Risk
1/24/2011
12:06 PM
50%
50%

Facebook Defends Security Practices

The social network responds to report alleging it puts the safety of its 650 million users at risk by not better securing third-party applications.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business

Is Facebook's app system inherently unsafe for the social network's 650 million users?

Responding to that exact criticism, the company last week issued a statement defending its security practices. "We have a dedicated team that does robust review of all third-party applications, using a risk-based approach. That means that we first look at velocity, number of users, types of data shared, and prioritize," said Facebook. "This ensures that the team is focused on addressing the biggest risks, rather than just doing a cursory review at the time that an app is first launched."

The company's statement was issued in reaction to a new threat report from Sophos, released on Wednesday. According to the report, "with furious debate raging every time privacy and security settings are tweaked on Facebook, it seems that functionality and ease-of-use triumph over security every time."

To better protect users, the report recommended that Facebook take a page from Apple and adopt a walled garden approach, in which applications would require "official approval before they can be uploaded to the site and shared with other users."

In its statement, however, Facebook seemed to stand by its post-screening security process. "We have built extensive controls into the product, so that now when you add an application it only gets access to very limited data and the user must approve each additional type of data," said Facebook. "We make sure that we act swiftly to remove/sanction potentially bad applications before they gain access to data, and involve law enforcement and file civil actions if there is a problem."

But Graham Cluley, senior technology consultant at Sophos, said the current approach can't keep up with the volume of new threats. "Facebook Security is effectively playing whack-a-mole, hammering the latest rogue app whenever they happen to spot it, and hoping that not too many accounts were compromised in the meantime. Unfortunately, quite often Facebook Security don't seem to spot the scams until they have spread far and wide."

Interestingly, the Sophos report released on Wednesday also found that "more than half of the companies surveyed imposed no limitations on accessing Facebook, Twitter, and LinkedIn -- and less than a quarter of firms completely block these sites."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0999
Published: 2015-06-02
Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header.

CVE-2014-8391
Published: 2015-06-02
The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information from other users' sessions via a large number of request.

CVE-2015-0759
Published: 2015-06-02
Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.

CVE-2015-0850
Published: 2015-06-02
The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository.

CVE-2015-1945
Published: 2015-06-02
Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, and 11.4 allows remote authenticated users to gain privileges via unknown vectors.

Dark Reading Radio
Archived Dark Reading Radio
From Target to Sony to Anthem, they are happening all around you: the “big” data breaches that compromise critical data and threaten the welfare of the corporate brand. Is your organization ready to respond?