Protecting People On Facebook
Facebook, like every significant internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure. As such, we invest heavily in preventing, detecting, and responding to threats that target our infrastructure …
Context & Ripple Effects
Facebook had already framed account safety as an ongoing product and operations task, from additional account-security tools in 2010 to its 2012 account of defending users against spammers, hackers, and likejackers. The reported infrastructure compromise shifts that security narrative from abuse on the service to the systems that operate it.
The incident also lands as Facebook brings server design in-house and shares server, storage, and rack designs through the Open Compute Project, making infrastructure engineering more central to its own security posture.
First-order effects
- Facebook must use its prevention, detection, and response capabilities to contain and investigate a compromise of its computers, while protecting infrastructure and data.
Second-order effects
- Facebook’s move away from HP and Dell servers puts more of the operational security burden around its infrastructure design and deployment inside the company.
Third-order effects
- If large internet services continue to own both hardware design and operations, security becomes a core platform-engineering responsibility rather than a capability chiefly obtained from traditional server vendors.
The trend: Internet platforms are combining custom infrastructure ownership with deeper in-house security operations as attacks reach beyond user accounts into the systems behind the service.