities of Web apps involving authentication, accessibility and more (all discussed below). It's true that Google Apps itself was not hacked, but Google's password reset function was successfully compromised, and other vulnerabilities facilitated the compromise of information.
Stone does not understand that the goal of security is not to protect software, but to protect the data that the software accesses. Even if a weak password had been involved, a password for a generic Internet e-mail account should not provide access to critical organizational files that are stored on file servers.
