Twitter responds to their security incident

Twitter has today issued a post incident response to this week's compromise of a number of their high profile verified accounts. They say "The attackers successfully manipulated a small number of employees and used their credentials to access Twitter’s internal systems, including getting through our two-factor protections. As of now, we know that they accessed tools only available to our internal support teams to target 130 Twitter accounts. For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets."

Twitter can be credited in saying that they moved quickly to lock down and regain control of the compromised accounts, additionally they locked other accounts whose password was changed recently. Returning functionality to compromised accounts today. They continue to work to restore access to all the accounts that were locked. They continue to work with law enforcement to complete their investigation, but give no date by which they expect it to be completed. They aim to strengthen internal security. Lastly they plan additional awareness training to guard against social engineering attacks.

I think this incident has done irrevocable damage to an already struggling platform. While this blog says some of the right things, it does not do enough to rebuild trust with its users. They need a full time CEO, some of the fixes they need to put in place to ensure proper segregation will take a long time. plus the company culture needs to change, to grow up into a mature, secure company.