8 ms·

SEC Charges SolarWinds and CISO with Fraud, Internal Control Failures

248 points by arkadiyt 3y ago

chews 3y ago
It’s interesting to see SEC go after a CISO, yes he was at the helm but can’t the one to patch systems… yes they had an ongoing attack but disclosing that to shareholders is a sensitive affair… they were also a technology provider to the US government. I honestly think that is what got them the teeth of the SEC.
- arkadiyt 3y ago
  They weren't charged for having deficiencies, they were charged for knowing about their deficiencies and lying about them: > SolarWinds allegedly misled investors by disclosing only generic and hypothetical risks at a time when the company and Brown knew of specific deficiencies in SolarWinds’ cybersecurity practices as well as the increasingly elevated risks the company faced at the same time.
  - deleted 3y ago
    [deleted]
- WaitWaitWha 3y ago
  CISOs are still often not considered C-suite, and rarely get called to boardrooms. Commensurating with the new risks for a CISO, a seat in the C-suite, E&O coverage, and nice parachute are the minimum CISOs should get. Edit: I understand that in this case there were false statements made. That still does not remove the new risk for other CISOs to be dragged into quagmires they were not responsible for (see regulation discrepancies between various US, UK, or EU departments).
blakesterz 3y ago
"As the complaint alleges, SolarWinds’ public statements about its cybersecurity practices and risks were at odds with its internal assessments, including a 2018 presentation prepared by a company engineer and shared internally, including with Brown, that SolarWinds’ remote access set-up was “not very secure” and that someone exploiting the vulnerability “can basically do whatever without us detecting it until it’s too late,” which could lead to “major reputation and financial loss” for SolarWinds. Similarly, as alleged in the SEC’s complaint, 2018 and 2019 presentations by Brown stated, respectively, that the “current state of security leaves us in a very vulnerable state for our critical assets” and that “[a]ccess and privilege to critical systems/data is inappropriate.”" So I think if I'm reading that right, he knew things were “not very secure” and part of his role was to disclose that, and he didn't? I assume there's some rules in place that C level folks sign off on statements and he's the one to sign off on statements about security?
- deleted 3y ago
  [deleted]
- xwolfi 3y ago
  You're not reading that right: the problem isnt that this engineer knew the problem, it s that he gave management presentations about it and they didnt fix it.
  - cj 3y ago
    The problem isn’t that they didn’t fix it. It’s that they knew about it and didn’t disclose it. When a company IPOs the SEC requires it to file a document that contains all known risks to the business and all possible factors that could negatively impact the company’s value over time. It sounds like they failed to include this specific known incident in their filings with the government.
- wglb 3y ago
  This was likely Ian Thornton Trump: https://www.newsweek.com/ex-solarwinds-adviser-warned-company-security-issues-2017-incredibly-easy-target-hack-1556453 https://www.newsweek.com/ex-solarwinds-adviser-warned-compan...
- tru3_power 3y ago
  These are often times problems that sadly take a long time to fix. Were they at least trying? Or just straight up didn’t care?
- pests 3y ago
  He is not C-level.
jiveturkey 3y ago
6 months ago: > SolarWinds CISO Tim Brown has been named CISO of the Year by Globee Cybersecurity Awards for his work overseeing our Secure by Design initiative. > "Through our Secure by Design initiative and our ongoing commitment to efficient information-sharing and public-private partnerships, ..." This is like China and Saudi Arabia sitting on the UN human rights council.
- xwolfi 3y ago
  [flagged]
- throwoutway 3y ago
  > Globee Never heard of it, but it looks like a pay to play, with dozens of awards. Not impressed https://globeeawards.com/cyber-security/ https://globeeawards.com/cyber-security/
  - genmud 3y ago
    The dirty secret is that almost every award for companies is pay to play. Some just obfuscate it better than others (e.g. gartner, forester or other big boys) rather than making it a straight up cash for award play. If you aren’t paying to talk to analysts, sponsor events for their customers, etc… they aren’t going to pay attention to you or listen to what kind of products/services you provide. You do the same thing with customers, put them on bullshit advisory boards or whatever. Boom! You are part of a wave or end up in one of the quadrants.
  - jiveturkey 3y ago
    > H1. Thought Leadership | Cybersecurity Thought Leadership Awards
choult 3y ago
Now do Kaseya!
- mvdtnz 3y ago
  If you have something interesting to say about Kaseya (and it's on topic) by all means say it. But please don't leave these kinds of contentless "now do X" posts here.
  - choult 3y ago
    Oh sure - I could talk about how their CISO is a former FBI agent who, prior to joining the company, was responsible for investigating the distribution of ransomware via their VSA product. Nothing shady there. Or perhaps that their (rapidly shrinking) security team has been told to communicate via Signal so their messages can't be subpoenaed successfully.
