FERC and NERC Publish Whitepaper on SolarWinds and Related Supply Chain Compromise | Akin Gump Strauss Hauer & Feld LLP

On July 6, 2021, the staff of the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) Electricity Information Sharing and Analysis Center (E-ISAC) issued a whitepaper entitled “SolarWinds and Related Supply Chain Compromise – Lessons for the North American Electricity Industry.” The whitepaper “describes these major supply chain-related cyber security events and the key actions to take to secure systems”¹ and is “intended for electric industry stakeholders and vendors as they consider their next steps in continued response to the SolarWinds cyberattack”² and “other recently identified cybersecurity vulnerabilities [that] have the potential to compromise electric industry cybersecurity.”³ The whitepaper:

• “primarily focuses on the significant and ongoing cyber event related to the SolarWinds Orion platform and the related Microsoft 365/Azure Cloud compromise, [and] also addresses vulnerabilities in products such as Pulse Connect Secure, Microsoft’s on-premise Exchange servers, and F5’s BIG-IP;”⁴
• “offers key actions to take and key questions to ask to ensure the electricity industry is taking all necessary steps to mitigate compromises related to these incidents and vulnerabilities;”⁵ and
• “highlights the need for continued vigilance by the electricity industry related to supply chain compromises and incidents, identifies key elements of adversary tradecraft, highlights specific malwares and tools to remediate, and recommends actions to ensure the reliability and security of the [bulk-power system].”⁶

With regard to the SolarWinds attack specifically, “[c]onsidering the sophistication, breadth, and persistence” of that attack,⁷ the whitepaper recommends “electric industry stakeholders fully consider the available diagnostics and mitigation measures to [e]ffectively address the software compromise,” including considering the recommendations in the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) Emergency Directive 21-01 (directed toward federal agencies) and CISA Alert AA20-352A (directed toward the private sector).⁸ Such recommendations include “disconnecting affected systems, conducting deep forensics, performing risk analyses, and consulting with CISA before reconnecting [or rebuilding] affected systems.”⁹ The whitepaper also includes its own specific recommended industry actions, which are extensive and detailed.¹⁰

Of particular note, the whitepaper states that “[b]ecause of SolarWinds’ wide use and the adversarial tactics used, even entities that did not install SolarWinds on their networks could still be impacted. For example, the indicators of compromise (IOCs) have been found on networks without SolarWinds. In addition, although SolarWinds may not have been used by entities, their key suppliers may use the product. Should the suppliers be compromised, the supplier in turn could compromise their customers, including those without SolarWinds. In fact, there is evidence technology firms were targeted for this reason.”¹¹ Accordingly, electricity industry participants should carefully review the recommended actions in the whitepaper and the alerts it references and consider implementing those that apply to them.

The whitepaper also notes that “[t]he E-ISAC is working closely with its members, FERC, and other partners in the Canadian and United States governments to produce timely, actionable, and useful defense information for all segments of the electric industry.”¹² Going forward, the E-ISAC “anticipates supplementing its current information sharing with new [Cybersecurity Risk Information Sharing Program] capabilities, enhanced cross-border sharing, and collaboration with the U.S. Department of Energy’s office of Cybersecurity, Energy Security and Emergency Response,” and FERC staff “stands ready to assist in the dissemination of actionable information that supports the electric industry in proactively responding to cyber attacks and other cyber vulnerabilities.” The whitepaper is available here. Stay tuned.

¹ Whitepaper at 17.

² Id. at 6.

³ Id. at 13.

⁴ Id. at 6.

⁵ Id.

⁶ Id.

⁷ Id. at 4.

⁸ Id. at 4-5.

⁹ Id. at 5, 9.

¹⁰ Id. at 5, 10-18.

¹¹ Id. at 4 (emphasis added).

¹² Id. at 17.