The article has good points about the nature of attacks by a determined adversary. The concept of "The One Critical TTP" that companies tout to divert blame and

The article has good points about the nature of attacks by a determined adversary. The concept of "The One Critical TTP" that companies tout to divert blame and that observers use to justify why they are not vulnerable to the same thing is utter nonsense. If somebody shoots a bullet at a bulletproof vest and it goes through you should not conclude that they just so happened to hit the only weak spot and if you just fix it everything is okay. You should instead assume that the bulletproof vest might have lots of problems at least against the gun you were using to test it. Successful breaches and attacks do not show you where your only weak points are, they show you the level of quality your process provides. To actually fix the problems the process, not the product, needs to be improved so that it is able to deliver higher quality outcomes. In the case of SolarWinds, we now know that the level of quality their process provides is insufficient to stop whoever attacked them. If we assume that it was a targeted attack by a nation-state actor, then we now know that they can not protect their customers against an actual adversary who had reason to attack them, willingness to attack them, and the ability to attack them. They are completely unable to defend against actual threats who will actually attack them. Lots of people will say: "Of course if a nation-state wants to attack me then there is nothing I can do, but why would they attack me?" Well, in this case, that is an actual threat. To provide an actual solution they do, in fact, actually need to be able to stop a nation-state. So, how does SolarWinds fare against a nation-state? They are not even on the same continent. Everybody thinks it is completely and utterly laughable that they would have had any hope of stopping them. Not just that, it is a forgone conclusion that if a nation-state wants to attack any commercial system they can with utter ease. It is not even viewed as a possibility for any currently deployed system to stop any nation-state from getting what they want. How far are these systems from stopping a nation-state? Well first we need to figure out what a nation-state can do. How valuable do you think the specs for the $1.5 trillion F-35 project would be to a peer adversary [1]? $100B? $10B? $1B? At the very least I would state that if a peer adversary could get the specs for the F-35 they would be willing to spend at least $1B on that project. So, to stop a nation-state you need a system that can protect against an attack funded to the $1B level. Assuming $500k/engineer-yr that is an attack with 2,000 engineer-years of development on it. There is no organization in the world who would even dare to claim that a team of 400 engineers working for 5 years could not completely and utterly compromise their systems. Even at 1/10th that nobody would dare to claim they could stop 40 engineers with 5 years. Even at 1/100th you would be hard pressed to actually find anybody who would claim they can stop 4 engineers for 5 years and you could probably count on one hand somebody who could actually deliver. The systems that are being deployed that are actually attacked by and must protect against nation-states need to improve by at least a factor of 100x before they can actually do their job. So, these systems are multiple orders of magnitudes away from achieving the minimum standard of functionality. What can be done about this state of affairs? Either we must do 100x better than the best deployed systems, or if that can not be done, then we must assume that these systems can be 100% guaranteed compromised and act accordingly. Either we must disconnect these systems since they can not be defended, or the benefits of their use must be greater than the worst-case outcome of failure. [1] https://www.idga.org/archived-content/news/pentagon-admits-f-35-data-theft-is-a-major-problem https://www.idga.org/archived-content/news/pentagon-admits-f...