    - halJordan 3y ago
      Ah yes, drivel. What i come to HN for.
    - deadstock 3y ago
      Also, the question regarding Kaseya knowing about this well in advance and firing the person that tried to get fixes prioritized over features: "One of the former employees said that in early 2019 he sent company leaders a 40-page memo detailing security concerns and was fired about two weeks later, which he believed was related to his repeated efforts to flag the problems." https://www.bnnbloomberg.ca/kaseya-failed-to-address-security-before-hack-ex-employees-say-1.1627491 https://www.bnnbloomberg.ca/kaseya-failed-to-address-securit...
WaitWaitWha 3y ago
I am going bet a pillow case of slightly squished mini candy bars that Tim Brown might have been a good technologist, but that he might have been told to sit down and color. I am saying this because reading the interview notes: > BROWN: It was crazy. So our CEO got a call in the morning from [Mandiant CEO] Kevin Mandia. And then he called me, and then the CTO for FireEye called me. That’s our nightmare moment. [Oct. 26, 2021 Cybersecurity Dive] Was the Mandiant CEO friends with Solarwinds CEO, to make the call to the CEO instead of the person that (presumably) signed their vendor contract, the CISO? > SolarWinds did almost immediately was create a cyber-specific committee on your board I read this as "there was no one, not even the CIO at the board." If you are a CISO, and you are have to decide between your livelihood for the rest of your life guaranteed by a company, or your livelihood for the rest of your life taken by regulators, where do you go? If the CISO says to the Corp "no, I am going public/won't lie/[insert insubordination]", no one will hire them thereafter. If the CISO says "okay, let me sit and color", go to jail, and no one will hire them thereafter.
- wglb 3y ago
  Those latter two statements are no doubt about why Alex Stamos called being the CSO "the worst job in the world"
  - Aerroon 3y ago
    Who holds the CSO-equivalent job in the government? It's the president or prime minister, isn't it? Because ultimately all decisions have an impact on security.
    - WaitWaitWha 3y ago
      CISO =/= CSO. The Federal Chief Information Security Officer, through the OMB is Chris DeRusha.
- hn_throwaway_99 3y ago
  Yeah, I think you really hit the nail on the head with this one. I want folks to be held accountable, but considering the forces/incentives at play, I worry what you're left with is a CISO role that no sane person would take, so instead it's just taken by grifters who take the "gambling" route - let's just hope the chance that some major breach happens doesn't do so on my watch, but if it's "damned if I do, damned if I don't", might as well collect a fat paycheck while I see what happens.
that_aint_cool 3y ago
Among other factors contributing to corporate/white-collar corruption & fraud, this is what happens when you have a culture of nepotism & nepotistic CEO. The HR Chief of SolarWinds is the cousin of the CEO (Sudhakar Ramakrishna) of SolarWinds. Same was true at their previous company (Pulse Secure). In many global cultures, this is completely normal-- and those are cultures which have high rates of endemic, prolific corruption, such as South Asia & Latin America. I would like to see more insiders speak out & blow the whistle on corrupt trade practices under this CEO. If any investigators or journalists would like more info, feel free to contact: anti.corruption.123@proton.me "As they sow, so shall they reap." "In human life seek justice, truth, temperance and courage, and you will profit from the supreme good that you have discovered." (Marcus Aurelius)
- wglb 3y ago
  I'm somewhat confident that the cultural problems predate those folks taking over SolarWinds. Putting the national spin on this issue is inappropriate and contrary to the guidelines of this site.
  - that_aint_cool 3y ago
    You mean the spin they themselves induced on a broad cultural scale, over the course of centuries, such that it has become prolific and engrained? ...No one is allowed to comment on it.. because... Fraudulent Activities should be Accepted, And Not condemned, And no one is allowed to discuss it? Just trying to understand your logic, truly in good faith. ... And other nations should just accept it eh? `Fraid not, ole chap. ...After all: Isn't that how they got there-- by silencing opposition to their activities? ______________ "Nepotism has been and remains one of the biggest curses of political development in South and Southeast Asia." [1] "In the late 20th century, some Asian leaders including former Malaysian Prime Minister Mahathir bin Mohamad advocated "Asian-style capitalism," which meant a state- or family-led economy. But this system is showing signs of doing more harm than good to many Asian nations which have joined the ranks of middle-income countries." [2] "When a leader gives his daughter a government contract, it’s nepotism. But it’s also cooperation at the level of the family, well explained by inclusive fitness, undermining cooperation at the level of the state. When a manager gives her friend a job, it’s cronyism. But it’s also cooperation at the level of friends, well explained by reciprocal altruism , undermining the meritocracy." [3] ... "It’s no surprise