3 ms·

The really interesting things are the apparent areas for redaction in the original lawsuit [0] pdf. For example: 1. This action asserts derivative claims on be

by Shank 5y ago

The really interesting things are the apparent areas for redaction in the original lawsuit [0] pdf. For example: 1. This action asserts derivative claims on behalf of SolarWinds against current and former members of the Company’s board of directors (the “Board”), for their utter failure to implement or oversee any reasonable monitoring system concerning [redacted] cybersecurity risks fundamental to SolarWinds’ only line of business. [entire sentence redacted] 2. Paragraph 5 is redacted entirely, but paragraph 6 states "these warnings underscored the specific and heightened risk." Does that mean that paragraph 5 contained notes from previous warnings that were ignored? If so, that's very interesting. 3. Paragraph 7's last sentence on warnings is redacted, and paragraphs 8, 9, and 10 are redacted. Paragraph 11 starts by saying that oversight failures were at play. Perhaps people inside were both warned and ignored warnings prior to the attack taking place? The rest of the complaint contains a very similar pattern: large swathes of redactions in and around failures to monitor the situation and failures to account for risk exposure. Paragraph 79: "By utterly failing to implement or oversee any reasonable monitoring system concerning the Company’s cybersecurity risks, SolarWinds’ Board disabled itself from being informed of mission critical risks at the Company and breached its fiduciary duties to the Company and its shareholders." Yikes. [0]: https://github.com/jaybobo/jaybobo/blob/main/docs/solarwinds-complaint/20211104-shareholders-vs-solarwinds-board-filing.pdf https://github.com/jaybobo/jaybobo/blob/main/docs/solarwinds...

syshum 5y ago
Massive laps on security do not just happen. I am sure there are TONS of internal communication and likely external communication highlighting various security concerns. Often these are ignored by leadership in favor of things that direct increase quarterly earnings or directly reduce cost It is a tale as old as the information technology industry
TrueDuality 5y ago
It is really common for any company that wants to maintain certain levels of compliance that they get a security audit. There are generally two paths forward for anything that is found, fix it... Or the terrifying path that is more commonly chosen "add it to the risk register". Company risk registers are signed off on by the boards, or more commonly an appointee of the board that is acting on their behalf. The risk register itself is almost never available outside the company except in some cases to major shareholders, or large business partners that make access to it a condition of a large deal. I suspect what happened here is they were told of the issues and added them to their risk register them promptly forgot about them. By doing so they accepted the liability if those risks ever became realized which would open them up to a lawsuit like this.

by Shank 5y ago

syshum 5y ago

Massive laps on security do not just happen. I am sure there are TONS of internal communication and likely external communication highlighting various security concerns. Often these are ignored by leadership in favor of things that direct increase quarterly earnings or directly reduce cost It is a tale as old as the information technology industry

TrueDuality 5y ago

It is really common for any company that wants to maintain certain levels of compliance that they get a security audit. There are generally two paths forward for anything that is found, fix it... Or the terrifying path that is more commonly chosen "add it to the risk register". Company risk registers are signed off on by the boards, or more commonly an appointee of the board that is acting on their behalf. The risk register itself is almost never available outside the company except in some cases to major shareholders, or large business partners that make access to it a condition of a large deal. I suspect what happened here is they were told of the issues and added them to their risk register them promptly forgot about them. By doing so they accepted the liability if those risks ever became realized which would open them up to a lawsuit like this.