How can you prevent SolarWinds-style hacks on your network?

I think this one is funny because the SolarWinds hack was actually perpetrated by the very fact that people were keeping their software updated. While I do endorse keeping software up to date as a general security best practice it is important to keep track of what is being updated, when it was updated, why it was updated, etc. Additionally, the systems updated should be monitored after they are updated to ensure they behave correctly. An additional idea to consider would be waiting until the first point release before upgrading. This approach needs to have escape clauses as there may be times it is necessary to upgrade immediately and waiting for a point release is not a cure-all since the breach may not have been identified yet.

Prevent SolarWinds-style hacks: Vet vendors, follow secure coding, use monitoring tools, enforce zero trust, update software, segment networks, implement MFA, educate users, demand vendor transparency, stay informed about threats, plan for incidents, conduct audits, control access, ensure secure configurations, encrypt data, adhere to standards, backup data, foster cybersecurity awareness. Adapt to evolving threats for robust defense.

It is easier said than done, and the challenge is different depending on the size of the organization. In reality a small organization may have have a small amount of software packages that need to be updated, but guess what, a small company is lucky to have one dedicated cyber secuirty guy to be able to scan and advise on such activities. On the other hand, larger organizations are likely to have the resources, however they will a long list of software that is critical to the operation of the business, which can't be taken down every other day for patching. In my opinion, the software authors should take more care to build good quality secure code. There is a rush these days to be first to market at the cost of security.

An industry-wide problem is that IT cannot patch vulnerabilities fast enough even when a new one is identified. In this case, the vulnerability was the lack of controls of the software vendor. Adversaries, whether guided by profit or espionage, will ultimately find an attack vector because patching at scale is impossible. At Halcyon, we typically see Ransomware-as-a-Service (RaaS) groups utilize Access Brokers to gain access to IT systems as a trusted user and then escalate privileges and then exploit vulnerabilities. It is often stated that customers should assume a breach is imminent -- and risk reduction is the ultimate goal. Unfortunately, that is the world we live in.

- Implement a method to observe how the patches behave once a system is updated . - Always be skeptical of the updates you perform.

Your best course of action would be to enhance your ability to detect post-exploitation activity. You really need to have good baseline of your environment and understand what is normal.

The SolarWinds-style hack was a successful switch of a legitimate update build code for an illegitimate update build code (that contained a RAT). This switch was done in the Orion build environment and at the last possible moment (just before execution)to ensure it would not be detected and ultimately was sent to customers. The update would not have drawn a flag during download because it was signed by a legitimate code signing certificate. Most importantly, its novelty meant that it had no known signatures and by-passed defensive arsenals and entered several networks. It was network monitoring and detection of unusual activity within these networks that alerted security analyst and led to its eventual mitigation

Network activity monitoring serves as an early warning system. It enables organizations to spot unusual or suspicious behavior that might indicate a cyber threat. This proactive approach allows security teams to respond swiftly, potentially thwarting an attack in its early stages. Modern network monitoring tools leverage behavioral analysis and machine learning algorithms to establish a baseline of normal network behavior. Deviations from this baseline, often indicative of an attack, trigger alerts. This approach is essential in identifying complex, evolving threats that don't fit traditional attack patterns.

Constant network monitoring and alert based on the change in baseline which should include how users talk to the servers , how servers talk to each other , how apps talk to apps and a playbook should be present to monitor and block any change with proper notifications to all the stakeholders . Have a healthy list of dynamic content like IPs , DNS and URL domains.

Establish and maintain a solid software and application update programs across the organization, Zerotrust as a basic principle until testing and vulnerability assessment is conducted.

Traditional thinking; to utilize network segmentation to prevent a SolarWinds-style hack are outdated. Using a Zero Trust policy engine and microsegmentation is more effective than traditional network segmentation in responding to SolarWinds-type attacks because they address the limitations of traditional segmentation. Zero Trust focuses on continuous authentication and verification, ensuring only authorized entities gain access. Microsegmentation further restricts lateral movement, containing the impact of a compromise. This combination provides dynamic access controls, granular protection, and enhanced monitoring. It prevents unauthorized access, detects anomalies, isolates high-value assets, and simplifies incident response.

Network segmentation is a key pillar of the defense-in-depth strategy. It assumes that no single security measure is foolproof and, therefore, deploys multiple layers of security. By dividing your network into segments, you're essentially creating layers of defense, where a breach in one segment doesn't necessarily compromise the security of others. Applying the principle of least privilege becomes much more manageable in a segmented network. You can finely tune who or what has access to specific segments, reducing the chances of unauthorized access or lateral movement.

Performance threat based segmentation and have a NAC solution where needed to isolate users and machines where needed. A solution should also perform threat based vulnerability prioritisation and further suggest or automate the process of blocking a host.

This is a good advice but it's something most organisations can't maintain in time when they experience rapid business growth, have operational issues or incidents and start adding new infrastructure both on-premise and cloud so you better have a plan for non-segmented networks as you will need to deal with them.

Zero Trust is kinda the buzz word these days but it's actually not a new idea. For decades hosts have put their public facing websites in DMZ's and not connect directly to their internal networks. Segmenting types of traffic from each other helps from a security perspective but can also isolate different traffic types from each other so they don't interfere with each other. VLAN's and SD-WAN overlay networks can also aid in separating your traffic from each other. Layer 3 devices with ACL's and multilayer firewalls are also good tools in between boundaries.

