IWS
SolarWinds Cyberattack Demands Significant Federal and Private-Sector Response (infographic)
AuthorPosted byIWS
Published April 22, 202113:37
UpdatedMay 9, 202114:37
Posted by IWS on April 22, 2021. Updated: May 9, 202114:37
GAO – The cybersecurity breach of SolarWinds' software is one of the most widespread and sophisticated hacking campaigns ever conducted against the federal government and private sector. In today's WatchBlog post, we look at this breach and the ongoing federal government and private-sector response. This information is based on publicly disclosed information from federal and private industry sources. We here at GAO are currently conducting a comprehensive review of the breach with plans to issue a public report later this year.
Beginning in September 2019, a campaign of cyberattacks, now identified to be perpetrated by the Russian Foreign Intelligence Service (hereafter referred to as the threat actor), breached the computing networks at SolarWinds—a Texas-based network management software company. The threat actor first conducted a "dry run," injecting test code into SolarWinds' network management and monitoring suite of products called Orion. Then, beginning in February 2020, the threat actor injected trojanized (hidden) code into a file that was later included in SolarWinds' Orion software updates. SolarWinds released the software updates to its customers not realizing that the updates were compromised. The trojanized code had provided the threat actor with a "backdoor"—a program that can give an intruder remote access to an infected computer. According to cybersecurity researchers, the threat actor was then able to remotely exploit the networks and systems of SolarWinds' customers who had downloaded the compromised software updates using a sophisticated computing infrastructure.
Since SolarWinds is widely used in the federal government to monitor network activity on federal systems, this incident allowed the threat actor to breach infected agency information systems. SolarWinds estimates that nearly 18,000 of its customers received a compromised software update. Of those, the threat actor targeted a smaller subset of high-value customers, including the federal government, to exploit for the primary purpose of espionage.
Discovery and response: What now?
FireEye—a cybersecurity professional services firm—stated that in November 2020 it had detected an intrusion to its systems and later informed SolarWinds of the compromise of the Orion platform. In addition, in coordination with FireEye, Microsoft reported the threat actor was able to compromise some of Microsoft's cloud platforms. The compromise allowed the threat actor to gain unauthorized network access. Microsoft informed several federal agencies that their unclassified systems had been breached and took steps with other industry partners to redirect the malicious network traffic away from the domain used by the threat actor to render the malicious code ineffective and prevent further compromise.
In response to this breach, on December 13, 2020, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) released an emergency directive outlining required mitigations for federal agencies to prevent further exploitation of federal information systems. On December 16, the White House's National Security Council activated the Cyber Unified Coordination Group, who is responsible for coordinating the government-wide response to the incident. This group includes officials from the Office of the Director of National Intelligence, FBI, and CISA, with support from the National Security Agency.
GAO and Congressional monitoring will continue
Congress held multiple hearings to gather and report information on the timeline of events related to the SolarWinds hack, and larger issues such as IT supply chain security (meaning the security of information and communications technology products and services), threat actor capability and motivation, and future federal actions and improvements.
Although our examination of SolarWinds is ongoing, we have previously reported on IT supply chain risks and major cybersecurity challenges. We continue to emphasize that the federal government needs to move with greater urgency to improve the nation's cybersecurity as the country faces grave and rapidly evolving threats. Ensuring the cybersecurity of the nation has been on our High Risk List since 1997.
A detailed timeline of federal government and private sector activities to remediate the breach is illustrated in the graphic below.
Source GAO
Russian Foreign Intelligence Service Exploiting Five Publicly Known Vulnerabilities to Compromise U.S. and Allied Networks
Securing the cyber advantage: U.S. Cyber Command celebrates its 11th year
Army Cyber Command salutes local student teams for winning cybersecurity skills
Previous Post FBI Warns Cyber Criminals Are Using Fake Job Listings to Target Applicants' Personally Identifiable Information
Next PostMan Sentenced to Life in Prison for ISIS-inspired Bombing in New York City Subway Station in 2017
Lindy Cameron outlines importance of global allies to beat online threats at international conference July 20, 2021
CISA and Partners Hold Annual Election Security Exercise July 20, 2021
Safeguarding Critical Infrastructure against Threats from the People's Republic of China July 19, 2021
COVID-19 fraudster guilty of cyber scam July 16, 2021
NCSC Weekly Threat Report 16th July 2021 July 16, 2021
Information Operations (IO)
Homeland Security (HS)
Space Operations (SO)
INFOCON Mailing List
SUBSCRIBE to get the latest INFOCON Newsletter.
Science & Tech Spotlight:Deepfakes (1,040)
CISA and Partners Hold Annual Election Security Exercise (1,031)
Information Environment: DOD Operations Need Enhanced Leadership and Integration of Capabilities (1,022)
Colonial Pipeline Cyberattack Highlights Need for Better Federal and Private-Sector Preparedness (infographic) (1,010)
SolarWinds Cyberattack Demands Significant Federal and Private-Sector Response (infographic) (1,001)
Business Email Compromise (4) Capitol Attack (4) China (4) CISA (16) Colonial Pipeline Incident (25) Crime (5) Critical Infrastructure (35) Cryptocurrency (11) Cyber (98) Cyber Attack (32) Cybercrime (49) Cyber Security (8) Cyberspace Operations (8) Cyber Threats (12) DarkSide (5) DHS (8) DOD (19) DOJ (25) Domestic Terrorism (7) Executive Order (4) FBI (43) Fraud (14) GAO (15) GCHQ (4) Hacking (7) Hearing (16) Homeland Security (7) Malware (7) National Security (7) NCSC (20) NSA (13) Phishing (5) Pipeline Network (13) Ransomware (42) Russia (6) Scammers (6) Security Architecture (3) SolarWinds (7) Space Domain (4) Supply Chain Security (6) Terrorism (11) UK (7) Vulnerabilities (6) White House (17) Zero Trust (4)
Cyber Crime (75)
Information Operations (25)
Space Operations (4)
© 2022 IWS. All rights reserved.