that family-oriented cultures like Mexico and Brazil are also high on corruption, particularly nepotism." [3] [1] "The Curse of Nepotism". Blog Post by Joshua Kurlantzick. January 7, 2011. https://www.cfr.org/blog/curse-nepotism https://www.cfr.org/blog/curse-nepotism [2] "Asia's emerging countries need to move away from nepotism, cronyism". Nikkei Asia - Business News. July 26, 2014 [3] "In Latin America as in the wider world, corruption is rooted in our relationships". London School of Economics and Political Science (Latin America and Caribbean Center). Michael Muthukrishna. October 23rd, 2017 [General Reference] "The Corruption Perceptions Index (CPI) is an index which ranks countries "by their perceived levels of public sector corruption, as determined by expert assessments and opinion surveys." https://en.wikipedia.org/wiki/Corruption_Perceptions_Index https://en.wikipedia.org/wiki/Corruption_Perceptions_Index
GartzenDeHaes 3y ago
If you ever wondered why your CISO seems to be over promoted as an executive, this is the reason. A lower level manager can't take the fall for the CEO/company.
PumpkinSpice 3y ago
In most public companies, CISOs are not "real" C-level positions. They're not considered "directors and officers" of the company in the sense of the securities law, they don't have special contracts, they don't rake in exorbitant salaries, they don't have golden parachutes. They don't routinely participate in board meetings or shareholder reporting. If I recall correctly, at Apple, the CISO role was some guy reporting to the corp IT org, entirely separate from core products and services. And we're talking about one of the most valuable and sophisticated tech companies in the world. Amazon had an even wackier model, with separate "CISOs" for different orgs, the term meaning not much more than "a senior manager that we can put in touch with clients if needs be." Google now has a "cloud CISO" who is a nice techie guy and talks to customers, but is not actually the person in charge of the overall Google security org. I get it that the SEC wants to change this culture and have a designated person meaningfully responsible for infosec risk, but it feels that it's a case of stick before the carrot. They have the power to reinterpret their own rules to elevate CISOs before they start cracking down on them with personal liability lawsuits. And I'm betting that just like in the case of Uber, the CISO will end up in trouble, while all the execs will get to claim ignorance and walk free.
- tptacek 3y ago
  Here it's worth remembering that CISO is a "specific" role; it does not necessarily connote "most senior security person in the company"; some companies have more than one; some companies have a "CSO" and/or a chief of "risk"; at Apple (for all I know) it might just mean "most senior security person in IS&T". Apple has a sprawling and multifunctional security team. If your claim is that all of security at Apple somehow reports up through IS&T, I have some reason to believe that is not the case.
  - PumpkinSpice 3y ago
    No, the bulk of security and privacy work at Apple happens elsewhere.
    - tptacek 3y ago
      Oh, we're saying the same thing, and I misconstrued you; I thought you were making a comment about how lackadaisical Apple is about security, but you're just saying "CISO" isn't that big a thing. I agree! Sorry about that.
spydum 3y ago
The billion dollar question: do we think SEC filing disclosures are about to get a bit more interesting to read? Or is the standard boiler plate "we might get hacked, our controls may not be sufficient" going to remain?
- scrapcode 3y ago
  I don't see this going in any direction other than a boilerplate that will become something that is ignored. > SolarWinds and Brown defrauded investors by overstating SolarWinds' cybersecurity practices and understating or failing to disclose known risks. In a nutshell, couldn't they say that in some way about any security software company?
- dmix 3y ago
  According to wikipedia SolarWinds suffered one of the largest cyberattacks against a company in history - one that also directly affected thousands of consumer devices (not just a company backend). This might be a unique consequence of a unique situation. But who knows. > In February 2021, Microsoft President Brad Smith said that it was "the largest and most sophisticated attack the world has ever seen". https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
  - ivlad 3y ago
    Brad Smith (https://news.microsoft.com/exec/brad-smith/ https://news.microsoft.com/exec/brad-smith/) is a PR person at Microsoft. His role is to make loud statements on matters he has no knowledge of or qualifications to talk about.
- halJordan 3y ago
  The new 8-ks are already a response to this...
rawgabbit 3y ago
”The volume of security issues being identified over the last month have [sic] outstripped the capacity of Engineering teams to resolve”… Rather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls I read this is as we are sinking and we will take all of our customers down with us.
miohtama 3y ago
Here is Matt Levine’s, of Bloomberg fame, famous article “Everything Everywhere is Securities Fraud.” https://www.bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud https://www.bloomberg.com/opinion/articles/2019-06-26/everyt... Now cybersecurity included.
