Slashdot Mirror
Facebook Security Chief Says Its Corporate Network Is Run 'Like a College Campus' (zdnet.com)
An anonymous reader quotes a report from ZDNet: Facebook's security chief has told employees that the social media giant needs to improve its internal security practices to be more akin to a defense contractor, according to a leaked recording obtained by ZDNet. Alex Stamos made the comments to employees at a late-July internal meeting where he argued that the company had not done enough to respond to the growing threats that the company faces, citing both technical challenges and cultural issues at the company. "The threats that we are facing have increased significantly and the quality of the adversaries that we are facing," he said. "Both technically and from a cultural perspective I don't feel like we have caught up with our responsibility. The way that I explain to [management] is that we have the threat profile of a Northrop Grumman or a Raytheon or another defense contractor, but we run our corporate network, for example, like a college campus, almost," he said.
Well, considering their 1.2 billion people DB hasn't leaked .. I guess they're doing OK job, compared to let's say yahoo... who have been hacked like 3 times in 5 years ? Or linkedin. Or equifax.. or ..
Sounds like someone out to push in his favorite firewall vendor for bigbucks. The tootsiepop model of security is long discredited. How about they put back some of the money they made off open source software into making sure that everybody can run a secure Linux on their network and that the Linux actually is secure? If every network connection was properly encrypted from a properly secured endpoint then the network wouldn't matter. If the endpoints aren't secure then the network isn't secure anyway.
So refreshing to see a company take security seriously.
Well. He's been at the post for 2 and a half years, and the word chief is attached to his job title, so what exatly is he complaining about?
And trust me, your info is safe with them. As a government secuirty analyst I *wish* we had the capability they have.
Not long ago, there was a discussion on Slashdot on how to encourage companies to be more mindful of security. Well, I think one of the answers is right here - use a metaphor that people will not be able to forget, like "Northropp Gruman versus college campus" :)
. . . this effort:
Facebook Is Looking for Employees With National Security Clearances
Zuckerberg taped over the camera on his Macbook Pro.
Too lazy to fetch the link....
"Hacked" can mean anything at all these days, so you're not saying anything of substance here.
Yes, the entire computer "security" industry has that problem, deliberately so.
Anyway, facebook apparently failed to grow up with their college campus mentality still very much in the dna of their company so you'll see it come back everywhere. On top of that their again college campus-inspired "real name policy", where they even decide whether your name can be "real" enough to open a facebook account with, and their "need" to gather as much data as they can to sell to third parties and therefore "need" to keep their own doings secret from the lusers who pour their tiny little hearts out into their platform, and you have... the privacy nightmare that is facebook. It's not so much any single incident. It's the leaky nature of the thing.
What this guy is apparently saying is that sooner or later facebook will have data leakage incidents, and that'll be bad for the bottom line. Do you see how his heart bleeds for your privacy?
Having seen IT at a defense contractor, I can confidently say that is not a very high bar to aspire to. Defense contractor IT departments do not appear to attract the best or brightest - and it shows.
Fires and employee uprisings and the members of the board running around going "NAZI!" and punching random people...
Chas - The one, the only.
THANK GOD!!!
Put another drunk -ass in charge! :;'And now 'we""l' see what happens.
Speaking as an IT Professional working at a large University I can assure you we take network security very very seriously. I believe Facebook would be envious of our network security teams.
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
Well, considering their 1.2 billion people DB hasn't leaked ..
If it's run that sloppy then it might have already happened and they/we just don't know it yet. My suspicion is that it is merely a matter of time before Facebook has some form of catastrophic data breach.
Honestly I'm not even a tiny bit surprised that Facebook is sloppy. They have a looooong pattern of not giving a shit about the people who use their service and being alarmingly relaxed (for lack of a better word) with privacy and the rights of their users. This is just another example of why I don't trust Facebook and do not have an account with them.
I guess they're doing OK job, compared to let's say yahoo... who have been hacked like 3 times in 5 years ? Or linkedin. Or equifax.. or ..
Talk about damning with faint praise...
A college campus network in the late 90s was as close to "free flow of information" as you can get. Nowadays there are firewalls everywhere. The last university network I was on didn't even allow NTP syncs with external servers.
