Twitter disclosed yesterday that it had to reset some passwords due to an exploit that really could have hit any company. In essence, certain visitors to a fake peer-to-peer search engine signed up for an account using the same username and password they used on their Twitter accounts. The owners of the fake P2P search engine used this information to access the users’ Twitter accounts. This exploit is not surprising given that a majority of online banking customers reuse their login credentials on other websites. Accordingly, standing alone, this would have little impact on Twitter’s security standing. Unfortunately, there have been more incidents.
On January 5, 2009, several dozen Twitter accounts were hacked, including one belonging to our president. On May 21, 2009, Twitter’s name was used in a phishing exploit that sent users emails notifying them of new followers and included a link to a fake Twitter site. There were also security incidents in April and June. In fact, one analyst has gone so far as to claim Twitter’s security posture is weak enough to be called “security Swiss cheese.”
Why pick on Twitter? Afterall, yesterday our Director of National Intelligence told members of the Senate’s Select Intelligence Committee that malicious online activity is growing at an unprecedented rate. As Dennis Blair put it, “in the dynamic of cyberspace, the technology balance right now favors malicious actors rather than legal actors, and is likely to continue that way for quite some time.”
The reason to mention Twitter is because their new user growth has slowed down. Big time. According to a Hubspot Report, Twitter’s new user rate of growth has gone from 13% in March 2009 to 3.5% for October 2009 (the last month tracked).
Although Twitter may have lost steam as a social networking tool simply because the novelty has worn thin, it is also likely the case that its public security failings have slowed growth. It is very likely that the current stagnation in growth is even worse given that it is estimated about 25% of accounts have no followers and about 40% of accounts have never sent a single Tweet. Why bother signing up for something you likely will not even use if you are skeptical of its security? Simply put, there is no reason to take a chance on a new company if public security lapses make you feel insecure about your data.
All of this points to the need for better security; and more importantly, the use of a directed marketing message that highlights security best practices. This strategy would not only serve to benefit social networking companies. All companies holding personally identifiable information need to get their network security and privacy (NSAP) marketing message out to potential clients. In other words, NSAP processes and procedures are not just tied to risk management and compliance, they directly relate to a marketing message that should lead to an increase in profitable new business.