- FireBeyond 3y ago
  I lost a lot of respect for Matt Levine with the pretzels he contorted himself into trying to defend the Texas Two Step as "really, truly, better for the plaintiffs", ignoring the two elephants in the room: if it was beneficial to the plaintiffs, why would the defendant go out of their way to do it? And how is it, by magical coincidence, that every firm that has done the Texas Two Step has managed to get out of paying up an average of over 90% (approaching 98% in a few cases) of their anticipated liabilities for decades of malfeasance and injury? Matt and these firms would like us to believe that we should just trust them, "it will be so much more convenient and cheaper for you to sue us this way - we want to make sure we look after you... now. And we, really, truly, honest-to-god, promise that we'll actually fund the liability-stricken new entity we create^". ^ Offer not valid in the United States.
  - boeingUH60 3y ago
    Or maybe as an expert, he understands the corporate bankruptcy process better than you and most of us here.
    - yborg 3y ago
      He was a lawyer in securities a long time ago. That doesn't automatically make him an expert in all areas of commercial law.
    - FireBeyond 3y ago
      I have no doubt he understands the process better than me. Absolutely. The outcomes speak for themselves though. Companies projecting $50B in liabilities for decades of injury to thousands of people funneling them into a shell company, "pledging" to fully fund that company, throwing maybe $100-300M into them, and then shuttering the company without fulfilling that pledge. That's the common outcome to each Texas Two Step story. But Matt and these companies and the firms (I mean firm, there's essentially one firm whose livelihood is this process) all patronizingly try to convince us that that outcome is somehow "better for plaintiffs and consumers", when the only one that seems to actually win is the corporation that successfully shed the boat anchor it put around its own neck.
deleted 3y ago
[deleted]
Nifty3929 3y ago
I’m don’t like that this is being pursued by the SEC. Especially since the likely penalty will be a large chuck of money that gets paid to… the SEC. Too much like extortion. But as Matt Levine often reminds us - everything is securities fraud. If a bad thing happens and you did not warn investors about it beforehand, you can be sued for securities fraud by the SEC. It’s almost like it’s illegal for investors to lose money, and the SEC enforces that requirement. Investing is risky, bad things can happen, including execs that make mistakes (not talking about actual deception and fraud here) and investors should not be surprised when they sometimes lose money, or seek the strong arm of the government for relief.
- me-vs-cat 3y ago
  Don't you count the following as "actual deception and fraud"? > SolarWinds allegedly misled investors by disclosing only generic and hypothetical risks at a time when the company and Brown knew of specific deficiencies... > SolarWinds’ public statements about its cybersecurity practices and risks were at odds with its internal assessments... > SolarWinds and Brown engaged in a campaign to paint a false picture...
- mym1990 3y ago
  This is like saying police officers shouldn't enforce speed limits because the ticket ends up back in the police department, and you could certainly make a point for a conflict of interest, but there is traceable proof. What actually happened in the SolarWinds instance seems to be actual deception and fraud. Plenty of companies go out of business due to competition, this isn't one of those instances.
  - piperswe 3y ago
    Ticket money shouldn't end up back in the police fund. It should go into the general fund.
- lima 3y ago
  It's more like "if a bad thing happens and you knew about the risk and lied to investors about it".
AndSinNoMore 3y ago
The SolarWinds case ups the stakes for CISOs everywhere. Are you secure? Yeah? Would you bet your life on it? How about a "dissenting opinion" envelope where a CISO lodges his most critical objections to the company's most egregious security sins? This can be discoverable as evidence if there is ever an incident. This clearly establishes that the CISO performed his function and warned of the risk but was overruled by the CEO or the Board. "Yeah? We can't afford MFA? No problem. I'm just going to note my dissenting opinion just in case this comes back to bite us."
BrandoElFollito 3y ago
Well, when you are a CISO you also need to know your actual responsibility. In Europe you are a normal employee with normal responsibilities and nobody sane would risk their future by going against the law. The IKEA CSO did that and was in jail. I was asked twice to provide a statement for a US court (being European and living there). Just for the fun I asked or legal department to provide me with a full written explanation of the consequences, the risks and how much I would get paid to do something like that that is outside my contact. Everything stopped there and some poor fellow in the US did that instead. I then asked why this isn't the legal dept that is issuing these statements in the name of the company. I got some complex explanation why they could not bear the risk. Being a CISO means managing risks, including yours.

