What’s the biggest lesson from the SolarWinds fiasco?
That just focusing security defenses on the most common means of penetrating an organization doesn’t cut it. Sure, you should guard against phishing, fortify your DMZ and Internet-facing applications, train your staff, and so on. That will at least give you a credible response if you get hacked and you’re asked what you were doing to prevent it (which I admit is nothing to sneeze at!). However as we’ve seen, that won’t keep you safe.
The software supply chain risk
Few organizations take software supply chain risk seriously. It’s very common for software packages to “call home” to the vendor for diagnostics, code and data file updates, etc. How many customers, or even the vendors themselves, have any way to monitor this threat vector, or to model the application for behavior changes that indicate compromise? Virtually none. Try asking your vendors “How can you demonstrate to me that your update channel isn’t compromised?“, and watch them squirm. And this doesn’t even address the problem at SolarWinds, which was the insertion of rogue code into the development process. While timely patching is a security best practice, how does one know that the patch itself isn’t compromised? Finally, given the prevalence of open source, and the push for rapid development and software innovation, can anyone seriously believe that the risk from software supply chain compromise will be “solved” anytime soon?
Supply chain attacks such as the Solarwinds incident work because they exploit trust relationships. Most security controls depend on whitelisting of the “known good”, including files, folders, processes, systems, users and groups, domains, IP addresses, and behavior. Typically, security solutions rely on reputation and past behavior patterns to give a free pass to “trusted entities”.
It doesn’t matter how they got in: spear-phishing, vulnerability exploit, or compromised software – it’s all fair game for ShadowPlex. In all such cases, it’s ready to detect, characterize, and if desired engage your adversary, without a lot of operational overhead or false positives. Will you sleep more soundly knowing ShadowPlex is on the job?
We’d like to think so!