Cybersecurity Vault - Debating the SEC Charges Against SolarWinds and their CISO

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the bombshell of a news story, the Security and Exchange Commission, uh, their case against SolarWinds and specifically their CISO for fraud An Internal Controls Failure. And I'm talking with Ira Winkler. Ira is an award-winning CISO, top-rated keynote speaker, bestselling author, and man, he's a longtime veteran in the cybersecurity industry. So Ira, thank you. Thank you for joining me and having a wonderful chat today.

I'm honored. That's all I could say.

All right. Sarcasm. I love it. Okay. Good way to start. So, you know, before we get into details of the particular case here, there's a tremendous buzz. It was just announced a couple of days ago where the SEC came out and said, hey, we're going after SolarWinds and specifically their CISO. But it's gotten visceral out there. I'm looking on social media and I'm hearing people talk and many CISOs are up in arms and it almost seems like people are perceiving it as an attack on the CISO institution itself. I mean, why is there so much emotion behind this, do you think?

So here's my opinion on this, and I'm going to mention this because it is relevant. You know, first you had the Joe Sullivan case back, what was that, early summer, I think it was, maybe before.

That was the Uber case.

Yeah, that was the Uber case.

For people that don't know.

And everybody was like rallying to Joe Sullivan's cause. Look, I don't know Joe Sullivan. I have nothing for or against him. But the reality was at the end of the day, what Joe Sullivan did was unequivocally a crime. You know, there is no— it's straightforward. There was no question. Everybody just was supporting Joe for sympathy, given all his previous work as a federal prosecutor, which I'm going to say did go into why his case was very different. Because with Joe Sullivan's case, essentially Uber was in the process of being investigated for a data breach. And while they were actually being investigated, there was this incident where basically cyber extortionists contacted Uber and Joe took the call and came up with, well, as opposed to these people having a data breach, actually creating another data breach in the midst of this, which we are being accused of not divulging the first one. We're gonna take this one and frame it as a bug bounty while they were being investigated. And again, as a former federal prosecutor, should have known better. And he was in an environment that was frankly, I mean, right now, one of the new shows on Netflix, I think it was on Showtime before, is something like Pound Stronger. Everybody should see that. That was an incredibly toxic and criminal environment. If that docu— well, mock, I don't know what you'd call it, but essentially a sort of drama documentary.

Mockumentary. Yeah.

Was anywhere near the truth. And he was there in the height of this and this just kind of was there. On the other hand, you have Tim Brown, Tim Brown, CISO. Now look, I am not going to say in any way, shape, or form that what SolarWinds did or did not do was in violation of these SEC regulations, because the SEC regulations essentially say you have to notify people of material issues, which at that point kind of sort of includes cybersecurity. And whether or not cybersecurity was good or bad, the problem is it's a judgment call in many cases as to whether or not cybersecurity is good or bad. If nobody breaches you, it's good enough, unfortunately, in the eyes of many because—

Well, hold on. Let's get into the facts of this particular case. And I'm gonna put in a link for everybody, the SEC's, the actual complaint. It's about 68 pages, a wonderful read to put you to sleep at night. But the case, it's not actually about what controls, whether the controls were sufficient or not or whatnot, whether they had rubber bands keeping everything together. The crux of the case is really around the filings, right? So you're talking about S-1, S-8, 8-K. Form 8-K. Right, so these are filings by a company that are made to investors to let them know this is, you know, our posture, these are our risks, these are our benefits, and there's lots of things contained in those things, but it's really to inform investors so that they could make good decisions. And the case is, the crux of the case is around the fact that the SEC alleges that the CEO and especially the CISO put false, intentionally false and deceiving information there to deceive the shareholders. Right. And these are forms that are submitted to the SEC.

I actually— okay. So let me make a very— it sounds like a fine, a very fine, you know, very fine point, but it's critical. The CEO in that document was not charged. SolarWinds as an entity was charged, but Tim Brown as an individual was charged along with SolarWinds as an entity. The CEO was not listed there. So that's issue number one where they are— Okay, well, let's take it one at a time because I want to respond to that because you and I have a different point of view and I'm going point counterpoint, but short of me going, Jane, you ignorant slut. I always wanted to do that. Most people won't know what I'm talking about, unfortunately. And all of a sudden I'm a sexist for that.