248 points by arkadiyt 3y ago

It’s interesting to see SEC go after a CISO, yes he was at the helm but can’t the one to patch systems… yes they had an ongoing attack but disclosing that to shareholders is a sensitive affair… they were also a technology provider to the US government. I honestly think that is what got them the teeth of the SEC.

arkadiyt 3y ago
They weren't charged for having deficiencies, they were charged for knowing about their deficiencies and lying about them: > SolarWinds allegedly misled investors by disclosing only generic and hypothetical risks at a time when the company and Brown knew of specific deficiencies in SolarWinds’ cybersecurity practices as well as the increasingly elevated risks the company faced at the same time.
- deleted 3y ago
  [deleted]
WaitWaitWha 3y ago
CISOs are still often not considered C-suite, and rarely get called to boardrooms. Commensurating with the new risks for a CISO, a seat in the C-suite, E&O coverage, and nice parachute are the minimum CISOs should get. Edit: I understand that in this case there were false statements made. That still does not remove the new risk for other CISOs to be dragged into quagmires they were not responsible for (see regulation discrepancies between various US, UK, or EU departments).

blakesterz 3y ago

"As the complaint alleges, SolarWinds’ public statements about its cybersecurity practices and risks were at odds with its internal assessments, including a 2018 presentation prepared by a company engineer and shared internally, including with Brown, that SolarWinds’ remote access set-up was “not very secure” and that someone exploiting the vulnerability “can basically do whatever without us detecting it until it’s too late,” which could lead to “major reputation and financial loss” for SolarWinds. Similarly, as alleged in the SEC’s complaint, 2018 and 2019 presentations by Brown stated, respectively, that the “current state of security leaves us in a very vulnerable state for our critical assets” and that “[a]ccess and privilege to critical systems/data is inappropriate.”" So I think if I'm reading that right, he knew things were “not very secure” and part of his role was to disclose that, and he didn't? I assume there's some rules in place that C level folks sign off on statements and he's the one to sign off on statements about security?

deleted 3y ago
[deleted]
xwolfi 3y ago
You're not reading that right: the problem isnt that this engineer knew the problem, it s that he gave management presentations about it and they didnt fix it.
- cj 3y ago
  The problem isn’t that they didn’t fix it. It’s that they knew about it and didn’t disclose it. When a company IPOs the SEC requires it to file a document that contains all known risks to the business and all possible factors that could negatively impact the company’s value over time. It sounds like they failed to include this specific known incident in their filings with the government.
wglb 3y ago
This was likely Ian Thornton Trump: https://www.newsweek.com/ex-solarwinds-adviser-warned-company-security-issues-2017-incredibly-easy-target-hack-1556453 https://www.newsweek.com/ex-solarwinds-adviser-warned-compan...
tru3_power 3y ago
These are often times problems that sadly take a long time to fix. Were they at least trying? Or just straight up didn’t care?
pests 3y ago
He is not C-level.

jiveturkey 3y ago

6 months ago: > SolarWinds CISO Tim Brown has been named CISO of the Year by Globee Cybersecurity Awards for his work overseeing our Secure by Design initiative. > "Through our Secure by Design initiative and our ongoing commitment to efficient information-sharing and public-private partnerships, ..." This is like China and Saudi Arabia sitting on the UN human rights council.

xwolfi 3y ago
[flagged]
throwoutway 3y ago
> Globee Never heard of it, but it looks like a pay to play, with dozens of awards. Not impressed https://globeeawards.com/cyber-security/ https://globeeawards.com/cyber-security/
- genmud 3y ago
  The dirty secret is that almost every award for companies is pay to play. Some just obfuscate it better than others (e.g. gartner, forester or other big boys) rather than making it a straight up cash for award play. If you aren’t paying to talk to analysts, sponsor events for their customers, etc… they aren’t going to pay attention to you or listen to what kind of products/services you provide. You do the same thing with customers, put them on bullshit advisory boards or whatever. Boom! You are part of a wave or end up in one of the quadrants.
- jiveturkey 3y ago
  > H1. Thought Leadership | Cybersecurity Thought Leadership Awards

choult 3y ago

Now do Kaseya!

