Hacker News Reader

Comment by slt2021 | Hacker News Reader

slt2021

did we ever see post mortem from Solarwinds? How did attackers enter the network? Even if build server used admin:admin, this server was in the intranet. How did they get inside the network?

we need post mortem and to understand the entire attack chain, rather than sit and speculate about the abilities of KGB/SVR.

Truth is KGB/SVR employees are very dumb and routinely leave traces. Their best hackers are actually civilians with commercial interests who do black hat campaigns for them in exchange for cover/protection on russian soil, but are not officially employed/enlisted.

I have a hard time believing these were russian state sponsored hackers, unless somebody provides the hard evidence

View on HN

> did we ever see post mortem from Solarwinds?

Other than to provide misinformation (to lead people astray) what is the advantage to solar winds to do a post mortem? Why educate people? Upside vs. downside?

A businesses purpose is to act like a business. Not to educate (for lack of a better way to put it) the 'peanut' gallery, pundits, news outlets, bloggers or to improve security for others. Or to seem like 'a good company'. Nobody will deal with or not deal with Solar Winds based on what they say afterwords in a public and open forum. Privately and maybe under NDA sure but why broadcast this to everyone? (Answer is not 'well that's what you do').

A post-mortem allows for the company to perform an analysis of what exactly went wrong and what needs to be fixed etc...

It also shows that they have a CSO role and they are trying to instill faith in their customers...

Plenty of companies seem to think that seeming like "a good company" is a sufficient business reason to do a post-mortem. That's the thing about expectations: even if you can't come up with a rationale for doing something, other peoples' reactions to not doing the thing can be a sufficient justification for doing it.

> well that's what you do

I assume what this phrase is supposed to get at the sense that doing port mortems is the (morally) right thing to do and part of our duties as engineers to each other and to the public that has an interest in security. If that's the case then I have to disagree with you, that's an excellent reason to do it. (The fact that something would be the right thing to do means that you have a good reason to do the thing: namely, that it would be the right thing to do.) You can be cynical and say that "doing the right thing" is not going to be a good enough motivation to convince business X to do it, and that's fine, but it doesn't sound like that's what you're saying here.

doing post mortem will be responsible thing to do as it will allow other companies to strenghten their defenses against this vector. if it was rogue employee who used his credentials - well that's one vector. if it was cheap CIO who kept security team understaffed and underpaid => underskilled -> well that's another lesson to learn for all other CIOs/CISOs around the world. Try to cut costs on your IT people, try to outsource talent - this is what you get. It will earn a goodwill for Solarwinds and will help everybody else to be aware of the attack vector

> Plenty of companies seem to think that seeming like "a good company" is a sufficient business reason to do a post-mortem.

'good company' to what audience? Hackers and security people and 'nerds'. How big is that audience? You don't make business decisions based like that. It's business after all.

Look at all the (for lack of a better way to put it) 'dicked off' things Apple has done. They pissed off (and continue to piss off) very diverse groups of people and companies that interact with them. In the end the vast majority of the Apple customers (the people who pay them money) don't care about this at all.

Note I didn't say that things couldn't be shared with direct and important groups of people. Just that it didn't have to be open and public and broadcast in any way as entertainment or help for the community at large.

You are absolutely wrong on your approach to this. If there is no transparency into what happened, there is nothing but the companies word that it won't happen again. In the case of SolarWinds, their word means less than nothing.

When you have a breach of this magnitude, people need to understand how the attack happened and what technical or process controls you have put in place to prevent it going forward.

The biggest issue with SolarWinds breach is they have done nothing but try to obfuscate what happened. When they did press release, they said it was a "Security Vulnerability".

WRONG!!!! There was a backdoor intentionally placed in their product and sent out as update to tens of thousands of customers. At the very best their response has been uninformed, but knowing what we know about solarwinds as a company it seems intentional. To date they have not corrected that release and still often times refer to it as a vulnerability.

> If there is no transparency into what happened, there is nothing but the companies word that it won't happen again. In the case of SolarWinds, their word means less than nothing.

True, the silence is damaging. But what if the answers would be more damaging than the silence?

Agree but nobody wants to believe that. Since many of the people who see upside have a vested interest in that upside remaining even to the detriment of others.

Simple: credibility. Right now, the default position is that they're insecure and they don't know what they're doing. A post-mortem with a solid RCA shifts that to "we've identified this, fixed it, and put in place systems to ensure it can't happen again."

It's the aviation industry playbook; air travel is perceived as safe (partially) because of the big song and dance they put on about safety analysis after an incident.

Reply on news.ycombinator.com