6 ms·

SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation

108 points by miguelazo 3y ago

miguelazo 3y ago
Would mark a major escalation in executive accountability... Still no criminal charges, though. >“Sunburst was a highly sophisticated and unforeseeable attack that the United States government has said was carried out by a global superpower using novel techniques in a new type of threat that cybersecurity experts had never seen before,” a company spokesperson told Cybersecurity Dive in an emailed statement
- dragonwriter 3y ago
  > Would mark a major escalation in executive accountability... Still no criminal charges, though. If there was a criminal referral they wouldn’t announce it and any charges would usually sigbificantly trail civil enforcement action, judging from every other SEC civil + DOJ criminal action I’ve seen.
- grun3 3y ago
  Wasn't the root cause of this attack someone setting a prod system password to 'solarwinds123'? Not very sophisticated nor unforseeable. Not just any prod system... the one that distributed their trusted updates to their entire customer base I believe.
  - donmcronald 3y ago
    Haha. I didn't follow it. After a bit of searching I had to laugh. They got owned by the 'hunter2' meme and call it a highly sophisticated and unforeseeable attack.
    - mlyle 3y ago
      Well, all the subsequent steps after the initial breach were fairly fancy. But still, not a great posture overall.
  - miguelazo 3y ago
    Exactly... the initial foothold was a joke. And the bottom line is that important management folks were warned about serious issues many times.
  - mac-chaffee 3y ago
    No, that was a separate incident: https://www.theregister.com/2020/12/16/solarwinds_github_password/ https://www.theregister.com/2020/12/16/solarwinds_github_pas... From what I can tell, all we know is that the attackers definitely got into their build system (since the trojan was signed), and we know they moved laterally through exploits in various Microsoft products: https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
    - wharfjumper 3y ago
      Will we see the SEC issue proceedings against Microsoft?
eganist 3y ago
The more these happen, the more likely it'll be that the role of CISO will need to be compensated commensurate to risk. And report up to the CEO. But it also depends on the nature of the action that's about to come down. My guess is something to do with misrepresentation of Solarwinds' security posture.
- toomuchtodo 3y ago
  CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. Anyone else (CXO) has incentive to apply pressure at odds with the role, or not take compliance requirements or regimes seriously. Checks and balances. @dvt: you can nudge with legislation (or in this case, executive branch rule making), we’re just at the initial phase of getting there: https://www.axios.com/2023/04/07/company-boards-sec-cybersecurity https://www.axios.com/2023/04/07/company-boards-sec-cybersec... | https://www.sec.gov/news/press-release/2022-39 https://www.sec.gov/news/press-release/2022-39 | https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-about-to-force-cisos-into-americas-boardrooms/ https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-... Statute and rule making, like corporate bylaws, are mutable, and must adapt to the risk landscape. (thoughts and opinions my own, interim deputy CISO in finance)
  - eganist 3y ago
    Who would the CRO report to?
  - dvt 3y ago
    > CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. I mean, this is all company bylaws, you can't seriously legislate this. But in any case, C-execs do have skin in the game (particularly if investigated by the SEC). They're usually insulated, but if non-compliant (or grossly negligent), directors can be personally liable.
    - CPLX 3y ago
      You could legislate that if you wanted to.
taeric 3y ago
Wow, Matt Levine's take that "everything is securities fraud" is rather amusing to apply here. I'm curious what the actual charges will be.
- duped 3y ago
  I mean as "selling a quarter billion dollars of stock before publicly disclosing the cyber crime of the century that you likely knew about for quite some time" is less "anything" and more "trading on material non public information."
  - walrus01 3y ago
    What's most amazing is they apparently thought this wouldn't be noticed by the SEC? execs of a company of that size absolutely should know better.
  - taeric 3y ago
    Ha! On this, I will blame the bad reporting, then. This story seems to focus on response to a security event. Do you have a pointer to the trades that are in question? Edit: Notably, where did you get that quote? I'm not seeing it in this story.
    - duped 3y ago
      This has been widely reported for two and a half years. Here's the first link I could find: https://www.crn.com/news/security/-286m-of-solarwinds-stock-sold-before-ceo-hack-disclosures https://www.crn.com/news/security/-286m-of-solarwinds-stock-... The quotes are not from the article, it's a writing style.
      - taeric 3y ago
        Understood, is not news I would typically follow, so unknown to me. Thanks for link to another source! As with most answers, this one comes with questions of its own. If it was that well known and obvious, why did it take so long to move on it? I'm now interested in this topic. :D
666satanhimself 3y ago
[dead]
suid 3y ago
I think the key here is that SolarWinds' C-staff deliberately downplayed the severity of the attack, and were very late in informing customers and regulatory agencies of the severity of the attack. I.e. they are being prosecuted not because they were "incompetent and got hacked", but that they then "tried to cover it up", which is where the SEC comes in (illegal stock manipulation via false or incomplete release of public information).
- b112 3y ago
  I.e. they are being prosecuted not because they were "incompetent and got hacked", but that they then "tried to cover it up" Capone was taken down for tax evasion. Any tool we have, is a good one. And the more shareholders and board members feel lax security could lead to a bad path (eg hiding the result), the better for all. I can hardly wait for the first civil lawsuits, for any such incident, by shareholders over negligence and loss of value. I can hardly wait until everyone had to provide a license validation for all code they use, so we can finally put node crap to rest.
  - philipwhiuk 3y ago
    > I can hardly wait until everyone had to provide a license validation for all code they use, so we can finally put node crap to rest. I don't see a reason Node dies faster than say, Java, or Rust or ...
- rkagerer 3y ago
  deliberately downplayed the severity of the attack You mean like UPS just did? https://news.ycombinator.com/item?id=36439033 https://news.ycombinator.com/item?id=36439033
- georgeplusplus 3y ago
  [dead]
miguelazo 3y ago
Couple of side notes that are very interesting: Palo Alto detected the SolarWinds problem early, but failed to notify the Cyber Threat Alliance which it spearheaded, significantly exacerbating the impact: https://www.cfr.org/blog/most-tools-failed-detect-solarwinds-malware-those-did-failed-too https://www.cfr.org/blog/most-tools-failed-detect-solarwinds... The PE firm that basically ran SolarWinds into the ground (Thoma Bravo) bought Proofpoint in 2021, not too long after the debacle became public.
- tolstoshev 3y ago
  Thoma Bravo is poison. They took over LogRhythm when I was working there and ruined it. If your employer is ever bought by then, polish your resume.
cosmiccatnap 3y ago
No amount of financial cost is sufficient for these kinds of things if you wish to truly prevent them in the future. There needs to be associated criminal charges for the individuals responsible. We are all still suffering from the Equifax breach all these years later and it won't be long before another Enron shows itself and that is simply because there was never any real consequences for the people primarily responsible.
user6723 3y ago
We live in an age of binary reproducible builds and anything worth running is open source. Windows-centric orgs barely know software from their ass. If your org is dumb enough to run closed source software for core IT functions, or you run Windows on bare metal, or don't have TPM chips and secure boot enabled, you kinda deserve what you get.