mvdtnz 3y ago
If you have something interesting to say about Kaseya (and it's on topic) by all means say it. But please don't leave these kinds of contentless "now do X" posts here.
- choult 3y ago
  Oh sure - I could talk about how their CISO is a former FBI agent who, prior to joining the company, was responsible for investigating the distribution of ransomware via their VSA product. Nothing shady there. Or perhaps that their (rapidly shrinking) security team has been told to communicate via Signal so their messages can't be subpoenaed successfully.
  - halJordan 3y ago
    Ah yes, drivel. What i come to HN for.
  - deadstock 3y ago
    Also, the question regarding Kaseya knowing about this well in advance and firing the person that tried to get fixes prioritized over features: "One of the former employees said that in early 2019 he sent company leaders a 40-page memo detailing security concerns and was fired about two weeks later, which he believed was related to his repeated efforts to flag the problems." https://www.bnnbloomberg.ca/kaseya-failed-to-address-security-before-hack-ex-employees-say-1.1627491 https://www.bnnbloomberg.ca/kaseya-failed-to-address-securit...

WaitWaitWha 3y ago

I am going bet a pillow case of slightly squished mini candy bars that Tim Brown might have been a good technologist, but that he might have been told to sit down and color. I am saying this because reading the interview notes: > BROWN: It was crazy. So our CEO got a call in the morning from [Mandiant CEO] Kevin Mandia. And then he called me, and then the CTO for FireEye called me. That’s our nightmare moment. [Oct. 26, 2021 Cybersecurity Dive] Was the Mandiant CEO friends with Solarwinds CEO, to make the call to the CEO instead of the person that (presumably) signed their vendor contract, the CISO? > SolarWinds did almost immediately was create a cyber-specific committee on your board I read this as "there was no one, not even the CIO at the board." If you are a CISO, and you are have to decide between your livelihood for the rest of your life guaranteed by a company, or your livelihood for the rest of your life taken by regulators, where do you go? If the CISO says to the Corp "no, I am going public/won't lie/[insert insubordination]", no one will hire them thereafter. If the CISO says "okay, let me sit and color", go to jail, and no one will hire them thereafter.

wglb 3y ago
Those latter two statements are no doubt about why Alex Stamos called being the CSO "the worst job in the world"
- Aerroon 3y ago
  Who holds the CSO-equivalent job in the government? It's the president or prime minister, isn't it? Because ultimately all decisions have an impact on security.
  - WaitWaitWha 3y ago
    CISO =/= CSO. The Federal Chief Information Security Officer, through the OMB is Chris DeRusha.
hn_throwaway_99 3y ago
Yeah, I think you really hit the nail on the head with this one. I want folks to be held accountable, but considering the forces/incentives at play, I worry what you're left with is a CISO role that no sane person would take, so instead it's just taken by grifters who take the "gambling" route - let's just hope the chance that some major breach happens doesn't do so on my watch, but if it's "damned if I do, damned if I don't", might as well collect a fat paycheck while I see what happens.

that_aint_cool 3y ago

Among other factors contributing to corporate/white-collar corruption & fraud, this is what happens when you have a culture of nepotism & nepotistic CEO. The HR Chief of SolarWinds is the cousin of the CEO (Sudhakar Ramakrishna) of SolarWinds. Same was true at their previous company (Pulse Secure). In many global cultures, this is completely normal-- and those are cultures which have high rates of endemic, prolific corruption, such as South Asia & Latin America. I would like to see more insiders speak out & blow the whistle on corrupt trade practices under this CEO. If any investigators or journalists would like more info, feel free to contact: anti.corruption.123@proton.me "As they sow, so shall they reap." "In human life seek justice, truth, temperance and courage, and you will profit from the supreme good that you have discovered." (Marcus Aurelius)