But you know, I'm going for it. Unless you want me to. We're keeping that in the recording.

Everybody needs a Dan Aykroyd, Jane Curtin reference once in a while.

Yes. Yes. Dan Aykroyd, the king. So, okay, you're right. CEO wasn't named. Now, I was reading through the brief and one of the things that came out with is the fact during this period where, again, the CISO provided and was part of the filings, and this is actually part of the 8-K filing. So once the breach came out and was public, they had to file with the SEC, hey, there's a material issue here. And they, again, the SEC alleges that the CISO intentionally downplayed and omitted a whole bunch of very, very important facts around it. And then after that, right, and the stock went down. But after that, the CISO then sold hundreds of thousands of dollars worth of options before the real truth came out. Now, again, that supports that kind of fraud and insider trading that the SEC— this is their bread and butter kind of case. Case, right? So, and I'm just speculating here because I don't know if the CEO also may have sold options there, don't know. But do you think that might be a differentiating factor, that there was a personal material financial gain because of an intentional choice of leaving out very pertinent, really important facts in their 8-K form?

So, I mean, obviously, when people sell stock, that always looks bad. At the same time, you know, there is frankly the realization that, you know, you look at this and I don't know the specific circumstances, but it appears that Joe Sullivan sold. It's not like we're talking millions of dollars, which is number one. I know.

Are you talking about our case?

Sorry. Okay. So hopefully it recorded your points, which if I'm going to summarize, if it didn't get recorded, that your points were he filed a document which said they have best-in-class procedures and those procedures were in place when in fact they weren't, and possibly including the fact that, to my remembering what you said, that, you know, that they were breached and when they filed the 8-K breach, they did not record whether or not You know, they did not say that we had a similar breach months before.

Two, two similars, one with the government customer and one with the security company customer that reported it to them. Yes.

So here's one of the problems with this and 8-K filings and stuff. With 8-K filings, one of the problems is, and this is unfortunately true and this happens all the time in large programs that a CISO has to deal with. So for example, you said it's the exact same attack, whatever, clearly they were in there. The problem is how, and this sounds really dumb, but it's unfortunately true. How do you know it's the exact same attack? Does it trace back to the same IP addresses? No, it doesn't. Does it trace back to, you know, do you know it's physically the same attackers on the same things? Can you say there were possibly similar things? Maybe, I don't know what the actual wording was, but the reality in all legal filings is you do not put data in there unless you are 100% certain. I'll give you, for example, training I had as a scuba instructor. And this sounds irrelevant, but I give presentations. Everything I need to know about cybersecurity, I learned from teaching scuba. Sounds irrelevant. But it's actually true. So for example, if you are going to report an accident, when you see an accident, you could see like there are people who get there and say, "You know, I was watching that person. They just looked like they were going to do something wrong, and then I turned my back and there they were. All of a sudden they were on the floor and they had like, you know, whatever." Now the thing is, when you in school as an instructor, they trained us do not go ahead and tell people what they were thinking. Do not go ahead and say, "I had a feel." You are to report facts, you know, because it could hurt you, it could hurt them. You make assumptions that are not true or whatever, it matters. So for example, did— unless you can show in this case that they definitively knew that the attacker was the same early in the year and at the end of the year, You know, there's a difference between people having chats back and forth in internal communication channels that have feelings compared to what is definitive proof that these were the same attackers back then than they are now. Now, to the extent that should have been reported, I don't know that part, but I do know that as a good CISO, You do not make assumptions. You do not act on, well, kind of seems right. If you were to ask me where my money is, well, that's one thing, but you don't, you're not there placing bets on your cybersecurity program. You're not there betting on the criminal. You are there to report a fact. You're not there to assume. And even if the assumption is correct, You don't assume. And what that discussion was, was not there's definitive proof that these are the same people. Those people were communicating. They kind of knew what it was. I'm not disagreeing that the odds were there, but unless they had a factual reference, you do not report an assumption as a fact in a legal filing.

