4 ms·

How many other SolarWinds are there? This company was allowed to install code on highly secure computers, but did not themselves have high levels of security. T

How many other SolarWinds are there? This company was allowed to install code on highly secure computers, but did not themselves have high levels of security. The practice of allowing random companies with poor security practices to install code is what lead to this breach. Any company that is allowed to do so must have 3rd party security auditing on a continuous basis.

ttul 6y ago
SolarWinds has achieved SOC2 compliance: https://orangematter.solarwinds.com/2019/06/12/solarwinds-achieves-soc-2-type-ii-certification/ https://orangematter.solarwinds.com/2019/06/12/solarwinds-ac... SOC2 is pretty heavy duty to achieve and to maintain. But SOC2 is not a guarantee that your company will be impervious to the kinds of mistakes that landed them in hot water this year.
- vhodges 6y ago
  I am NOT well versed (so standard disclaimers apply :) but https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html says that SOC2 is (mostly) about sales and little about validating security practices, only that you have them. I find it telling that SOC2 audits are performed by accountants.
  - throwaway201103 6y ago
    Even a financial audit is based on what the company tells the auditors and is about whether the financial reporting conforms to generally accepted principles, not whether it's actually correct.
- delaynomore 6y ago
  >SOC2 is pretty heavy duty to achieve and to maintain. As an auditee who dealt with SOC2 for the last 3 years I'd say that's not true. It's heavy on reviewing documentation and not the true efficacy of your security program.
- necubi 6y ago
  > SOC2 is pretty heavy duty to achieve and to maintain. LOL, no. I've gone through SOC2, and it's not hard at all to achieve. SOC2 is basically just about (1) documenting controls and (2) following them. You have a lot of leeway with your auditor on what those controls entail (and remember, you choose and pay your auditor, so there's also a huge conflict of interest here). We did have to do a yearly security audit, but it's foolish to think that will catch all issues, and it relies a lot on the company being helpful and open with their auditor. You also a lot of leeway in arguing down issue severity. We got SOC2 certified because many companies require that their vendors have it, but I personally think it has little to no value, and I would not trust a company any more because they've gone through it.
  - KajMagnus 6y ago
    The auditors, were they IT security professionals (if so, about how many years experience?), or accountants, or mixed, or something else? Were there any requirements about pentesting one's company somehow? Did they look at source code?
    - suifbwish 6y ago
      Auditors looking at source code.. Are you serious? From that question alone I can tell you know nothing about these audits.
      - KajMagnus 6y ago
        Actually there are auditors who look at source code — "code audits", https://en.wikipedia.org/wiki/Code_audit https://en.wikipedia.org/wiki/Code_audit And there's a job role called "Source Code Auditor". Question was if GGP's SOC2 case involved any such source code audits or not. Now, having read https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html (linked from a nearby comment, https://news.ycombinator.com/item?id=25489586 https://news.ycombinator.com/item?id=25489586), seems SOC2 does not include those types of audits. Could still be nice to hear directly from GGP @necubi though. ("yearly security audit"?)
- jiveturkey 6y ago
  lol! SOC2 is a joke. it’s checkbox compliance and rather easy to achieve.
Veserv 6y ago
You have identified the right problem (a company with security like SolarWinds should not be used on critical systems), but based on your wording likely for a common, but wrong reason. The wording you are using indicates the belief that the breached company, in this case SolarWinds, was uncharacteristically stupid/incompetent and extremely below average and if they just adopted good practices (such as those on the highly secure computers) then the problems would be unlikely to occur. Unfortunately, SolarWinds is, with high probability, above average and above average is, in absolute terms, abysmal. In fact, even the "best" systems are inadequate and effectively useless against credible attackers. FireEye was hacked. Symantec, TrendMicro, McAfee were hacked [1]. Kaspersky was hacked and as part of the hack it was determined that the NSA was previously hacked [2]. Lockheed Martin was hacked and the F-35 blueprints were leaked [3]. That was done using the results from a previous hack months earlier on the company RSA as a part of EMC [4]. The NSA was hacked by The Shadow Brokers who were then themselves hacked [5]. Microsoft Windows gets hacked regularly. The same with MacOS/iOS. Android as well. Hospitals, banks, cars. None of these organizations can protect themselves from their actual foes. In absolute terms, there is no meaningful difference between the "best" and SolarWinds as the difference is like arguing the use of a piece of cardboard as a bulletproof vest since it is more bulletproof than a piece of paper even though neither actual accomplishes the goal of stopping a bullet. So, to answer your question of: "How many other SolarWinds are there?" All of them. Also, as a secondary point, any security process that allows random, insecure systems to be connected to secure systems without positively identifying if the integration retains the security properties of the secure system is not a security process that creates "secure" systems. That is literally the first step of any good security process as you point out. Therefore, the "highly secure computers" in your example are actually very likely not actually "highly secure" as they were developed by a security process that is incapable of developing high security systems. If they are actually high security, then that would be purely by extraordinary luck as even the most trivial, amateurish of mistakes would violate the security properties and we know experimentally that randomly walking into high security is effectively impossible. A more proper terminology would likely be "high value computers" as they are protecting things that are important, just with inadequate security. [1] https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/ https://arstechnica.com/information-technology/2019/05/hacke... [2] https://www.washingtonpost.com/world/national-security/israel-hacked-kaspersky-then-tipped-the-nsa-that-its-tools-had-been-breached/2017/10/10/d48ce774-aa95-11e7-850e-2bdd1236be5d_story.html https://www.washingtonpost.com/world/national-security/israe... [3] https://www.reuters.com/article/us-usa-defense-hackers/exclusive-hackers-breached-u-s-defense-contractors-idUSTRE74Q6VY20110527 https://www.reuters.com/article/us-usa-defense-hackers/exclu... [4] https://www.wired.com/2011/08/how-rsa-got-hacked/ https://www.wired.com/2011/08/how-rsa-got-hacked/ [5] https://www.npr.org/2017/11/14/564006460/nsas-hackers-are-hacked-in-major-cybersecurity-breach https://www.npr.org/2017/11/14/564006460/nsas-hackers-are-ha...

