[fusion_builder_container hundred_percent=”no” hundred_percent_height=”no” hundred_percent_height_scroll=”no” hundred_percent_height_center_content=”yes” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” status=”published” publish_date=”” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” enable_mobile=”no” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” video_preview_image=”” border_color=”” border_style=”solid” margin_top=”” margin_bottom=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” type=”legacy” admin_toggled=”no”][fusion_builder_row][fusion_builder_column type=”1_1″ layout=”1_1″ spacing=”” center_content=”no” link=”” target=”_self” min_height=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_image_id=”” background_position=”left top” background_repeat=”no-repeat” hover_type=”none” border_color=”” border_style=”solid” border_position=”all” border_radius=”” box_shadow=”no” dimension_box_shadow=”” box_shadow_blur=”0″ box_shadow_spread=”0″ box_shadow_color=”” box_shadow_style=”” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” margin_top=”” margin_bottom=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=”” last=”true” border_sizes_top=”0″ border_sizes_bottom=”0″ border_sizes_left=”0″ border_sizes_right=”0″ first=”true” type=”1_1″][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” content_alignment_medium=”” content_alignment_small=”” content_alignment=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” sticky_display=”normal,sticky” class=”” id=”” font_size=”” fusion_font_family_text_font=”” fusion_font_variant_text_font=”” line_height=”” letter_spacing=”” text_color=”” animation_type=”” animation_direction=”left” animation_speed=”0.3″ animation_offset=””]
By now, you have probably heard of the SolarWinds hack that is being called the largest such hack of the U.S. Government (and most of the Fortune 500) in at least a decade. CynergisTek, Inc.’s Chief Information Security Officer (CISO), Thomas Graham gives his outlook and provides recommendations on this egregious hack of a lifetime:
The impacts of the SolarWinds hack are still being determined and may reach further than simply those who utilized the SolarWinds Orion module. Microsoft has recently released/notified a number of companies who were impacted ancillary to the SolarWinds hack due to attackers being able to jump from one compromised solution to another. Additionally, a second backdoor has been found in the compromised package that points to more than one potential malicious actor.
With these ongoing revelations, my own opinion of this, is the SolarWinds hack will be more far-reaching than we will probably know, but regardless government and enterprise organizations alike should be operating at a heightened sense of urgency. Currently, it appears that the attackers limited the malicious activity to viewing/reading real data rather than destroying/modifying it. However, this is still a large concern and as the investigation continues the activity of the attackers may be updated. Additionally, be aware that simply because someone says there is “No evidence of compromise” this simply means they could not find any evidence. Not that it did not actually occur as attackers are often fond of destroying logs indicating who/what/where/when/how they accessed files/systems.
With this in mind, I recommend organizations take the following steps to combat potential SolarWinds impacts:
- Initiate an in-depth review of your configurations and protections to ensure you have proper alerting in place for any new elevated accounts.
- Implant additional alerts for certain activities such as updates to existing, published, software packages.
- Most importantly, CHANGE DEFAULT PASSWORDS!
I recommend all of these steps regardless of if you directly utilize SolarWinds and communicate why this is being done to the larger organization to increase awareness. As always, with anything of this magnitude, if you have any questions or think something “wonky” is going on with your organizational system reach out to your IT department or CISO. After all, your employees, coworkers, and YOU are the last line of defense!
-Thomas Graham
CISO, CynergisTek Inc.
[/fusion_text][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]