So I think it's going to come down to— because again, the SEC has to prove this innocent until proven guilty. But there, you know, in the filing here, it looks as if the CISO was open about it within his staff. And when he communicated it up, it was, yes, we've seen this attack before. And it doesn't have to be the same attacker, in fact, that's irrelevant, right? It needs to be, hey, we've been attacked using these vulnerabilities or exploiting these vulnerabilities and it's happening again and again and again. And again, when they're responding to their customers and to SEC saying, oh, we've never seen this before. Yes, you have. In fact, you talked about it. In fact, you presented to your executives about it. But when it came to putting it in a document that you're supposed to be sharing this with, you said, nope, nope, this is the first we've ever seen this. No, that's not true. That's not— I am—

what I'm saying is there's a lot of splitting hairs. At the same time, if I was there, there's a— and at the same time, I would say if I am Tim Brown, and here's again where the Joe Sullivan case kind of differentiates itself. Joe Sullivan is a highly experienced attorney.

Yes. And who used to prosecute cases like the case against him. He absolutely should know. Absolutely. I see where you're going here. Yes. Absolutely should know.

And that's issue number one. Issue number two, however, is, and as you claim, and one of the problems I have with the SEC lawsuit, it's like saying Tim never disclosed anything. You know, Tim did not disclose the information to his superiors. The whole document reference, and Tim Brown provided this information or else they wouldn't have a case against SolarWinds.

Agreed.

And the whole case is making, well, Tim Brown is at fault 'cause he never disclosed this. Yet at the same time, every other paragraph says, and Tim Brown made his managers aware. Now in this case, thinking if I was Tim Brown, would I have done the same thing? People know me. It's like I would tell management to go to hell. I'm outta here.

Because ethics matter to you. Yes, I get it. And that's good. That's what we want in this industry.

But I'm willing to tell management to go to hell and quit.. And I've done that in the past. And Tim's difference, you never know where finances, I'm not going to guess, you know, how many stock options Tim vests into and stuff like that, which might have had an impact on his actions. But at the same time, here's the problem I have. Tim went ahead and disclosed the hell out of all this according to your statements. Tim went ahead and told his management, we've seen the same thing, if I assume you're correct. And if I assume you're correct, Tim reported this up the chain to everybody with all their legal teams, highly paid lawyers who are doing crisis response, highly paid lawyers who are familiar with SEC regulations. And they're like, we're filing this information. Tim has disclosed everything he knows to them and they're coming to him and saying, here's the appropriate filing.

That, that happened. And that should be a defense, right? If he were, if I were defending him, I would go, yeah, we need to show that it wasn't just you. So on and so forth. And it was at the advisement of your attorneys as well. That's always a nice thing to add in. But again, we don't know if that happened. Well, that is something I think that this case has to explore. Right.

This is why as a CISO, a CISO past, present, and future, where the concerns come in, because when you look at and stop and think what's going on, and as you said, Tim disclosed this to his management. And they— Tim, they tended not say, hey, here's the 8-K, I'm going to file it. Don't take a look at it. They prepared the 8-K for him, for his signature.

And, well, I shouldn't say CEO signs it, right? But yes, he was part of the team, supposedly.

And according to everything, he disclosed everything. And the problem is he disclosed everything. As far as we know, he disclosed everything. There's not Any claims except for when the SEC determined it was convenient to say, and Tim Brown did this but did not disclose. Yet every other paragraph says he disclosed everything to his management. That's why SolarWinds as an entity is at fault. It never said Tim kept it secret, but Tim went ahead and reported pretty much everything, especially when it came to this 8-K filing. And the problem I'm having is not necessarily— I don't know the fine lines of what happened. I know that Tim did not— as a CISO, I know Tim did not operate in a vacuum, that Tim reported everything, even this. And you know, all that report had to be disclosed to all the lawyers and everybody else advising SolarWinds at the time.

Yeah.

And to say—

It's definitely been reported to them.

Yes. And to say, okay, well, we kind of let this guy lie. And, you know, all the attorneys basically blessed what he said and lied. There's so many other people. And do I think that Tim Brown was a deer in the headlights? Fundamentally, I like the guy, but yeah, he was probably a deer in the headlights. And that's an assumption, but it's an assumption based upon the facts that— and this is Tim's personal defense. And frankly, it's one of the problems is Tim is going to have to use probably the legal team of SolarWinds. I think he— hopefully, I think they determined he had directors and officers insurance. So hopefully he'll have his own attorneys who will make the case and then thereby throw SolarWinds under the bus saying Tim isn't qualified. He doesn't have the legal background to know what is or isn't any, you know, legitimate. He, he Basically, I'm making the assumption, I admit, but odds are in my favor, he took the advice of the attorneys and the accountants and everybody else provided to him through SolarWinds on how to respond. If he hired his own attorney in the process, he might have got a different result. But in the—