108 points by miguelazo 3y ago

Would mark a major escalation in executive accountability... Still no criminal charges, though. >“Sunburst was a highly sophisticated and unforeseeable attack that the United States government has said was carried out by a global superpower using novel techniques in a new type of threat that cybersecurity experts had never seen before,” a company spokesperson told Cybersecurity Dive in an emailed statement

dragonwriter 3y ago
> Would mark a major escalation in executive accountability... Still no criminal charges, though. If there was a criminal referral they wouldn’t announce it and any charges would usually sigbificantly trail civil enforcement action, judging from every other SEC civil + DOJ criminal action I’ve seen.
grun3 3y ago
Wasn't the root cause of this attack someone setting a prod system password to 'solarwinds123'? Not very sophisticated nor unforseeable. Not just any prod system... the one that distributed their trusted updates to their entire customer base I believe.
- donmcronald 3y ago
  Haha. I didn't follow it. After a bit of searching I had to laugh. They got owned by the 'hunter2' meme and call it a highly sophisticated and unforeseeable attack.
  - mlyle 3y ago
    Well, all the subsequent steps after the initial breach were fairly fancy. But still, not a great posture overall.
- miguelazo 3y ago
  Exactly... the initial foothold was a joke. And the bottom line is that important management folks were warned about serious issues many times.
- mac-chaffee 3y ago
  No, that was a separate incident: https://www.theregister.com/2020/12/16/solarwinds_github_password/ https://www.theregister.com/2020/12/16/solarwinds_github_pas... From what I can tell, all we know is that the attackers definitely got into their build system (since the trojan was signed), and we know they moved laterally through exploits in various Microsoft products: https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
  - wharfjumper 3y ago
    Will we see the SEC issue proceedings against Microsoft?

eganist 3y ago

The more these happen, the more likely it'll be that the role of CISO will need to be compensated commensurate to risk. And report up to the CEO. But it also depends on the nature of the action that's about to come down. My guess is something to do with misrepresentation of Solarwinds' security posture.