A group can only be as successful as its least successful person. The human side of security is also the most vulnerable side and organizations should invest more in building up skills to help prevent their users from being the weak link in the chain. Employees continue to be targeted by hackers through several means. This battle for the minds of our staff can only be won through constant, continuous and up-to-date security education and awareness.

Your staff can act as either a robust human firewall or a weak link in your security chain. Training them in cybersecurity awareness and best practices is like arming your first line of defense. They become vigilant, knowledgeable, and capable of spotting and responding to threats effectively. Leadership should actively support and participate in cybersecurity training. When employees see that leadership values security, they are more likely to take it seriously. Cybersecurity is not just about rules; it's about creating a security culture. Staff should feel responsible for the security of the organization and understand how their actions can impact it positively or negatively.

We need move on from the idea that users are the weakest link and somehow with enough (unwanted) education we are going to somehow get them to turn in to threat detection experts. The best you will achieve is that the user will be able to notice a very obvious phisihing email. Now if a very obvious phasing email got through, we should start to question why was it allowed through in the first place. Likewise a phishing email using novel techniques will likely bypass the protection and fool the user. Therefore, it is safe to say that assuming compromise is a good starting point. And figuring out how we will detect the activity carried out by the miscreant is probably more important than trying to blame users I mean educated them..

By conducting attack simulations, organizations can identify weaknesses and address them before real attacks occur. This helps in strengthening defenses and mitigating potential risks. Training provides employees with the knowledge and skills to recognize and report suspicious activities, reducing the likelihood of successful attacks. Additionally, targeted re-training for those that fail to identify the simulated attack, ensures that employees stay vigilant and informed about emerging threats, allowing them to adapt and respond effectively.

A solution like cyber range , phishing simulation along with 3rd party vendor management and vetting is part of an important talk an organisation should do

An integral part of testing network is to create a continuous vulnerability management program that covers all third party assets in its fold. It is imperative to conduct weekly biweekly scans and ensure the vendors are compliant on patching of the systems. A real time dash board should be built in the environment to keep a check on vulnerabilities detected and mitigated in the environment. Real Time data is the key.

Network environments are dynamic, and new vulnerabilities emerge continuously. Regular security testing helps in identifying these vulnerabilities promptly. It's like conducting routine health check-ups for your network, ensuring it's free from hidden ailments. Also Security incidents are inevitable. Regular testing helps your incident response teams practice and refine their procedures. The other thing is Security testing should be tailored to your organization's unique risk profile. A one-size-fits-all approach may not be effective. Consider factors like the type of data you handle, your industry, and your specific threat landscape when designing testing scenarios.

Continuous table top / breach simulation exercise should be part of the overall cyber security strategy where every vertical in the organisation like HR , Accounts, IT etc is active to respond/ contain a breach

Using some of the same tools the adversaries use to test our own networks is essential to find vulnerabilities. Knowing what's on your network is important. Testing network security also means maintaining a strict network asset hardware/software baseline. Having a plan for before and after an incident is essential and practicing these processes makes everyone more capable of responding when an incident occurs. Keeping the tools used to search for vulnerabilities updated is a constant cat and mouse game. Time is of the essence.

Zero Trust Architecture: Adopt a zero-trust approach where trust is never assumed, and verification is required from anyone trying to access your network. Encryption and Data Protection: Encrypt sensitive data at rest and in transit. Implement data loss prevention (DLP) solutions to monitor and control the movement of sensitive information. Cybersecurity Insurance: Consider investing in cybersecurity insurance to help mitigate financial losses in case of a breach.

It's not feasible to "prevent" a software-supply-chain attack. To prevent such an attack would necessitate unrealistic measures, such as: - A software freeze across your entire enterprise ( vulnerability exposure) - Custom internally developed solutions only ( insider threat exposure) - Manual/Analog processes and technologies (human error and availability exposure) Ideally, we need every software creator to undergo a strict process to safeguard against many threats, which include: - insider threats tampering with source code - integrity control of code repositories - compromised compiler defenses - stolen software signing certificates/signatures - man-in-the-middle update interception - hash collisions - SBOM forging/tampering

Adopt a zero-trust security approach, which assumes that threats may come from both inside and outside the network. This means verifying every user and device trying to access resources, even if they are inside the network perimeter.

Put these in place to hedge against such an attack: - IOC detection - FIM - SIEM - Network traffic analysis - Conditional access - SBOM - Current assets & their risk classification - NO SHORTCUTS That last one is critical. Too many companies roll the dice when it comes to the true balance of business risk (i.e. Sunburst) & having good controls to avoid an incident turning into a 10-megaton blast.

You should control outbound network access from your resources. Ideally this would be all resources (i.e. employee computers, servers, printers, etc.) and outbound traffic would be limited to the appropriate ports/protocols/destinations. While this sort of approach would not have prevented the SolarWinds software from being installed it would have minimized the damage done since (with properly configured firewalls) data would have been difficult or impossible to exfiltrate. Even just blocking access to external DNS services can be helpful. Blocking outbound traffic must be done cautiously as it can have major, unintended effects. Best practices would be to start slowly introducing a narrow block first and expanding it over time.

Many companies and organizations trusted SolarWinds to protect their networks. A basic principle of risk management is not to put all your eggs in one basket. For instance: when practical, use several different vendors for products and services, that way if one of them is compromised the others will have a lower chance of having the same issue. Use two vendors for switches and routers. Use two vendors for firewalls, etc.