Well, I think we're aligned here 'cause I look at it kind of in two aspects. Number one, grown adult in a leadership position. If he did knowingly put false information on an SEC form, got to be held accountable. I mean, you have to. Now, the other piece that, that were more closely aligned, if there was the CEO and the CFO and the CTO and the lawyers and everybody else who also were part of that decision in misleading the SEC and the investors, I think they should also be held accountable. But if I'm looking at it from the investor's perspective, they have certain rights and they were violated, right? And so if anybody that was part of that did it, I think they should be held accountable according to what the law is.

And the other part is, frankly, I don't think— here's the unfortunate part— I would say at the end of the day, I doubt most investors give a damn in what's put in these SEC, the 10-K filings. Not sure about the 8-K filings, but what goes into the 10-K filings. I mean, look at the Target stock price. Target became synonymous with data breach for a period of time, and Target stock price did not end up going down in any way, shape, or form for an extended period of time. It all came out in the wash, you know. Same thing with, you know, Like SolarWinds. I mean, SolarWinds, because I did do the research and see, okay, yeah, it went down and pretty much stayed down. And then I don't know, I did not do the research as to what else could have been involved in there. SolarWinds is still at this point, from what I saw, the more of a pure, you know, it's primarily the largest pure play on the market and it still has a pretty notable market cap. Whether or not the market cap previously was where it should be is another question. I don't know how well their revenue is still close to $1 billion a year. And I'm sitting there thinking, okay, do investors have something to worry about? And you know, when I look at some of the documents, it would be like, yeah, I'm reading that. And I'd be like, as a person, I'd be like, Yeah, that kind of sucks. But as an investor, at the end of the day, they care about market, you know, market financials.

Okay. Okay. But these are rules that are established to make sure that there's not fraud going on, not insider trading. Mm-hmm. I mean, are you recommending that investors should not care if there's insider trading, if the rules are not being followed? In this case, they were filing some of those forms because they were looking to get new investors to bring more money into the company. If you're a new investor going, "I'm thinking, I'm considering investing in this company," are you saying they shouldn't care whether there's insider information not being shared as required by law?

Okay. So, let me give you an example this way. So, for example, we're talking about password policies, we're talking about passwords around and things like that. Trying to, I mean, sorry, I'm trying to give examples. So I'm not giving examples of people I know firsthand information on, just so you know.

Sure, sure.

And so for example, I remember a case, never did work for JP Morgan Chase as an example. There was a data breach of JP Morgan Chase where what happened was this, there was a system that did not have multifactor authentication in place. Despite the fact JPMorgan touted the hell out of the fact that multifactor authentication was in place throughout JPMorgan. JPMorgan basically said, you know what, we did have a system that did not have multifactor authentication in place. We did not know about it. If we did, we would have changed it and so on and improved the situation.

Yes.

And they took the hit. They paid a fine. They moved on. JPMorgan Chase is large enough.

That's because they didn't know, right? But if the SEC had information that said, guess what? You were provided with reports for the last 3 years saying you had these problems and you didn't fix it and you still stated, you still stated you had those password controls in place. That's deceitful.

Part of, part of, here's the thing. They said, if I'm not mistaken, we had good password policies in place. Then they point to incidents where the password was not in place, like passwords or SolarWinds 123 or whatever that was. That was a case where I'm not going to deny, I would assume every large organization somehow has systems because the part— and here's where the problem with CISOs comes in. The problem with CISOs comes in, it's like, you know what? I work my ass off. To give this organization the best security possible. And then there's rogue IT that pops up. There are systems that are, you know, that employees bring in. There are cell phones that come on my network that somehow are able to, like, you know, can't put MDM on everything because of privacy concerns and all that sort of stuff. And while I try to put and implement where I can, I am saying I have the appropriate procedures in place that I enforce to the best of our abilities.

Sure. But you said where you can. So if you have that policy and I'm an auditor and I come to you and say, Ira, here are these 10 servers that don't comply with your password policy. Here's the server names. Here you go. Should you still, right? And you decide to do nothing about that. Oh, that's a nice list.