toomuchtodo 3y ago
CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. Anyone else (CXO) has incentive to apply pressure at odds with the role, or not take compliance requirements or regimes seriously. Checks and balances. @dvt: you can nudge with legislation (or in this case, executive branch rule making), we’re just at the initial phase of getting there: https://www.axios.com/2023/04/07/company-boards-sec-cybersecurity https://www.axios.com/2023/04/07/company-boards-sec-cybersec... | https://www.sec.gov/news/press-release/2022-39 https://www.sec.gov/news/press-release/2022-39 | https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-about-to-force-cisos-into-americas-boardrooms/ https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-... Statute and rule making, like corporate bylaws, are mutable, and must adapt to the risk landscape. (thoughts and opinions my own, interim deputy CISO in finance)
- eganist 3y ago
  Who would the CRO report to?
- dvt 3y ago
  > CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. I mean, this is all company bylaws, you can't seriously legislate this. But in any case, C-execs do have skin in the game (particularly if investigated by the SEC). They're usually insulated, but if non-compliant (or grossly negligent), directors can be personally liable.
  - CPLX 3y ago
    You could legislate that if you wanted to.

taeric 3y ago

Wow, Matt Levine's take that "everything is securities fraud" is rather amusing to apply here. I'm curious what the actual charges will be.

duped 3y ago
I mean as "selling a quarter billion dollars of stock before publicly disclosing the cyber crime of the century that you likely knew about for quite some time" is less "anything" and more "trading on material non public information."
- walrus01 3y ago
  What's most amazing is they apparently thought this wouldn't be noticed by the SEC? execs of a company of that size absolutely should know better.
- taeric 3y ago
  Ha! On this, I will blame the bad reporting, then. This story seems to focus on response to a security event. Do you have a pointer to the trades that are in question? Edit: Notably, where did you get that quote? I'm not seeing it in this story.
  - duped 3y ago
    This has been widely reported for two and a half years. Here's the first link I could find: https://www.crn.com/news/security/-286m-of-solarwinds-stock-sold-before-ceo-hack-disclosures https://www.crn.com/news/security/-286m-of-solarwinds-stock-... The quotes are not from the article, it's a writing style.
    - taeric 3y ago
      Understood, is not news I would typically follow, so unknown to me. Thanks for link to another source! As with most answers, this one comes with questions of its own. If it was that well known and obvious, why did it take so long to move on it? I'm now interested in this topic. :D

666satanhimself 3y ago

[dead]

suid 3y ago

I think the key here is that SolarWinds' C-staff deliberately downplayed the severity of the attack, and were very late in informing customers and regulatory agencies of the severity of the attack. I.e. they are being prosecuted not because they were "incompetent and got hacked", but that they then "tried to cover it up", which is where the SEC comes in (illegal stock manipulation via false or incomplete release of public information).

b112 3y ago
I.e. they are being prosecuted not because they were "incompetent and got hacked", but that they then "tried to cover it up" Capone was taken down for tax evasion. Any tool we have, is a good one. And the more shareholders and board members feel lax security could lead to a bad path (eg hiding the result), the better for all. I can hardly wait for the first civil lawsuits, for any such incident, by shareholders over negligence and loss of value. I can hardly wait until everyone had to provide a license validation for all code they use, so we can finally put node crap to rest.
- philipwhiuk 3y ago
  > I can hardly wait until everyone had to provide a license validation for all code they use, so we can finally put node crap to rest. I don't see a reason Node dies faster than say, Java, or Rust or ...
rkagerer 3y ago
deliberately downplayed the severity of the attack You mean like UPS just did? https://news.ycombinator.com/item?id=36439033 https://news.ycombinator.com/item?id=36439033
georgeplusplus 3y ago
[dead]

miguelazo 3y ago

Couple of side notes that are very interesting: Palo Alto detected the SolarWinds problem early, but failed to notify the Cyber Threat Alliance which it spearheaded, significantly exacerbating the impact: https://www.cfr.org/blog/most-tools-failed-detect-solarwinds-malware-those-did-failed-too https://www.cfr.org/blog/most-tools-failed-detect-solarwinds... The PE firm that basically ran SolarWinds into the ground (Thoma Bravo) bought Proofpoint in 2021, not too long after the debacle became public.

tolstoshev 3y ago
Thoma Bravo is poison. They took over LogRhythm when I was working there and ruined it. If your employer is ever bought by then, polish your resume.

cosmiccatnap 3y ago

No amount of financial cost is sufficient for these kinds of things if you wish to truly prevent them in the future. There needs to be associated criminal charges for the individuals responsible. We are all still suffering from the Equifax breach all these years later and it won't be long before another Enron shows itself and that is simply because there was never any real consequences for the people primarily responsible.

user6723 3y ago

We live in an age of binary reproducible builds and anything worth running is open source. Windows-centric orgs barely know software from their ass. If your org is dumb enough to run closed source software for core IT functions, or you run Windows on bare metal, or don't have TPM chips and secure boot enabled, you kinda deserve what you get.