SOLARWINDS SUPPLY CHAIN ATTACK SOFTWARE

SOLARWINDS SUPPLY CHAIN ATTACK SOFTWARE

Chief information officers (CIOs) should consolidate software suppliers, and chief information security officers (CISOs) can reduce risk by exercising intense scrutiny over whether remaining suppliers should continue to have critical, trusted access.ДЇinally, businesses must consider leveraging cloud infrastructure to replicate capabilities that may have historically been delivered through installed, difficult-to-customize, and potentially insecure software.

There should be no more вЂњpreference buyingвЂќ across business and technology teams who have largely similar needs but use different and duplicative software simply because of siloed operations and personal preferences. This increased scrutiny of key supplier risks requires that businesses reduce their number of software suppliers. The level of trusted access that suppliers have enjoyed, even for those critical to business processes, will need to shift, and вЂњessential supplierвЂќ blessings (which sidestep risk and security processes) will become a thing of the past.

Second, security and technology leaders will need to focus more on the essential (вЂњkeyвЂќ) suppliers, which are unique to each organization. While this approach may have historically served the need to rapidly risk-rank suppliers and limit extending trust to low-performing organizations, it does not adequately address those suppliers that score well in these processes and that are then placed into positions of trust with high-risk access to data and networks. This refactoring will require time for new approaches to develop and mature, but three takeaways from the attack are clear today.ДЇirst, an organization cannot simply rely on a combination of questionnaires and outside information about the vulnerabilities and practices of critical suppliers to assess the likelihood of a breach of their systems, which may then harm other organizations. Ultimately, the SolarWinds attack requires a shift in the way companies assess cyber risk in their supply chains as well as the way they view other associated risks. The attackersвЂ™ approach to target a small set of specific victims using SolarWindsвЂ™ supply-chain entry point even though they had potential access to more organizations is also remarkable. In fact, had they not attacked FireEye (with a world-class incident response practice in its Mandiant Solutions branch), they may have gone undetected for even longer. This is a stark reminder that no amount of risk ranking, vendor profiling, or controls will thwart a persistent, capable adversary, or compensate for systemic vulnerabilities in an organizationвЂ™s approach to managing a software supply chain and its supporting technologies.ДЄlthough the attack used a few new and refined mechanisms to compromise SolarWinds and other organizations (such as low-level compromises of the software development process and the subversion of cloud identity management technology), it was the attackersвЂ™ skilled penetration and prolonged period of remaining undetected that was the most astonishing. The attack on SolarWinds, disclosed in the companyвЂ™s December regulatory filings, and subsequent victims including FireEye, Microsoft Corp., and numerous US federal agencies, tears at the fabric of standard risk management and security practices. Amid this turmoil, a widespread and persistent attack that would further disrupt our confidence in the software supply chain and shatter our trust in enterprise software quietly lingered. Cyber criminals seized the crisis as an opportunity to further monetize attacks by proliferating ransomware and leveraging more commonplace fraud techniques at record levels. A report by Crowdstrike in September, for example, noted that it had seen more attacks in the first half of 2020 than in all of 2019. In 2020, we saw a rapid increase in cyberattacks while the COVID-19 pandemic ravaged the globe.

Solarwinds supply chain attack