SolarWinds Hack – From Supply Chain Risk To Full Spectrum Awareness

The sustained SolarWinds hack that closed out 2020 will have long-lasting ramifications. The hackers behind the attack were highly skilled and patient, but industry analysis has uncovered traces of how those operations were carried out. Understanding what information they sought out is important to help improve preparedness for these supply chain risks. While the list of victims may never be fully divulged, we can recognize that as an industry, our own behaviors need attention. This is where full spectrum awareness and full spectrum security comes into play and can make all the difference between being “in the news” and being “out of the news.”  The brand damage that SolarWinds, FireEye, and Capital One suffered is gigantic, and no one should want that exposure if they can avoid it. 

The SolarWinds hack is a typical “supply chain” hack.  In other words, that is an example of how hackers are using third party software providers like SolarWinds to infiltrate end user customers. It is now well known that the hackers managed to leverage false certificates and validation tokens to avoid detection and prove identity during their infiltrations. Once inside and from a position of relative trust, the path to specifically targeting other resources was simple to execute. Organizations that used the affected monitoring systems are still assessing the extent of this malicious intrusion—and may be doing so for a long time. 

More than Tools

Hackers tend to use the least common denominator or weakest link in the chain to maximize their impact and minimize their efforts while major cyberattacks inevitably seem to track with poor cyber hygiene. Standard access controls, security controls, and even an entire chest full of attractive security tools do not make for better security. Your weakest link may well be a third party software somewhere in your supply chain.

The answer is not as simple as throwing out the affected product and replacing it with another. Jumping from one vendor to the next is like putting bandages upon bandages. This behavior does not add to security, and makes security more complicated and difficult to implement internally. 

Beyond our corporate digital borders, the issue is not just about SolarWinds. The industry must work towards applying technology better overall, in a process of comprehensive awareness that covers the complete spectrum of protection in terms of technology, business value and protocols. Applying technologies better is a mandate that should be driven by outcomes, not checklists and processes. This is especially critical as we continue to adopt rapid technologies to take advantage of new business opportunities. 

Driven by Outcomes

When we embrace the comprehensive outcome-driven security philosophy, we can collectively begin looking at the supply chain, demanding better detection and processes from suppliers. Internally, we can clean up our own operations from there and focus on:

• Third party risk assessment 
• Risk management
• Backups
• Disaster recovery
• Improved procedures
• Risk planning
• Complete security procedures

For businesses in services or supply chain relationships (which is everyone), the philosophy also applies. Services are important, but security is critical. Trust must be established and maintained. The relationship begins with a shared establishment of a security mission for the operation as a whole. Reviewing partners and addressing risk includes assessing the components of security that matter most to your organization including:

• Statement of their industry compliance
• Analysis of solutions offerings
• Review of their internal cybersecurity training and practices
• Use of sophisticated tool sets such as MFA, behavioral security analysis, and DevSecOps
• Least privilege controls 
• Proactive monitoring
• Multi-factor authentication linkages
• Multi-layered security 
• Patch Management Practices
• Incident response plans
• Routine penetration testing

Complete these technology and security assessments every year at least to create your own assurance and establish your own expectations of assurance from partners. 

It is important not to get lost in the cybersecurity mission. Now is the time to step things up by establishing awareness across information technology operations and integrating these values into the overall business proposition. For corporate IT executives, delivering a standard of reputation and assurance that cascades throughout the matrix of modern risks is essential and staying firmly on top of cybersecurity threats is an existential mission nowadays. If you can’t do it by yourself (many can’t), make sure you find a partner that can.