The latest in the SolarWinds hack investigation and education education education. While learning is key in 2021. These stories end more in this week's ISNG Security Report. Hi, I'm Anna Delaney.
A mass indiscriminate global assault is how Microsoft's President Brad Smith referred to the SolarWinds hack this week, insisting that it should be a wake-up call to the cybersecurity industry. So how far reaching is this assault and what do we know so far? Here's Matthew Schwartz, ISNG's executive editor of DataBeach Today in Europe, he's been piecing together the SolarWinds puzzle as more information unfolds. The SolarWinds supply chain attack appears to have been one of the most sophisticated, online, espionage operations in history.
The attack was complex, and new details continue to come to light. SolarWinds, which is based in Texas, now reports that it's identified the source of the backdoor that was added to its Orion network monitoring software. In particular, attackers breached its software development processes, sneaking in code designed to plant the backdoor into every Orion code build. This backdoor in Orion has been named Sunburst.
Beginning last March, it potentially gave attackers remote access to any system on which it was present. Unfortunately, up to 18,000 customers were running the backdoor version of Orion. Experts suspect, however, that a much smaller number, perhaps 200 to 300 organizations, may have been targeted by second-stage attacks. Among other things, these attacks could have compromised further systems and facilitated mass eavesdropping and data theft.
Incident response teams and government investigators are continuing to probe the attack campaign, but the sheer scale of the endeavor means that it may be many months, if not years, before the full scope of the campaign can be understood. Credit for discovering the attack goes to Viarei, which was one of its victims, and which publicly brought the attack to light last month on December 13th. Since then, many security professionals and U.S. government incident response teams have been working around the clock.
SolarWinds, which is publicly traded, has also been investigating. It's two lead incident response investigation firms, CrowdStrike and KPMG, say attackers first breached SolarWinds Network in September 2019, adding malware they call Sunspot and used this malware to inject Sunburst into the code development processes. Who's to blame? It's often the first question people ask in the wake of a breach.
Since the attack came to light, multiple experts and White House officials said it appeared to be a Russian espionage operation. Moscow has denied any involvement, but last week, the U.S. intelligence community finally also said it was likely a Russian operation. In a live interview with the Washington Post, U.S.
intelligence official, Bill Evanina, was asked, how likely is likely? I don't know if there's a continuum of likeness. I think that's the best way the government can put it right now without full attribution. Attribution has a policy matter, and the executive branch would do, but in my belief here as head of counterintelligence, I'm going to stick with Secretary Pompeo and Attorney General Barr.
I believe it was a Russian and I think that will vet itself out in the future. Evanina is the director of the U.S. National Counterintelligence and Security Center, which is part of the Office of the Director of National Intelligence, which is coordinating government intelligence agencies' response to the attack. Experts say this SolarWinds campaign looks like a typical espionage plan.
With that in mind, however, Evanina says it's time to move the discussion from reacting to this to responding, especially for victims, and identifying better ways to protect organizations from these sorts of attacks in the future. I think we have to really, in my space, peel away from not only that it was Russians or who it was, but also what did they do? Why did they do it? What was the methodology as an espionage activity?
And at the end of the day, we're going to eventually get past the cyber activity and how we're going to protect businesses and organizations in the business community as well as governments. But actually, what were they seeking? Let's remember that the first rule of espionage is to identify the plans and intentions of foreign leaders and their governments. And I think that's what we see here.
Of course, as these SolarWinds investigations continue, no doubt for their details will come to light. For Information Security Media Group, I'm Matthew Schwartz. You're listening to the ISMG Security Report on ISMG Radio, your number one source for Information Security News. I'm going to talk to our industry to its core.
If you were to say there are two or three topics, we'd better get educated about in 2021. What would those be? Well, from a security perspective, I definitely think it's in the application security and DevSecOps. I'm fond of using the expression that in today's agile development environments, the developers have the party and the security people end up with the hangover.
So it's really doing a better job of understanding security in the DevOps world that I would put as one of the biggest. Obviously, we talked about social media and the dangers of misinformation. But now I'll go way the hell up and look at how our government reacted to this SolarWinds breach. The United States has had a policy of the best defense being a good offense.
In other words, from a cyber standpoint, we believe that if we're forward into the adversary's space, we're going to see how they might come at us. Well, that's obviously not working. So educating people and educating from a policy standpoint, that we need to do a better job defending ourselves. And we've been talking about public-private partnerships for decades, but understanding and educating people on what would be an effective public-private partnership.
Those are the kinds of educational things at the highest policy level that I think people need to think about. And finally, we often hear that SOCs or security operations centers are challenged when it comes to retaining their analysts, and the number of security professionals is not growing to meet demand. In short, SOC analysts are overwhelmed with an overabundance of data to monitor, chasing countless alerts and false positives, which often leads to burnout. So how can organizations break the state of cycle and retain their talent?
Here's Nat Smith, Senior Director and Analyst Agartner with some advice. I think that the better SOC analysts we tend to see and interact with are creative. Find ways, find projects that will help them stay mentally engaged, or give them outlets for some of that creativity. And it's above and beyond the regular job.
And that means don't give them extra work, but find a way to fit that in and be part of things. Red team and blue team exercises where you are creating fake attacks and seeing how well you can defend our games, or games in many respects. They're fun. Most individuals that get involved with them have a pretty good time with that.
That's an example of something that's creative above and beyond. It has a secondary benefit to the organization. Oh, we recognize that we were a little more vulnerable here. Oh, we have actually given some opportunities to bring some junior associates along to learn side by side with some of the more senior ones.
So there's a lot of skills transfer there. But more than anything else, it just allows you to be creative and allows you to do things a little bit differently than having. So I think that's a great place. Pulling them into architecture or product evaluation.
That's not normally part of the job description for a SOC analyst. But that gives them a little bit something different, lets them stretch a little bit outside of where they were. It brings probably a lot of value to the organization as well. And then I don't want to say that people aren't looking for monetary compensation.
But I think that a lot of creative individuals, and particularly in the SOCs, are looking for a little bit of praise or recognition. If you look at some statistics from more of an HR study, you can see that the highest paying organizations don't necessarily have the highest retention of their employees. It's part of it. It's part of the mix.
But there's something about a culture that recognizes greatness or things that were done very, very well and spreads the word. And allows there to be gratitude, allows there to be just a moment of recognition. That tends to go a long way for creative people who will work mad hours to do something small and simple that nobody else has ever done before. And few people can appreciate.
And so having just a little bit of recognition of this was important, this made a difference. It goes a long way. That's it from the ISNG Security Report. Be musicers by Ithaca Audio.
I'm Anna Delaney. Until next time.