SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation | Hacker News Reader

SEC notifies SolarWinds CISO and CFO of possible action in cyber investigation

cybersecuritydive.com

108 pointsmiguelazo41 comments

I think the key here is that SolarWinds' C-staff deliberately downplayed the severity of the attack, and were very late in informing customers and regulatory agencies of the severity of the attack.

I.e. they are being prosecuted not because they were "incompetent and got hacked", but that they then "tried to cover it up", which is where the SEC comes in (illegal stock manipulation via false or incomplete release of public information).

I.e. they are being prosecuted not because they were "incompetent and got hacked", but that they then "tried to cover it up"

Capone was taken down for tax evasion. Any tool we have, is a good one.

And the more shareholders and board members feel lax security could lead to a bad path (eg hiding the result), the better for all.

I can hardly wait for the first civil lawsuits, for any such incident, by shareholders over negligence and loss of value.

I can hardly wait until everyone had to provide a license validation for all code they use, so we can finally put node crap to rest.

> I can hardly wait until everyone had to provide a license validation for all code they use, so we can finally put node crap to rest.

I don't see a reason Node dies faster than say, Java, or Rust or ...

deliberately downplayed the severity of the attack

You mean like UPS just did?

https://news.ycombinator.com/item?id=36439033

The more these happen, the more likely it'll be that the role of CISO will need to be compensated commensurate to risk.

And report up to the CEO.

But it also depends on the nature of the action that's about to come down. My guess is something to do with misrepresentation of Solarwinds' security posture.

CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho. Anyone else (CXO) has incentive to apply pressure at odds with the role, or not take compliance requirements or regimes seriously. Checks and balances.

@dvt: you can nudge with legislation (or in this case, executive branch rule making), we’re just at the initial phase of getting there: https://www.axios.com/2023/04/07/company-boards-sec-cybersec... | https://www.sec.gov/news/press-release/2022-39 | https://www.forbes.com/sites/bobzukis/2022/04/18/the-sec-is-...

Statute and rule making, like corporate bylaws, are mutable, and must adapt to the risk landscape.

(thoughts and opinions my own, interim deputy CISO in finance)

Who would the CRO report to?

> CISO needs to report to either chief risk officer (edit: who reports to the board) or the board directly imho.

I mean, this is all company bylaws, you can't seriously legislate this. But in any case, C-execs do have skin in the game (particularly if investigated by the SEC). They're usually insulated, but if non-compliant (or grossly negligent), directors can be personally liable.

You could legislate that if you wanted to.

Don’t @ people down thread of you. It makes for a really shitty reading experience

Or should the CISO be an employee of a federal agency?

Edit: wish folks downvoting this would comment too. We're supposed to be curious here.

For systemically-important tech firms?

There should definitely be a government inspector general empowered to poke around.

SolarWinds was a sophisticated operation, but there are a ton of security orgs for very important companies that are just inept, underfunded, or both. And absent mandated ability to inspect, they're not going to get the harsh spotlight of "unfuck this now" they deserve.

I don't think that the PRC is a role-model here.

Comments like these implicitly deny the existence of heavily regulated industries.

When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity or when refusal to take cybersecurity seriously results in what happened to solarwinds they should be subjected to a regulatory scheme that will enforce seriousness.

If you think "regulated industries" have great security, I have a bridge to sell you. Regulations are just more checkboxes for most businesses.

Agreed, but this is in large part a function of how things are enforced. The lack of real accountability (especially at the executive level) related to the spirit of the law/regulations is how these things just turn into box ticking exercises.

If you think those checkboxes aren't actively serving a purpose then ... there's nothing really to say against such ignorance except to inform you youry wrong.

> When refusal to take cybersecurity seriously results in 1/3 of Americans losing their identity

Part of the problem is that the term "identity theft" itself is spin to avoid addressing security problems.

As brilliantly pointed out by Mitchell & Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E

As far as societal problems go by far the biggest is the need for people to only consume entertainment because then they start using it as an argument. It was funny enough when people were using Jon Stewart. It was bad enough when people started using John Oliver. But Mitchell and Webb? Really?

Identity theft is not a joke Jim.

I used that The Office reference a few days ago.

The BBC period costume drama image of posh characters referencing the classics makes that look more respectable, but I'm not sure how different was that in practice to the modern day, say, barrage of obvious reaction "meme" images to a Tweet.