Well, I wouldn't be surprised if some college campuses have better security than some defense contractors.
I cannot speak for every defense contractor but I've worked at one in the past and with a few as a vendor and I can assure you that their security (physical and IT) was CONSIDERABLY tighter than any college campus I've ever seen, at least where I was working.
You can't be hacked if you have nothing hidden and everything is public. PointsHead.gif
Don't fight for your country, if your country does not fight for you.
If he wasn't "former" at the disclosure, he surely will be shortly after.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Facebook is a group of moronic children. Is anyone surprised that people inder 30, particulatly in this day and age, couldn't manage their way out of a wet paper sack? You give power to children, they use it with the common sense and experience of children. The result is usually about on par in terms of insight, understanding, and mastery with their other high school science projects. Wehave done this to ourselves by refusing to be responsible adults, folks.
Running joke from my buddy that works at a defense contractor is that if you can do your job, the network isn't secure enough. It's amazing the hoops he has to jump through to perform functions and obtain permission to perform functions that are actually enumerated in his job. Oh, and of course, they are told to just assume the network is compromised, anyway. There are good security reasons for a some of the restrictions, of course -- but there's no denying that having a very locked down network requires significant investment on the IT side as well as slowing down the jobs of the people actually trying to use the network.
I am surprised that a Facebook exec would publicly admit a failure like that! Worse, I am surprised said exec would have even allowed such an insecure network. Well, I am glad I gave up my Facebook account! Fuck Zuck.
If Mark Zuckerburg is wired into the network, coding and drinking late at night, he can crash the Facebook campus network the same way he crashed the Harvard campus network? So much for intelligent design.
Source: "The Accidental Billionaires: The Founding of Facebook: A Tale of Sex, Money, Genius and Betrayal" by Ben Mezrich
The problem is that it's very difficult to resolve "move fast and break things" developers with anything approaching information security. If you run an extension of a college campus like Facebook does, you're going to get a college campus mentality.
I can see why they are concerned though...Facebook has become the de facto identity provider for almost every consumer website. That "sign in with Facebook" button lets developers assume that Facebook will keep login details for millions of users safe. Microsoft has this same problem with Office 365/Azure AD and they've gone to great pains to explain what they're doing around security. Any time you are providing a vital service that others are counting on, and you have people's personally identifiable information stored, you can't put that in a college campus environment.
I have (BAE, and Raytheon).
The configuration and lockdown can be so Byzantine that simply signing into you workstation can be a chore.
Hmm. how many intrusions has this prevented? Oh that's right. None.
Employees are f-ing like monkeys, drinking like sailors, and staying up all night to try to finish that last bit of code which ultimately results in a D+ grade?
Caution: Contents under pressure
You never signed up for an account with them. That doesn't mean that there isn't a nice fat DB entry with your name and all the information they can gather. Did you sign up for Equifax?
Oh I'm well aware they are trying to gather data on everyone. I also cannot stop my idiot friends and family from posting information and pictures about me. Nevertheless I'm not going to cooperate with them and I make pretty heavy use of software to block advertisers and others who want to track my actions on the net. I'm sure information leaks through but they don't have nearly as much on me as they could if I took no measures and they don't have information voluntarily from me.
Some years ago (when /. was new) someone posted a comment regarding computer security of article about a major system that was recently hacked. He began with "when you are responsible for computer security, you can't be too secure. A shotgun will help." Then went on about choosing firearms for people staffing a computer room, really strange, with references like "don't use a large gun for your wimpy hands, a 22 slug in the gut is better than a 357 in the ceiling."
Does anyone remember when Zuck was hacked and it turned out his password was dadada? And people actually trust this clown with their data. He is both evil and incompetent, which is a dangerous combo. Ditch Facebook.
Lots of people outraged that their network is run like a college campus, no one looking at what he meant by that phrase.
If what he claimed were true, FB would've had a major breech already. This sounds more like internal political jockeying rather than valid concerns.
Why do you think they're building that new office right near all the spooks?
Must make it awfully convenient to tap into the fiber.
Security people won't be happy until everyone has chips implanted and nerve stapling capability.
You have a great career in front of you. Employed a few myself. Great combo of open network experience with hardened systems with thousands of smart little shits ( technical term ) trying it on daily.