Eh.

Right? Are you then— should you be held accountable if you go in front of investors, right? Or send them a letter and say, "Hey, no, we're covered." You know, there's some fine lines here. If you knowingly choose not to address it, that's different than, "As far as to the best of my knowledge, we are compliant." That's great. This is where—

and I read the— I actually read the the charges just specifically for this.

Uh-huh.

The document says we have— here's how the document reads, and correct me if I'm wrong, because if I'm wrong, I will concede this point. The document says that Tim Brown attested to the fact of having good procedures in place. Then an audit showed there were some violations of that procedure. Therefore, he's wrong. I did not say— I did not see— and by the way, this remained in place for a period of time. I only saw that he made a statement that said he had good password policies, but yet when an audit was done, they found systems that did not have a good password. I did not see what happened, you know, as a result of that finding.

So they're actually calling out 4 things, yeah, right, that he stated that they were in compliance with this framework and they were not, right? And auditors came in and showed that it was between 26 and I think 40% compliant or semi-compliant, but basically 60% not compliant. But he said they were compliant. Number 2, that they were using a secure development lifecycle when creating software, and yet they've got documents that show that they weren't and he knew it and there were conversations about it, that this part of the software and this product did not benefit from that. And yet he came in and said that they were. 3, that they had strong password protections, right? When he knew there were gaping holes there. And again, I think you're right. There, there, there could be some wiggle room there. And lastly, they maintain good access controls. And again, some auditing came back and said, you've got entire systems that are not compliant with your access control policy. And that actually had led to the breach, several breaches, right? Because they didn't have all that stuff together. So it's not just one little claim, it's a number. And they're backing each one of those up because they have to, right?

Well, here's the pro— when I look at that, the fact is, yes, you're right. The fact is, however, in most organizations, You know, to the extent you're going to find that there is no such thing as a blanket security statement in any organization of any given size. And so if they are reporting that there are exceptions now, to the extent that it is endemic and so on, then you're getting to, okay, here's where, again, I'm telling you where the concerns are.

Sure.

The concerns are And maybe it's 100% right that Tim is a complete sociopath and lied his ass off.

I don't necessarily believe that. And I don't know Tim, by the way.

I'm just saying that maybe it is correct. I'm not discounting that. Maybe. But what I am saying is that when you hear, yes, we have an audit, we find deficiencies, that's what audits are for at the end of the day. You know, in the ideal world, you're supposed to do pre-audits. You have an assessment coming, you find the violations. The question then becomes, and this is a legitimate question, how as a CISO, and here's probably the biggest issue where the whole thing comes up, you are given a variety of resources to implement fixes and changes. Given all the fixes and changes, because, and this is where, because here's what I'm thinking in listening to everything. And let's assume what you're saying is 100% accurate. Tim Brown's only thing was either to go ahead and declare, no, our systems are a bunch of crap. And therefore I'm not, and this is what I'm attesting to.

Mm-hmm.

Or theoretically quit, possible find another job with a new vendor. And I'm sitting here thinking, okay, on the other hand, most CISOs are sitting there, yes, I have problems. And depending on how well security is built in, but from the time you take it over and how long your program's in place, it takes a while to turn the battleship, as the expression goes. And when you're doing that, do you have time, for example, to stand down all system development and maintenance to modify the software development lifecycle, as an example? And what qualifies as a secure software development lifecycle? The issue comes up that, okay, if I am a CISO and I walk into an organization— again, I have been lucky in the last two organizations to have been blessed with and incredible cybersecurity programs in place.

That's awesome.

And I would not— awesome companies. But I realize having been in other companies and more a consultant, not luckily, not that I've been directly involved in, but you're looking at a program where, okay, we have issues and we are righting the ship. We're basically starting to implement processes and the implementation of processes, frankly, I don't see anything that's going to be an operational thing that's going to cause us to shut down and cause imminent risk to the organization of an existential nature.

