Fallout
Whatever the outcome of Zatko’s complaint in Congress, the SEC, or other federal agencies, it already is part of Musk’s latest legal filings as he tries to back out of his purchase of Twitter.
Ideally, in light of these disclosures, Twitter will take corrective action to improve the company’s cybersecurity systems and practices. A good first step the company could take is reviewing and limiting who has root access to its systems, source code, and user data to the minimum number necessary. The company should also ensure that its production systems are kept current and that it is effectively prepared to contend with any type of emergency situation without significantly disrupting its global operations.
From a broader perspective, Zatko’s complaint underscores the critical and sometimes uncomfortable role cybersecurity plays in modern organizations. Cybersecurity professionals like Zatko understand that no company or government agency likes publicity for cybersecurity problems. They tend to think long and hard about whether and how to raise cybersecurity concerns like these—and what the potential ramifications might be. In this case, Zatko says his disclosures reflect “the job he was hired to do” as head of security for a social media platform that he says “is critical to democracy.”
For companies like Twitter, bad cybersecurity news often results in a public relations nightmare that could affect share price and their standing in the marketplace, not to mention attract the interest of regulators and lawmakers. For governments, such revelations can lead to a lack of trust in the institutions created to serve society, in addition to potentially creating distracting political noise.
Unfortunately, how cybersecurity problems are discovered, disclosed, and handled remains a difficult and sometimes controversial process, with no easy solution both for cybersecurity professionals and today’s organizations.
Richard Forno is a principal lecturer in computer science and electrical engineering at the University of Maryland, Baltimore County.
This article is republished from The Conversation under a Creative Commons license. Read the original article.
