Facebook has taken a page from recent crises in its recent response to a security breach.
On Friday, Facebook revealed that a data leak occurred on Sept. 25, which affects nearly 50 million accounts.
The attackers exploited a feature called "View as" that lets users see their Facebook page the way someone else would. They could then potentially use it to take over the accounts and use them exactly as if they were the account holders.
… More than 90 million users were forced to log out of their accounts on Friday for security reasons. Users do not need to take any additional security precautions or reset their passwords, said Facebook. All logged out users will receive a notification about the issue from Facebook.
[FREE GUIDE: 3 things you (probably) didn't know about crisis communications]
In a Facebook Newsroom post, the platform’s vice president of product management, Guy Rosen, wrote:
People’s privacy and security is incredibly important, and we’re sorry this happened. It’s why we’ve taken immediate action to secure these accounts and let users know what happened. There’s no need for anyone to change their passwords. But people who are having trouble logging back into Facebook — for example because they’ve forgotten their password — should visit our Help Center. And if anyone wants to take the precautionary action of logging out of Facebook, they should visit the “ Security and Login” section in settings. It lists the places people are logged into Facebook with a one-click option to log out of them all.
In the blog post, Rosen outlined the steps Facebook took—and will take—to rectify the situation:
Here is the action we have already taken. First, we’ve fixed the vulnerability and informed law enforcement.
Second, we have reset the access tokens of the almost 50 million accounts we know were affected to protect their security. We’re also taking the precautionary step of resetting access tokens for another 40 million accounts that have been subject to a “View As” look-up in the last year. As a result, around 90 million people will now have to log back in to Facebook, or any of their apps that use Facebook Login. After they have logged back in, people will get a notification at the top of their News Feed explaining what happened.
Third, we’re temporarily turning off the “View As” feature while we conduct a thorough security review.
This attack exploited the complex interaction of multiple issues in our code. It stemmed from a change we made to our video uploading feature in July 2017, which impacted “View As.” The attackers not only needed to find this vulnerability and use it to get an access token, they then had to pivot from that account to others to steal more tokens.
Since we’ve only just started our investigation, we have yet to determine whether these accounts were misused or any information accessed. We also don’t know who’s behind these attacks or where they’re based. We’re working hard to better understand these details — and we will update this post when we have more information, or if the facts change. In addition, if we find more affected accounts, we will immediately reset their access tokens.
Curtis Sparrer, principal of Bospar PR and crisis communications leader, praised Facebook’s crisis response:
Facebook has finally learned from its mistakes in crisis communications. Instead of waiting months or years to disclose bad news to the public like they did in the past, Facebook did the right thing and alerted us now. Our research shows that most Americans expect companies like Facebook to reveal such breaches in a week’s time and actually reward companies for being responsive and transparent. We hope to see this trend continue.
A transparent and well-laid-out crisis response can give your organization a leg up on rebuilding trust with stakeholders—especially if you respond sooner, rather than later.
Though Facebook’s response time was praised, several crises might require more rapid communications.
A Bospar and Propeller Insights survey revealed that nearly 35 percent of U.S. consumers think that 24 hours is too long for organizations to wait and respond to crises, followed by 29.3 percent of consumers who think that 48 hours is too long.
What do you think of Facebook’s response, PR Daily readers?
(image via)
from PR Daily News Feed https://ift.tt/2InMzG1
No comments:
Post a Comment