The redacted lawsuit: Solarwinds board of directors sued by shareholders

This is a helpful reminder because upon reading the headline I immediately confused this company with the solar roof company Tesla acquired a few years ago.

(v) seems a bit much

Yeah, sounds like a good basis for a lawsuit. Good thing the "we care about your privacy/security" yadayada won't fly this time it seems.

>> (i) used weak passwords for its software download webpages such as “solarwinds123”

Humor me: Why is this bad? I would naively expect software downloads to be almost-public, possibly actually public but non-functional without a license key or such. Unless they did something separately bad like baking private keys into distributed software, I can't see where this hurts anything but already-weak security by obscurity.

While I generally agree that solar winds was lacking a lot on their internal DnR team (iv cut investments in cybersecurity) a lot of the identified issues are things that are seen in businesses EVERYWHERE.

Until recently I was a pen tester and (just a guestimate) 9/10 clients that I do testing for don't properly segment IT networks, use weak passwords for things they shouldn't, and list sensitive and high-value clients on their webpage (they are trying to draw other customers in).

I'd like to clarify two points:

1. It doesn't matter how much money you spend on security - there will ALWAYS be a way for attackers to get in. E.g. Log4J issues recently. There is always gonna be another zero-day or a new email phishing payload or a new NSA hacking tool leak and at most a big company can pay a lot of money and hire a lot of engineers to Reduce the chance of something bad happening.

2. None of these practices are really that unusual (I've seen plenty of software that recommends to tell your AV to ignore it.) and actually managing and knowing about every single credential/password etc in a corp network is almost impossible. Usually things like the FTP server with a weak password get set up long before the company hires their first security engineer, and then refuses to make changes to existing stuff that would take a lot of time and effort.

I do feel that SolarWinds is on the hook for this, especially egregious is (iv cut investments) because of their exceptionally high value clients and the level of access they get into client environments.

However, I don't think it would have mattered much how much money they put into their security team, the team that ran the operation was likely a state-sponsored team and they probably had the funds/people/time to crack such a juicy target regardless of how difficult it was going to be.

Question:

-What did their ISO-27001 and SOC-2 reports look like? Do they actually mean anything?

That's a bruh moment for sure. They going to do the same thing with log4j?

I'm really curious what other restricted software/technology was in this policy.

Massive laps on security do not just happen. I am sure there are TONS of internal communication and likely external communication highlighting various security concerns. Often these are ignored by leadership in favor of things that direct increase quarterly earnings or directly reduce cost

It is a tale as old as the information technology industry

It is really common for any company that wants to maintain certain levels of compliance that they get a security audit. There are generally two paths forward for anything that is found, fix it... Or the terrifying path that is more commonly chosen "add it to the risk register". Company risk registers are signed off on by the boards, or more commonly an appointee of the board that is acting on their behalf. The risk register itself is almost never available outside the company except in some cases to major shareholders, or large business partners that make access to it a condition of a large deal.

I suspect what happened here is they were told of the issues and added them to their risk register them promptly forgot about them. By doing so they accepted the liability if those risks ever became realized which would open them up to a lawsuit like this.

Thats what you get when you leave companies to regulate themselves, and few options remain for investors.

Not bashing Solarwinds because I think they are a good company, just explaining how this works:

The board is responsible for what the company is doing; not for the actions of every single employee, but for setting policies, make sure they are respected, hiring competent people etc.

Today the SOX is already holding the CEO and the board personally responsible for financial reporting. I think it is criminal responsibility there. It is not much different to hold them responsible for the results of the company, especially if any of the accusations can be proven.

The interesting part will be the effect on changes in the way tech companies are managed. For example in some very large companies most people are hired based on criteria that don't include skills; for example in my company IT people are hired without any IT interview, they get points (in US) for race and gender, outside US on gender. If something happens and these people blow up some FDA regulated products (most of our products are FDA regulated to some degree), is the board be personally responsible for a situation they created? I bet they are.

There are also many companies where policies exist on paper, but nobody is respecting it. The ISO 9001 certification is famous in parts of Europe, it is mandatory for some IT companies but it is just a bunch of paper in a closet that nobody ever read. Is the board responsible for such a situation? Of course it is. Board members are not appointed only to have friendly meetings talking about golf, with people being board members in a dozen of companies and doing just golfing and board meetings, but to top level set the directions for the company. If you set the company on self-destruct, they should be held responsible for it.

can't tell from the comment if you believe that the actions of the board is morally questionable that somebody holds these creeps accountable. mate who works in sales was in a room with them on a trade-show last year and they downplayed the incident and told their customers that they have mitigated all future risks. I hope the lawsuit will rip them a new one!!

Exactly. This lawsuit is getting a lot of attention in board rooms because the pension funds are saying that the board is personally responsible and have been negligent in their responsibilities under SEC and NYSE regulations for cybersecurity.