As the poet said, "Hasta la vista, baby."

> results in 1/3 of Americans losing their identity

Just because enough identifying information about me had been leaked where people could potentially use it to impersonate me, does not mean that I stop knowing who I am.

Typically the company would always have its own in-house compliance organization and executive, even if there is extensive, on-site federal regulation (like banking sector). So that would probably look like the company having its own CISO, but some of the technical decisions/changes being approved by or required by a regulatory agency.

CISO's are often hired for the purpose of having an executive head to cut. They'll commonly report to the CIO, but have c-suite titles or employee designations (at-will in some states). It's a stressful position with a lot of legal responsibility and little organizational influence and authority.

Wow, Matt Levine's take that "everything is securities fraud" is rather amusing to apply here. I'm curious what the actual charges will be.

I mean as "selling a quarter billion dollars of stock before publicly disclosing the cyber crime of the century that you likely knew about for quite some time" is less "anything" and more "trading on material non public information."

What's most amazing is they apparently thought this wouldn't be noticed by the SEC? execs of a company of that size absolutely should know better.

Ha! On this, I will blame the bad reporting, then. This story seems to focus on response to a security event. Do you have a pointer to the trades that are in question?

Edit: Notably, where did you get that quote? I'm not seeing it in this story.

This has been widely reported for two and a half years. Here's the first link I could find: https://www.crn.com/news/security/-286m-of-solarwinds-stock-...

The quotes are not from the article, it's a writing style.

Understood, is not news I would typically follow, so unknown to me. Thanks for link to another source!

As with most answers, this one comes with questions of its own. If it was that well known and obvious, why did it take so long to move on it? I'm now interested in this topic. :D

No amount of financial cost is sufficient for these kinds of things if you wish to truly prevent them in the future. There needs to be associated criminal charges for the individuals responsible. We are all still suffering from the Equifax breach all these years later and it won't be long before another Enron shows itself and that is simply because there was never any real consequences for the people primarily responsible.

We live in an age of binary reproducible builds and anything worth running is open source.

Windows-centric orgs barely know software from their ass.

If your org is dumb enough to run closed source software for core IT functions, or you run Windows on bare metal, or don't have TPM chips and secure boot enabled, you kinda deserve what you get.

Couple of side notes that are very interesting:

Palo Alto detected the SolarWinds problem early, but failed to notify the Cyber Threat Alliance which it spearheaded, significantly exacerbating the impact: https://www.cfr.org/blog/most-tools-failed-detect-solarwinds...

The PE firm that basically ran SolarWinds into the ground (Thoma Bravo) bought Proofpoint in 2021, not too long after the debacle became public.

Thoma Bravo is poison. They took over LogRhythm when I was working there and ruined it. If your employer is ever bought by then, polish your resume.

Would mark a major escalation in executive accountability... Still no criminal charges, though.

>“Sunburst was a highly sophisticated and unforeseeable attack that the United States government has said was carried out by a global superpower using novel techniques in a new type of threat that cybersecurity experts had never seen before,” a company spokesperson told Cybersecurity Dive in an emailed statement

> Would mark a major escalation in executive accountability... Still no criminal charges, though.

If there was a criminal referral they wouldn’t announce it and any charges would usually sigbificantly trail civil enforcement action, judging from every other SEC civil + DOJ criminal action I’ve seen.

Wasn't the root cause of this attack someone setting a prod system password to 'solarwinds123'? Not very sophisticated nor unforseeable.

Not just any prod system... the one that distributed their trusted updates to their entire customer base I believe.

Haha. I didn't follow it. After a bit of searching I had to laugh. They got owned by the 'hunter2' meme and call it a highly sophisticated and unforeseeable attack.

Well, all the subsequent steps after the initial breach were fairly fancy. But still, not a great posture overall.

Exactly... the initial foothold was a joke. And the bottom line is that important management folks were warned about serious issues many times.

No, that was a separate incident: https://www.theregister.com/2020/12/16/solarwinds_github_pas...

From what I can tell, all we know is that the attackers definitely got into their build system (since the trojan was signed), and we know they moved laterally through exploits in various Microsoft products: https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

Will we see the SEC issue proceedings against Microsoft?

Reply on news.ycombinator.com