Former Twitter head of security Pieter 'Mudge' Zatko disclosed significant security problems on the platform, obtained exclusively by CNN and The Washington Post. It showed threats to user information, shareholders, national security, and democracy. Twitter denies the claims, saying Zatko was fired in January for 'poor performance.' Safeguard Cyber CEO Chris Lehman joins Cheddar News' Closing Bell to discuss.

Closing Bell

Former Twitter Executive Turns Whistleblower, Sounding the Alarm on Platform's Cybersecurity

Welcome back to cheddar news is closing bell everyone while an ex twitter executive blowing the whistle on the social media company alleging it has major privacy issues and security vulnerabilities and no incentives. It turns out to fix them. Peter Zach oh former head of security and a well known cybersecurity expert filing the complaint further alleging the company allows too many employees access to the sites central controls and in turn sensitive information even alleges that one or more current employees may be working for a foreign intelligence service. While twitter denies the claims. ST Sacco was fired in january for quote, poor performance end quote. But joining me now is Chris Lehman sea of safeguard cyber accompaniment monitor Over 30 digital communications platforms including Twitter Chris it's really good to have you on the show today. Let's start by breaking down these serious allegations. What are they to your understanding and what would it mean if one or more of them are actually true. Well thanks for having me kristen. And for starters really the most serious allegation uh that's being made is that right now more than or close to half of all twitter employees have access to user account information and that user account information uh can oftentimes be confidential. It could be something like a phone number for example or it could include uh user I. D. And password information. And um that is a very serious allegation and could point to a problem that exists at twitter about security controls in general and the problem with insufficient security controls when it comes to uh use your uh I. D. Information or personal information is that um it could result in a situation where twitter employees become insider threats and insider threats is a very common type of threat known in the cybersecurity industry. And insider threats can lead to a number of different problems. Um You could have cyber criminals who would target an insider to gain access to personal information of twitter's users and that personal information could ultimately be used to enable things like fraud and theft. Insider threats are uh there's been situations where insiders have partnered with nation states to give access to information that could be used to help drive something like a misinformation campaign. And insider threats are often access and leverage by cyber activists who have the goal of potentially disrupting a business. And uh those types of situations disruption of business can cause massive financial loss and or uh you know reputational damage to the business. So it is it is obviously pretty alarming and I think for users out there they might be freaked out hearing about this. Um If it is the first time that they're learning of this in twitter's case for instance for an everyday user, are there steps that they can take to protect themselves and what should they know simply about using this platform? And these allegations? Well so there's a couple of things. I mean number one when it comes to ensuring your own personal privacy you should always take the basic steps of regularly updating your user I. D. And password information. Um Oftentimes in the cybersecurity world we say that hackers no longer break in, they log in and the reason and the way that they do that is that credential theft is very very common and it's something that users of everyday applications like twitter need to be mindful of and the best thing that they can do to take control of that and help protect themselves is to constantly update their uh their I. D. And password. Um in terms of uh what they need to be aware of and really what they need to demand is that the way we communicate today has changed dramatically over the last decade. We no longer just communicate via the phone in via email. There's all kinds of new applications and methods for us to communicate in our personalized and in business it could be in social channels and applications like twitter, facebook and instagram uh in the business world we increasingly use collaboration applications. We have messaging applications that we use on our phones. And a lot of these new ways to communicate have been driven by the popularity of the smartphone and the applications that come along with those, the challenges that by and large corporations have not put the same level of security controls on those new modern communication channels that they've put on traditional channels like email and as consumers of those applications whether it's at your place of work or it's in your personal life, you should expect and demand that these applications put proper controls in place to protect your information and or at your place of business, your business is information. Look, I think the more users feel protected, I would have Assume the more confident they would feel actually using one of these platforms as someone who works at a company, you're the ceo of safeguard cyber, you monitor more than 30 digital communications platforms Twitter included. Do you find that this is the norm that the allegations against Twitter are the norm across other social media platforms? Well, you know, it's businesses are constantly trying to play catch up. So there's a spectrum, certainly some corporations have done a good job of putting controls in place. And when we talk about controls, there's process controls, there's people controls and there's tech technology controls and many companies are doing their best to keep up. But it is what we call an asymmetric battle in the cybersecurity world. And what we mean by that is that the bad actors only need to be successful once and the business or the user needs to be right all the time. And that is a daunting challenge. So you need to think about where there are opportunities for hackers and bad actors to break in. And one of the most common ways that they break in today are these new communication channels that users are constantly accessing uh and putting personal or company confidential information into. All right chris Lehman, giving us the news that we need to know. Chris. Thank you so much. Chris is the ceo of safeguard cyber.