Well, I think that— but that I think is a great thing because again, I advise organizations and I've gone in and I've had some companies go, "Hey, well, we want to put— we're best in class. We're the world class." And I tell them, "Well, actually you're not." Right? But how you word those external statements, whether it's your security policy, whether it's your filings to the SEC, really matter. It's okay to say, hey, we have a developing cybersecurity program. It's good. We believe it's at least at peers. It's not where we want to be. We are working on a number of critical issues and we expect to be working on them for a while in alignment with our business goals. We do not believe at this time that they are critical enough to cause material damage or issues. Right? We have responsible parties and we're moving forward. That's a great discussion if you are having with a vendor, you're signing off on something or your cyber insurance has a questionnaire and you have to answer it. Instead of saying checkbox, oh, we have strong passwords all through the company. When you really know you're at about maybe 85%. The right answer is to say, we're at 85% with our goal being 99% by end of quarter or end of year or next decade or whatever. It's about being forthright. And nobody expects bulletproof security. I don't, and I've been in companies that spend billion, billion dollars on security, right? No, nobody expects perfect security, but you do have to convey reasonable limitations and work in progress. And it, you know, it sounds like you would do it. All my other CISO peers that I know of that are ethical and do exactly the same thing, right? There's wiggle room. If you go in and put on a document, we're solid. No, we, we're not hacked.

See, and again, here's where it comes down to I think part of the problem, especially when we're talking about SEC filings, and this is where I guess it's the empathy for a CISO. Now, are you saying, and frankly, I don't know if you've ever filled—

We're going to have this too when we talk about empathy for a CISO. They've got a job to do. I know it sucks. I know it's impossibly hard, but they got a job to do.

No, this is where— No, I'm going a different way. I'm going a different way than what you think of. So when I look at having empathy for a CISO in the first place, frankly, here's probably where this comes down to, and I know I'm making an assumption here, but Frank, I can't imagine it's not true, where in all likelihood they didn't say, Tim, we need a couple paragraphs for the 10-K. What they likely did was they put a document in front of him, which is industry standard boilerplate garbage for a 10-K, and had him and say, does this look right to you?

Yep. Are we good here?

Are we good here? And then he probably said, well, we have these issues, but doesn't all companies have these issues and so on? And I know I'm making excuses. And the problem is, and here's my problem, I don't want people who are not lawyers, or, and I don't want every CISO to have to get a lawyer for every document that they somehow have to come up with wording for, because I'm pretty, I will bet major money on the fact that Tim did not write whatever the lines were that went into the document that are attributed to him.

Okay, I want to speculate now because I— and it's not that far off from what you're saying here. So if I had to, you know, throw a dart and say, okay, what really happened? And again, I have no inside information, total speculation.

Neither do I. I'm perfectly willing to admit that.

Okay, okay. I would say that the CISO in this case is a competent CISO, right? And what I've seen for being able to do things, Maybe not perfect, right? I've chatted with a former coworker of this particular individual and they had issues, right? And they felt it was systemic. But I think, okay, this person's been around the block. They understand what needs to happen. And in this case, right, when it comes to now the C-suite and the board, you have to file these forms. Hey, we're going to try and get more investment money. We have to file these forms. Great. Well, I can't really put, uh, we just got hacked, or I think we're hacked, or we're working on something. Okay, the boilerplate stuff, as, as you kind of said, hey, this is what the industry normally says, boilerplate, here you go. He may have looked at that and said, you know what, can we make some tweaks? And I'm guessing the finance people and the CEO and everybody said, no, you can't make any tweaks. People will notice that, that will impact our valuation. That will impact— we're just about to secure funding over here. You're going to break our company. And I think there was that social pressure. And as you said before, right, it puts CISOs in between a rock and a hard place. But, you know, we're paid the big bucks to be there and we know our job sucks and we know it's an impossible situation. And I think, again, throwing the dart and just assuming, I'm thinking he said, okay, fine, it probably won't come back to bite me. Go ahead and put that in there. Yeah, we'll keep it general. No, we won't disclose anything. Even though I know it, even though I know it, I'll roll the dice and hope this doesn't blow back in my face. And that was an ethical decision because I think he had the skills to know. Right, you know, what the truth was and what he should be putting in there. But because of the peer pressure and him deciding, okay, I don't want to rock the boat, I, because of the personal issues that it's going to impact my career or whatever, I don't want to go find a new job. I don't, you know, I may love it here, I may love my comfy chair, they have a corner office, I don't know, right? For whatever reason, um, you know, pizza on Thursdays, I love it, so I want to stay here. But he made a decision to sign off on it and say, yep, and I'm going to do it on the quarterly announcements, on the quarterly forms. And now this, this, you know, 8-K form.

