While this approach may have historically served the need to rapidly risk-rank suppliers and limit extending trust to low-performing organizations, it does not adequately address those suppliers that score well in these processes and that are then placed into positions of trust with high-risk access to data and networks. This refactoring will require time for new approaches to develop and mature, but three takeaways from the attack are clear today.įirst, an organization cannot simply rely on a combination of questionnaires and outside information about the vulnerabilities and practices of critical suppliers to assess the likelihood of a breach of their systems, which may then harm other organizations. Ultimately, the SolarWinds attack requires a shift in the way companies assess cyber risk in their supply chains as well as the way they view other associated risks. The attackers’ approach to target a small set of specific victims using SolarWinds’ supply-chain entry point even though they had potential access to more organizations is also remarkable. In fact, had they not attacked FireEye (with a world-class incident response practice in its Mandiant Solutions branch), they may have gone undetected for even longer. This is a stark reminder that no amount of risk ranking, vendor profiling, or controls will thwart a persistent, capable adversary, or compensate for systemic vulnerabilities in an organization’s approach to managing a software supply chain and its supporting technologies.Īlthough the attack used a few new and refined mechanisms to compromise SolarWinds and other organizations (such as low-level compromises of the software development process and the subversion of cloud identity management technology), it was the attackers’ skilled penetration and prolonged period of remaining undetected that was the most astonishing.

The attack on SolarWinds, disclosed in the company’s December regulatory filings, and subsequent victims including FireEye, Microsoft Corp., and numerous US federal agencies, tears at the fabric of standard risk management and security practices.

Amid this turmoil, a widespread and persistent attack that would further disrupt our confidence in the software supply chain and shatter our trust in enterprise software quietly lingered.

Cyber criminals seized the crisis as an opportunity to further monetize attacks by proliferating ransomware and leveraging more commonplace fraud techniques at record levels. A report by Crowdstrike in September, for example, noted that it had seen more attacks in the first half of 2020 than in all of 2019. In 2020, we saw a rapid increase in cyberattacks while the COVID-19 pandemic ravaged the globe.

Solarwinds supply chain attack