I think they know this is a pretty desperate story. Some of the other coverage [1] suggest Solarwinds had so many different overlapping security failures they

I think they know this is a pretty desperate story. Some of the other coverage [1] suggest Solarwinds had so many different overlapping security failures they may never be able to attribute to a single cause. Still there's some interesting things that could help a (much smaller, less critical) software vendor decide where to focus their security efforts. Perhaps near the top of the list should be: 1. Who in your organisation has access to your build and distribution toolchain, and how secure are their credentials? 2. How good is your record keeping? Are all your builds traceable back to a specific revision in your source control, and are you keeping build logs somewhere they can't be tampered with? [1] https://www.bloomberg.com/opinion/articles/2021-02-26/deepening-mystery-and-fear-over-the-solarwinds-hack https://www.bloomberg.com/opinion/articles/2021-02-26/deepen...