David Kennedy, CEO of incident response firm TrustedSec, who previously worked at the NSA and US Marines, said: “Twitter seems to have neglected security for a very long time, and With all the changes, there are bound to be risks.” signal intelligence unit. “There is a lot of work to be done to stabilize and secure the platform, and there is certainly an increased risk from a malicious insider perspective due to all the changes that occur. As time goes on, the probability of an incident decreases, but the security risks and technology debt are still there.”
A Twitter breach can expose a company or its users in a myriad of ways. Of particular concern would be an incident that endangers users who are activists, dissidents or journalists under a repressive regime. With more than 230 million users, a Twitter breach would also have potentially far-reaching consequences for identity theft, harassment, and other harms. And from a government intelligence perspective, the data has proven valuable enough over the years to boost the government spy infiltrate companya threat Zatko said Twitter was not prepared to fight.
The company has come under scrutiny from the US Federal Trade Commission for its past activities, and on Thursday, seven Democratic senators call for FTC to investigate whether “reported changes to internal assessments and data privacy practices” at Twitter violate the terms of a 2011 settlement agreement between Twitter and the FTC regarding mishandling past data or not.
If a breach occurs, of course, the details will dictate the consequences for users, Twitter, and Musk. But the outspoken billionaire may want to note that, at the end of October, the FTC command against online ordering service Drizly and personal sanctions against its CEO, James Cory Rellas, after the company disclosed the personal data of about 2.5 million users. The order requires the company to have stricter policies on data deletion and minimizes data collection and retention, and requires the same for Cory Rellas at any future companies that he works.
Speaking broadly on the current digital security threat landscape at the Aspen Cyber Summit in New York City on Wednesday, Rob Silvers, Department of Homeland Security’s deputy secretary for policy, urged companies and other organizations to be vigilant. “I wouldn’t be too complacent. We see enough targeted intrusions and successful hacks every day that we can’t let our guard down even a little bit,” he said. “Defense matters, resilience matters in this space.”
Dan Tentler, founder of attack simulation and remediation company Phobos Group, who worked on Twitter security from 2011 to 2012, points out that despite the current turmoil and staff shortages within the company creates potentially urgent risks, but it can also pose challenges for attackers who may find it difficult at this point to map the organization to target those employees. potentially have strategic access or control within the company. However, he added that the high risk is due to Twitter’s size and reach worldwide.
“If there are still Twitter insiders or someone is violating Twitter, it probably won’t be much of a hindrance to them doing whatever they want—you have an environment where there may not be as many defenders left,” he say.