wglb 3y ago
I'm somewhat confident that the cultural problems predate those folks taking over SolarWinds. Putting the national spin on this issue is inappropriate and contrary to the guidelines of this site.
- that_aint_cool 3y ago
  You mean the spin they themselves induced on a broad cultural scale, over the course of centuries, such that it has become prolific and engrained? ...No one is allowed to comment on it.. because... Fraudulent Activities should be Accepted, And Not condemned, And no one is allowed to discuss it? Just trying to understand your logic, truly in good faith. ... And other nations should just accept it eh? `Fraid not, ole chap. ...After all: Isn't that how they got there-- by silencing opposition to their activities? ______________ "Nepotism has been and remains one of the biggest curses of political development in South and Southeast Asia." [1] "In the late 20th century, some Asian leaders including former Malaysian Prime Minister Mahathir bin Mohamad advocated "Asian-style capitalism," which meant a state- or family-led economy. But this system is showing signs of doing more harm than good to many Asian nations which have joined the ranks of middle-income countries." [2] "When a leader gives his daughter a government contract, it’s nepotism. But it’s also cooperation at the level of the family, well explained by inclusive fitness, undermining cooperation at the level of the state. When a manager gives her friend a job, it’s cronyism. But it’s also cooperation at the level of friends, well explained by reciprocal altruism , undermining the meritocracy." [3] ... "It’s no surprise that family-oriented cultures like Mexico and Brazil are also high on corruption, particularly nepotism." [3] [1] "The Curse of Nepotism". Blog Post by Joshua Kurlantzick. January 7, 2011. https://www.cfr.org/blog/curse-nepotism https://www.cfr.org/blog/curse-nepotism [2] "Asia's emerging countries need to move away from nepotism, cronyism". Nikkei Asia - Business News. July 26, 2014 [3] "In Latin America as in the wider world, corruption is rooted in our relationships". London School of Economics and Political Science (Latin America and Caribbean Center). Michael Muthukrishna. October 23rd, 2017 [General Reference] "The Corruption Perceptions Index (CPI) is an index which ranks countries "by their perceived levels of public sector corruption, as determined by expert assessments and opinion surveys." https://en.wikipedia.org/wiki/Corruption_Perceptions_Index https://en.wikipedia.org/wiki/Corruption_Perceptions_Index

GartzenDeHaes 3y ago

If you ever wondered why your CISO seems to be over promoted as an executive, this is the reason. A lower level manager can't take the fall for the CEO/company.

PumpkinSpice 3y ago

In most public companies, CISOs are not "real" C-level positions. They're not considered "directors and officers" of the company in the sense of the securities law, they don't have special contracts, they don't rake in exorbitant salaries, they don't have golden parachutes. They don't routinely participate in board meetings or shareholder reporting. If I recall correctly, at Apple, the CISO role was some guy reporting to the corp IT org, entirely separate from core products and services. And we're talking about one of the most valuable and sophisticated tech companies in the world. Amazon had an even wackier model, with separate "CISOs" for different orgs, the term meaning not much more than "a senior manager that we can put in touch with clients if needs be." Google now has a "cloud CISO" who is a nice techie guy and talks to customers, but is not actually the person in charge of the overall Google security org. I get it that the SEC wants to change this culture and have a designated person meaningfully responsible for infosec risk, but it feels that it's a case of stick before the carrot. They have the power to reinterpret their own rules to elevate CISOs before they start cracking down on them with personal liability lawsuits. And I'm betting that just like in the case of Uber, the CISO will end up in trouble, while all the execs will get to claim ignorance and walk free.

tptacek 3y ago
Here it's worth remembering that CISO is a "specific" role; it does not necessarily connote "most senior security person in the company"; some companies have more than one; some companies have a "CSO" and/or a chief of "risk"; at Apple (for all I know) it might just mean "most senior security person in IS&T". Apple has a sprawling and multifunctional security team. If your claim is that all of security at Apple somehow reports up through IS&T, I have some reason to believe that is not the case.
- PumpkinSpice 3y ago
  No, the bulk of security and privacy work at Apple happens elsewhere.
  - tptacek 3y ago
    Oh, we're saying the same thing, and I misconstrued you; I thought you were making a comment about how lackadaisical Apple is about security, but you're just saying "CISO" isn't that big a thing. I agree! Sorry about that.

spydum 3y ago

The billion dollar question: do we think SEC filing disclosures are about to get a bit more interesting to read? Or is the standard boiler plate "we might get hacked, our controls may not be sufficient" going to remain?

scrapcode 3y ago
I don't see this going in any direction other than a boilerplate that will become something that is ignored. > SolarWinds and Brown defrauded investors by overstating SolarWinds' cybersecurity practices and understating or failing to disclose known risks. In a nutshell, couldn't they say that in some way about any security software company?
dmix 3y ago
According to wikipedia SolarWinds suffered one of the largest cyberattacks against a company in history - one that also directly affected thousands of consumer devices (not just a company backend). This might be a unique consequence of a unique situation. But who knows. > In February 2021, Microsoft President Brad Smith said that it was "the largest and most sophisticated attack the world has ever seen". https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
- ivlad 3y ago
  Brad Smith (https://news.microsoft.com/exec/brad-smith/ https://news.microsoft.com/exec/brad-smith/) is a PR person at Microsoft. His role is to make loud statements on matters he has no knowledge of or qualifications to talk about.
halJordan 3y ago
The new 8-ks are already a response to this...

rawgabbit 3y ago

”The volume of security issues being identified over the last month have [sic] outstripped the capacity of Engineering teams to resolve”… Rather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls I read this is as we are sinking and we will take all of our customers down with us.

miohtama 3y ago

Here is Matt Levine’s, of Bloomberg fame, famous article “Everything Everywhere is Securities Fraud.” https://www.bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud https://www.bloomberg.com/opinion/articles/2019-06-26/everyt... Now cybersecurity included.

