The SolarWinds hack was more than just one of the most devastating cyberattacks in history. It was a serious national security breach that exposed gaps in US cyber defenses.
These loopholes include inadequate security from a large software company, a fragmented authority for government support for the private sector, and a national lack of software and cybersecurity skills. None of these loopholes are easy to close, but the scope and impact of the SolarWinds attack show how important it is to US national security.
The SolarWinds violation, likely committed by a group affiliated with FSB’s Russian security service, impacted the software development supply chain that SolarWinds uses to update 18,000 users of its Orion network management product. The hack, which supposedly started in early 2020, wasn’t discovered until December when cybersecurity firm FireEye announced it was affected by the malware. More worryingly, this may have been part of a wider attack on government and trade targets in the US
Supply chains, shoddy security, and lack of talent
The vulnerability of the software supply chain – the collections of software components and software development services that companies use to create software products – is a well-known problem in the security arena. In response to a 2017 executive order, a report from a Department of Defense-led task force on Inter-Agents identified “surprising levels of foreign dependency,” workforce challenges, and critical skills such as circuit board manufacturing that haunt companies at sea competitive price adjustment. All of these factors came into play in the SolarWinds attack.
According to cybersecurity experts, SolarWinds bears much of the responsibility for the damage due to its growth strategy and the planned spin-off of its managed service provider business in 2021. I believe the company has put itself at risk by outsourcing its software development to Eastern Europe, including a company in Belarus. Russian employees are known to use companies in former Soviet satellite countries to inject malware into software supply chains. Russia used this technique in the 2017 NotPetya attack, which cost global corporations more than $ 10 billion.
SolarWinds also failed to practice basic cybersecurity hygiene, according to a cybersecurity researcher.
Vinoth Kumar reported that the password for the software company’s development server was allegedly “solarwinds123”, a gross violation of basic cybersecurity standards. SolarWinds’ sloppy password management is ironic given the Password Management Solution of the Year award the company received in 2019 for its Passportal product.
In a blog post, the company admitted that “the attackers were able to bypass threat detection techniques used by SolarWinds as well as other private companies and the federal government.”
The bigger question is why the American company SolarWinds had to turn to foreign vendors for software development. A Department of Defense report on supply chains characterizes the lack of software engineers as a crisis, partly because the education pipeline does not provide enough software engineers to meet demand in the commercial and defense sectors.
There is also a shortage of cybersecurity talent in the US. Engineers, software developers, and network engineers are among the most needed skills in the United States, and the shortage of software engineers with a particular focus on software security is acute.
While I’d argue that SolarWinds has a lot to answer for, it didn’t have to defend itself against a state orchestrated Cyber attack on your own. The National Cyber Strategy 2018 describes how the security of the supply chain should work. The government determines the security of federal companies like SolarWinds by reviewing their risk management strategies, making sure they are aware of threats and vulnerabilities, and responding to incidents on their systems.
However, this official strategy divided those responsibilities between the DOD for Defense and Intelligence Systems and the Department of Homeland Security for civil agencies and continued a fragmented approach to information security that began in the Reagan era. The implementation of the strategy is based on the US Cyber Command of the DOD and the Cyber and Infrastructure Security Agency of the DHS. DOD’s strategy is to “forward defend” – disrupting malicious cyber activity at the source that has been shown to be effective in the run-up to the 2018 midterm elections. The agency for cyber and infrastructure security, founded in 2018, is responsible for providing information on threats to critical infrastructure sectors.
None of the agencies appear to have issued a warning or attempted to mitigate the attack on SolarWinds. The government did not reply until after the attack. The Cyber and Infrastructure Security Agency issued warnings and guidance, and a Cyber Unified Coordination Group was formed to facilitate coordination between federal agencies.
These tactical measures, while useful, were only a partial solution to the larger strategic problem. The fragmentation of national cyber defense agencies seen in the SolarWinds hack is a strategic weakness that makes cybersecurity difficult for government and the private sector, and leads to further attacks on the software supply chain.
National cyber defense is an example of a “bad problem,” a political problem for which there is no clear solution or no measure of success. The Cyberspace Solarium Commission identified many deficiencies in US national cyber defenses. In its 2020 report, the commission noted that “there is still no clear unity of effort or the theory of victory that drives the federal government’s approach to protecting and securing cyberspace.”
Many of the factors that make centralized national cyber defense difficult to develop are beyond the direct control of the government. For example, economic forces are pushing tech companies to get their products to market quickly, which can lead them to use abbreviations that undermine safety. Legislation based on the Gramm-Leach-Bliley Act passed in 1999 could help address the need for rapid software development. The law imposed security requirements on financial institutions. However, software development companies are likely to resist additional regulations and oversight.
The Biden administration seems to be taking the challenge seriously. The president has appointed a national director for cybersecurity to coordinate related government efforts. It remains to be seen if and how the administration will address the problem of fragmented authorities and clarify how the government will protect companies that provide critical digital infrastructures. It is unreasonable to expect a US company to be able to defend itself against a foreign nation’s cyber attack.
In the meantime, software developers can use the secure software development approach recommended by the National Institute of Standards and Technology. Government and industry can prioritize developing artificial intelligence that can identify malware in existing systems. However, all of this takes time and hackers move quickly.
After all, companies need to aggressively assess their vulnerabilities, especially by engaging in more “red teaming” activities: that is, employees, contractors, or both play the role of hackers and attack the company.
Realizing that hackers are dedicated, thorough, and unreserved in serving foreign adversaries is important in anticipating their next steps and strengthening and enhancing US national cyber defenses. Otherwise, SolarWinds is unlikely to be the final victim of a major attack on the US software supply chain.
This article by Terry Thompson, Adjunct Instructor in Cybersecurity at Johns Hopkins University, was republished by The Conversation under a Creative Commons license. Read the original article.
Read on: California’s Petaluma becomes the first US city to ban new gas stations