3 ms·

This is indefensible. However, Solarwinds isn't a security company. They build network monitoring/management tools and have a very telco feel. I'm honestly not

by mike_d 6y ago

This is indefensible. However, Solarwinds isn't a security company. They build network monitoring/management tools and have a very telco feel. I'm honestly not surprised by this level of incompetence.

chrisco255 6y ago
Their software allows network traffic to be monitored for some of the most important government agencies we have: the White House, the Pentagon, Treasury Dept, etc. They're not some retail company. Their tools provide a vector to attack extremely sensitive systems. Network monitoring and management is by definition supposed to be secure, especially for critical systems.
- cbsmith 6y ago
  Agreed... but having used SolarWinds... I can't believe people use this stuff.
captn3m0 6y ago
They have 6 tools listed on their IT Security Downloads: - Access Rights Manager: Manage and audit access rights across your IT infrastructure - Security Event Manager - Improve your security posture and quickly demonstrate compliance with an easy-to-use, affordable SIEM tool - Server Configuration Monitor - Gain visibility into systems changes and easily compare configurations over time with our new change monitoring tool - Patch Manager - Patch management software designed to quickly address software vulnerabilities - Serv-U Managed File Transfer Server - Enhance security and control over file transfers in and outside your organization - Serv-U File Transfer Protocol Server - Simple, affordable, easy-to-use FTP server software While I wouldn't call all of these security sensitive, but considering some of the other tools that they built: - Dameware Remote Support: Remote control and systems management tools in one easy-to-use package - Dameware Remote Everywhere: Deliver the tools IT professionals need in a cloud-based, remote support solution - User Device Tracker: Network device tracking software designed to locate users and devices on your network they definitely count as a security-sensitive vendor.

by mike_d 6y ago

chrisco255 6y ago

Their software allows network traffic to be monitored for some of the most important government agencies we have: the White House, the Pentagon, Treasury Dept, etc. They're not some retail company. Their tools provide a vector to attack extremely sensitive systems. Network monitoring and management is by definition supposed to be secure, especially for critical systems.

cbsmith 6y ago
Agreed... but having used SolarWinds... I can't believe people use this stuff.

captn3m0 6y ago

They have 6 tools listed on their IT Security Downloads: - Access Rights Manager: Manage and audit access rights across your IT infrastructure - Security Event Manager - Improve your security posture and quickly demonstrate compliance with an easy-to-use, affordable SIEM tool - Server Configuration Monitor - Gain visibility into systems changes and easily compare configurations over time with our new change monitoring tool - Patch Manager - Patch management software designed to quickly address software vulnerabilities - Serv-U Managed File Transfer Server - Enhance security and control over file transfers in and outside your organization - Serv-U File Transfer Protocol Server - Simple, affordable, easy-to-use FTP server software While I wouldn't call all of these security sensitive, but considering some of the other tools that they built: - Dameware Remote Support: Remote control and systems management tools in one easy-to-use package - Dameware Remote Everywhere: Deliver the tools IT professionals need in a cloud-based, remote support solution - User Device Tracker: Network device tracking software designed to locate users and devices on your network they definitely count as a security-sensitive vendor.