FireBeyond 3y ago
I lost a lot of respect for Matt Levine with the pretzels he contorted himself into trying to defend the Texas Two Step as "really, truly, better for the plaintiffs", ignoring the two elephants in the room: if it was beneficial to the plaintiffs, why would the defendant go out of their way to do it? And how is it, by magical coincidence, that every firm that has done the Texas Two Step has managed to get out of paying up an average of over 90% (approaching 98% in a few cases) of their anticipated liabilities for decades of malfeasance and injury? Matt and these firms would like us to believe that we should just trust them, "it will be so much more convenient and cheaper for you to sue us this way - we want to make sure we look after you... now. And we, really, truly, honest-to-god, promise that we'll actually fund the liability-stricken new entity we create^". ^ Offer not valid in the United States.
- boeingUH60 3y ago
  Or maybe as an expert, he understands the corporate bankruptcy process better than you and most of us here.
  - yborg 3y ago
    He was a lawyer in securities a long time ago. That doesn't automatically make him an expert in all areas of commercial law.
  - FireBeyond 3y ago
    I have no doubt he understands the process better than me. Absolutely. The outcomes speak for themselves though. Companies projecting $50B in liabilities for decades of injury to thousands of people funneling them into a shell company, "pledging" to fully fund that company, throwing maybe $100-300M into them, and then shuttering the company without fulfilling that pledge. That's the common outcome to each Texas Two Step story. But Matt and these companies and the firms (I mean firm, there's essentially one firm whose livelihood is this process) all patronizingly try to convince us that that outcome is somehow "better for plaintiffs and consumers", when the only one that seems to actually win is the corporation that successfully shed the boat anchor it put around its own neck.

deleted 3y ago

[deleted]

Nifty3929 3y ago

I’m don’t like that this is being pursued by the SEC. Especially since the likely penalty will be a large chuck of money that gets paid to… the SEC. Too much like extortion. But as Matt Levine often reminds us - everything is securities fraud. If a bad thing happens and you did not warn investors about it beforehand, you can be sued for securities fraud by the SEC. It’s almost like it’s illegal for investors to lose money, and the SEC enforces that requirement. Investing is risky, bad things can happen, including execs that make mistakes (not talking about actual deception and fraud here) and investors should not be surprised when they sometimes lose money, or seek the strong arm of the government for relief.

me-vs-cat 3y ago
Don't you count the following as "actual deception and fraud"? > SolarWinds allegedly misled investors by disclosing only generic and hypothetical risks at a time when the company and Brown knew of specific deficiencies... > SolarWinds’ public statements about its cybersecurity practices and risks were at odds with its internal assessments... > SolarWinds and Brown engaged in a campaign to paint a false picture...
mym1990 3y ago
This is like saying police officers shouldn't enforce speed limits because the ticket ends up back in the police department, and you could certainly make a point for a conflict of interest, but there is traceable proof. What actually happened in the SolarWinds instance seems to be actual deception and fraud. Plenty of companies go out of business due to competition, this isn't one of those instances.
- piperswe 3y ago
  Ticket money shouldn't end up back in the police fund. It should go into the general fund.
lima 3y ago
It's more like "if a bad thing happens and you knew about the risk and lied to investors about it".

AndSinNoMore 3y ago

The SolarWinds case ups the stakes for CISOs everywhere. Are you secure? Yeah? Would you bet your life on it? How about a "dissenting opinion" envelope where a CISO lodges his most critical objections to the company's most egregious security sins? This can be discoverable as evidence if there is ever an incident. This clearly establishes that the CISO performed his function and warned of the risk but was overruled by the CEO or the Board. "Yeah? We can't afford MFA? No problem. I'm just going to note my dissenting opinion just in case this comes back to bite us."

BrandoElFollito 3y ago

Well, when you are a CISO you also need to know your actual responsibility. In Europe you are a normal employee with normal responsibilities and nobody sane would risk their future by going against the law. The IKEA CSO did that and was in jail. I was asked twice to provide a statement for a US court (being European and living there). Just for the fun I asked or legal department to provide me with a full written explanation of the consequences, the risks and how much I would get paid to do something like that that is outside my contact. Everything stopped there and some poor fellow in the US did that instead. I then asked why this isn't the legal dept that is issuing these statements in the name of the company. I got some complex explanation why they could not bear the risk. Being a CISO means managing risks, including yours.