#SOLARWINDS BREACH FULL#
#SOLARWINDS BREACH SOFTWARE#
#SOLARWINDS BREACH CODE#

“At some point most organizations, particularly larger ones, commit a sin that brings forth a swift and painful outcome. Despite what their data was telling them, they depended on each other to confirm what was happening. Organizations relied on the ‘gold standard’ for cybersecurity, which resulted in pluralistic ignorance. The audits, certifications and statements were all there- why dig deeper? Yet, from the risk manager’s perspective, SolarWinds had all the right compliance documentation. For a vendor with access to as much information as SolarWinds, these red flags should have been enough to scale back and examine that network connection. Related domains purchased by hackers were registered mostly by China.Īlthough none of the above signals clearly indicated when, how, or even if the attack would happen, they did suggest the company’s cyber hygiene was inadequate.Credential Management reported as deficient.SDLC Hacker Share Results show multiple exploits, including SQL injection.Some of which dated all the way back to 2018, including: In the case of SolarWinds, there were multiple signals amidst the noise that should have set off alarms. Signals are key to knowing when hackers are in the process of malicious activity. Unpatched software, SSL/TLS strength, open domain leverage, and websites owned by the potential target are also at risk. Once a target relevant to a hacker’s criteria is located, they then gather host information and as much identity-based data as they can to facilitate social engineering attacks through active and/ or passing scanning. If SolarWinds had been identified as a third party with greater financial impact, organizations could have paid special attention to reduce the signal-to-noise ratio and pick up on the key signals. The opportunity to pay special attention to signals from such a critical third party were missed because resources were likely allocated elsewhere. Without a quantitative understanding of probable financial impact, more noise remains in the ratio.Īs a result, SolarWinds gets lumped in with the rest of an organization’s “critical” vendors and signals go undetected.

#SOLARWINDS BREACH FULL#

Oftentimes, very few of their vendors have high hygiene scores, adding to the complexities associated with monitoring third-party risk.Ĭritical vendors vary in level of impact, which makes quantitative methodologies essential for determining the full picture.

#SOLARWINDS BREACH SOFTWARE#

It’s safe to assume that companies that utilize this kind of high-end, enterprise-wide software have a large number of additional third parties. A poor cyber hygiene score, for example, is not an indicator that a company has been hacked-resulting in deceiving, sometimes misleading, data. When potential impact factors are neglected or ignored, a cyber risk score can quickly become noise rather than a useful signal. This method makes understanding the difference between a score and a signal necessary.

īy attacking the “weakest link”, a hacker can gain access to an entire company without targeting it directly. įar more sophisticated than traditional attacks, the SolarWinds breach was built on the predominant method hackers leverage to infiltrate larger organizations-targeting the weakest links in supply chains. To make matters worse, accounts and directory settings were altered to facilitate long-term persistence. Once inside the Orion, hackers were able to counterfeit tokens, allowing them to impersonate organizations’ existing users.

#SOLARWINDS BREACH CODE#

At the center of the attack was SolarWinds’ Orion Network Management platform, which had a backdoor code inserted into its library. The SolarWinds Breach: Gray Rhino or Black Swan? Instances such as the recent attack on SolarWinds, however, blurs the line. In most cases, it’s clear whether an event should be classified as a gray rhino or a black swan.

The SolarWinds Breach: Gray Rhino or Black Swan?Ĭandan Bolukbas, CTO & Co-Founder Chris Bush, Chief Customer Officer Bob Maley, CSO, Black Kiteĭefined as a “slowly emerging, obvious threat that is ignored or minimized by decision makers,” a gray rhino is recognized, while the potential impact of the event itself is dismissed.Ī black swan, on the other hand, describes an event that comes as a surprise, has large-scale impact, and may be rationalized after the fact as being predictable because data signals were available but unaccounted for in risk mitigation programs.

Solarwinds breach