Twitter's Whistleblower Allegations Are a Cautionary Tale for All Businesses

Today, the mere threat of a breach can crush your business. The Twitter whistleblower saga shows that, after years of indifference, customers are sensitive to even rumors of data leaks. A few years ago, PR teams could paper over a small breach, and customers would accept it. A decade ago, massive data breaches made headlines, but customers stayed with the vendor because they believed that lightning couldn't strike twice.

Times have changed, though, so how can you protect yourself … and even turn privacy and security into an advantage? The companies that win will embrace small steps, transparency, and the right partners.

Ex-Twitter Exec Blows the Whistle

The Twitter whistleblower story will change how the news industry reports on security and privacy moving forward. Just as ransomware went mainstream with the Colonial Pipeline hack, security and privacy stories are going to become mainstream news. Even if your company isn't as high profile as Twitter, the floodgates have opened.

Furthermore, the Twitter story demonstrates that you don't need to be breached to make the news. Former Twitter security executive Peiter Zatko (aka Mudge) made headlines with his concerns about Twitter's security and privacy policies and execution. While there have been well-known Twitter hacks, Zatko's most powerful criticisms are about Twitter's state of security. In his almost 200-page report to federal regulatory agencies and the Department of Justice, the most serious allegations are that Twitter provided regular employees access to central controls and sensitive information without adequate oversight.

It Doesn't Matter If the Accusations Are True

If a reporter asked, "Who has access to your data," could you answer? Would you want to answer? You will be convicted in the court of public opinion before you can defend your security posture. I have no inside information on the Twitter case, but it doesn't matter whether it's found to have egregious breaches of standard security protocols. There will be a large contingent that already assumes this information is true.

After so many high-profile breaches (Target, Adobe, Yahoo, and more), companies are considered guilty until proven innocent. Unfortunately, it's almost impossible to prove innocence since you cannot prove the absence of a breach. Furthermore, even if you could, by the time you could prove that you haven't been breached, the news machine already has moved on. You cannot react quickly enough to counteract the rumors.

Why Are Customers So Sensitive to Privacy?

Everybody knows that companies are gathering vast amounts of personal data. Clicking on the GDPR-inspired "Track my information" buttons may be a reflex, but we understand that we're always being tracked. Customers accept that their vendors will hold their personal data, but they expect the company to protect their information.

Unfortunately, cybercriminals are targeting personal customer information. Identity theft, spam, phishing, ransomware, and other attacks aren't just theoretical. Everybody knows somebody who's been affected.

With more data and more threats, every customer is sensitive to breaches. Corporate data breaches lead to fines, damaged reputations, and loss of customer trust. Companies are desperate to secure their data because it's the difference between survival and failure.

How to Protect Yourself: Transparency

The only way to survive is to be transparent about your data management. Most organizations are hesitant to talk about security and privacy because they know there is a chasm between what they are doing and what they should be doing, but everybody is in the same position. Therefore, whoever steps into the light will immediately take the lead.

When making yourself publicly accountable, you should:

Remember, You're Never Done

Threats and expectations keep evolving, so you must keep ratcheting up your security plan, as well. Since most companies won't give you an unlimited budget, you'll need to plan for how to do more with less

Start Today

The best way to start protecting your company's reputation is with a single assignment. Pick one dataset — a business-critical application, your CRM system, or your backups. Figure out who has access to them. Create a plan to make them more secure. Then share that plan with your colleagues and hold yourself accountable.

Twitter's security issues are blanketing the news. When even a rumor can destroy your business, it's not the time to wait for consultants and focus groups. Now is the time to make your part of the world a little bit better, every day. Shine a light on how you protect your data, and your customers will trust you.