ttul 6y ago

SolarWinds has achieved SOC2 compliance: https://orangematter.solarwinds.com/2019/06/12/solarwinds-achieves-soc-2-type-ii-certification/ https://orangematter.solarwinds.com/2019/06/12/solarwinds-ac... SOC2 is pretty heavy duty to achieve and to maintain. But SOC2 is not a guarantee that your company will be impervious to the kinds of mistakes that landed them in hot water this year.

vhodges 6y ago
I am NOT well versed (so standard disclaimers apply :) but https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html says that SOC2 is (mostly) about sales and little about validating security practices, only that you have them. I find it telling that SOC2 audits are performed by accountants.
- throwaway201103 6y ago
  Even a financial audit is based on what the company tells the auditors and is about whether the financial reporting conforms to generally accepted principles, not whether it's actually correct.
delaynomore 6y ago
>SOC2 is pretty heavy duty to achieve and to maintain. As an auditee who dealt with SOC2 for the last 3 years I'd say that's not true. It's heavy on reviewing documentation and not the true efficacy of your security program.
necubi 6y ago
> SOC2 is pretty heavy duty to achieve and to maintain. LOL, no. I've gone through SOC2, and it's not hard at all to achieve. SOC2 is basically just about (1) documenting controls and (2) following them. You have a lot of leeway with your auditor on what those controls entail (and remember, you choose and pay your auditor, so there's also a huge conflict of interest here). We did have to do a yearly security audit, but it's foolish to think that will catch all issues, and it relies a lot on the company being helpful and open with their auditor. You also a lot of leeway in arguing down issue severity. We got SOC2 certified because many companies require that their vendors have it, but I personally think it has little to no value, and I would not trust a company any more because they've gone through it.
- KajMagnus 6y ago
  The auditors, were they IT security professionals (if so, about how many years experience?), or accountants, or mixed, or something else? Were there any requirements about pentesting one's company somehow? Did they look at source code?
  - suifbwish 6y ago
    Auditors looking at source code.. Are you serious? From that question alone I can tell you know nothing about these audits.
    - KajMagnus 6y ago
      Actually there are auditors who look at source code — "code audits", https://en.wikipedia.org/wiki/Code_audit https://en.wikipedia.org/wiki/Code_audit And there's a job role called "Source Code Auditor". Question was if GGP's SOC2 case involved any such source code audits or not. Now, having read https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html (linked from a nearby comment, https://news.ycombinator.com/item?id=25489586 https://news.ycombinator.com/item?id=25489586), seems SOC2 does not include those types of audits. Could still be nice to hear directly from GGP @necubi though. ("yearly security audit"?)
jiveturkey 6y ago
lol! SOC2 is a joke. it’s checkbox compliance and rather easy to achieve.

