IDG News Service - Gawker Media's CTO has outlined a series of security changes designed to shore up the company's IT operations following an attack last week that compromised up to 1.4 million accounts.
The company was unprepared to respond to an attack in which user data and passwords were posted to peer-to-peer file-sharing networks, wrote Tom Plunkett in an e-mail memo to Gawker staff on Friday. The e-mail was reposted on Jim Romenesko's blog on the Poynter journalism site. A group called Gnosis claimed responsibility for the hack, which exploited a flaw in the source code of Gawker's Web servers.
"Our development efforts have been focused on new product while committing relatively little time to reviewing past work," Plunkett wrote. "This is often a fatal mistake in software development and was central to this vulnerability."
As a result, Gawker has done a security audit of the sites affected, which include Lifehacker, Gizmodo, Gawker, Jezebel, io9, Jalopnik, Kotaku, Deadspin and Fleshbot.
Gawker is now mandating the use of SSL (Secure Sockets Layer) encryption for employees with company accounts using Google Apps. Also, if those employees have access to sensitive legal, financial or account data, two-factor authentication must be used, Plunkett wrote.
Gawker also will not allow employees to discuss sensitive information on chat applications, including AOL's Instant Messenger and Campfire.
For users of its websites, Plunkett wrote that Gawker wants to move away from storing information such as e-mail and passwords and use systems such as OAuth.
OAuth is an authentication protocol that allows people to use the same login information for multiple services and share data through an API (application programming interfaces). OAuth provides a token that grants access to different applications, which do not see users' original login credentials. It is being used now by Google, Twitter and Facebook, among other services.
Gawker will also allow people to create a "disposable" account with its sites in order to leave comments. Gawker will not store e-mail addresses or passwords for those accounts. The accounts can be used as long as the person remembers a key code, Plunkett wrote.
Since the breach, Gawker has been in the process of notifying those who are affected and reminding them to change their passwords, especially if they used the same password for other Web services. Twitter saw a raft of spam soon after the Gawker breach, which illustrated that some people used the same password on both services.
The U.S. Federal Bureau of Investigation is looking into the Gawker breach.
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!