Veserv 6y ago

You have identified the right problem (a company with security like SolarWinds should not be used on critical systems), but based on your wording likely for a common, but wrong reason. The wording you are using indicates the belief that the breached company, in this case SolarWinds, was uncharacteristically stupid/incompetent and extremely below average and if they just adopted good practices (such as those on the highly secure computers) then the problems would be unlikely to occur. Unfortunately, SolarWinds is, with high probability, above average and above average is, in absolute terms, abysmal. In fact, even the "best" systems are inadequate and effectively useless against credible attackers. FireEye was hacked. Symantec, TrendMicro, McAfee were hacked [1]. Kaspersky was hacked and as part of the hack it was determined that the NSA was previously hacked [2]. Lockheed Martin was hacked and the F-35 blueprints were leaked [3]. That was done using the results from a previous hack months earlier on the company RSA as a part of EMC [4]. The NSA was hacked by The Shadow Brokers who were then themselves hacked [5]. Microsoft Windows gets hacked regularly. The same with MacOS/iOS. Android as well. Hospitals, banks, cars. None of these organizations can protect themselves from their actual foes. In absolute terms, there is no meaningful difference between the "best" and SolarWinds as the difference is like arguing the use of a piece of cardboard as a bulletproof vest since it is more bulletproof than a piece of paper even though neither actual accomplishes the goal of stopping a bullet. So, to answer your question of: "How many other SolarWinds are there?" All of them. Also, as a secondary point, any security process that allows random, insecure systems to be connected to secure systems without positively identifying if the integration retains the security properties of the secure system is not a security process that creates "secure" systems. That is literally the first step of any good security process as you point out. Therefore, the "highly secure computers" in your example are actually very likely not actually "highly secure" as they were developed by a security process that is incapable of developing high security systems. If they are actually high security, then that would be purely by extraordinary luck as even the most trivial, amateurish of mistakes would violate the security properties and we know experimentally that randomly walking into high security is effectively impossible. A more proper terminology would likely be "high value computers" as they are protecting things that are important, just with inadequate security. [1] https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/ https://arstechnica.com/information-technology/2019/05/hacke... [2] https://www.washingtonpost.com/world/national-security/israel-hacked-kaspersky-then-tipped-the-nsa-that-its-tools-had-been-breached/2017/10/10/d48ce774-aa95-11e7-850e-2bdd1236be5d_story.html https://www.washingtonpost.com/world/national-security/israe... [3] https://www.reuters.com/article/us-usa-defense-hackers/exclusive-hackers-breached-u-s-defense-contractors-idUSTRE74Q6VY20110527 https://www.reuters.com/article/us-usa-defense-hackers/exclu... [4] https://www.wired.com/2011/08/how-rsa-got-hacked/ https://www.wired.com/2011/08/how-rsa-got-hacked/ [5] https://www.npr.org/2017/11/14/564006460/nsas-hackers-are-hacked-in-major-cybersecurity-breach https://www.npr.org/2017/11/14/564006460/nsas-hackers-are-ha...