Right.

I've got to put it on there. I've already said in the quarterly ones, everything's fine. I hope this doesn't blow back. And he put it on there. And so he has to be held accountable for it in my mind. If, if it's true, this is all speculation. He is innocent until proven guilty. I want to make sure that, you know, we say that again and again and again.

And here's the thing that I more have issues with as well, because again, like I mentioned before, there are a couple issues. Number 1, at what point does a CISO as a cog in an organization, and I hate to say it, they're a cog, they have responsibility and so on, but at what point do you rely upon the people saying this is appropriate. You have disclosed everything to me. And as far as I can tell, despite the fact they say he hid information, they keep reiterating how much he told management to make the company seem guilty. So it seems like he told them everything of note and they allowed him, or for lack of a better term, they allowed those statements attributed to him to go forward.

Yeah. And I think there is more accountability. I'm, I'm with you on that. I think there's more accountability here than just him.

And that's my problem. They're, they're like charging the organization and him when there are other people who had to personally guide him in any organization unless he somehow walked in with his own attorney and like, you know, I, I'm just imagining.

Yeah, that didn't happen. That didn't happen. Yeah, I think there is more culpability here. It's not just him. And, and I would hope that SEC would expand that as they go through all this. And, and but I don't know. Okay.

So yeah, just let me summarize because I know we're closing up because we're been at—

I got another couple of questions for you.

Okay. Well, anyway, I just want to say. Yeah, but anyway, let me just say though, my issue is it sounds like he disclosed everything. And it sounds like from what I can tell, making the assumption, I wouldn't do it personally, but it sounds like making the assumption, he's like, here's what I know. You've heard it. All the people have heard it. Now, can you put it, you know, you're putting it into a document that you want me to, at best, he signed a sub-statement. I mean, looking for things like they're attributing crap, like marketing crap on the website to him. I'm like, Jesus Christ.

Yeah, that's weak.

I mean, that's like lame. And that's— sorry, that's my biggest point where—

fair enough.

Anyway, I'll go on.

Okay. And I know everybody is going to be watching this case because we can speculate all we want. It really comes down to what can you prove in a court of law, what evidence is there, and that is an extraction fact, so on and so forth. So I think everybody's going to be watching that. So I think that'll be interesting. Okay, so if we pivot this because there is a lot of unknowns, we've talked about a lot of challenges, a lot of ambiguity, a lot of imperfections, and yet still a lot of responsibility and accountability on the CISO. So my question to you is based on this coming to the forefront and everybody talking about this, how should CISOs and executive leaders adapt their practices? Is there something they should look at now or something that they should consider changes based on this case coming up, and we had the Uber case before, a little bit different, but this case coming up, and I'm guessing there's going to be other cases in the future the SEC is going to go after. So this isn't a one and done. What should CISOs and executive leaders start to evaluate in their current practices?

So regarding this, because again, I just have the issues of any major organization is going to have ongoing issues. And these ongoing issues, again, it kind of like with the— what was it? All these guidelines are coming up. This is the SEC. Well, actually, it is SEC guidelines coming up of what is a material information.

That comes— that turns on in December here. But yes, I love that one. That's a different conversation. Let's not rat hole on that.

Well, yeah. And that actually kind of is somewhat similar in this case. It's like, what's material to disclose? They were saying, well, there was a pre-legal thing to disclose. You know, I mean, the fact is anything a class action attorney thinks was material to disclose all of a sudden becomes a lawsuit and possibly becomes a crime theoretically. That's one of my problems. But the reality is, if I'm, if I ever take a role as a CISO again in an organization where I'm going to have to sign off on something, number one, make sure you are part of directors and officers insurance.

D&O insurance, yes.

And D&O insurance, that's number 1. Number 2 is, unfortunately, I want to ensure in my contract that I can have an outside attorney help me evaluate anything that I am theoretically putting my signature on going forward. Because if I have—

I like that one.

Yeah, I haven't heard that before.

Trademark. I haven't seen that in contracts either. You may be starting a trend. Right here.

I have a new class action. Attorneys could come out from the sewers and be put into, you know, a noble role in protecting CISOs and stuff.

Wow. Wouldn't that be a change? Okay. Anyway, moving on from that one. What else? What else? What else? So, you know, insurance, private counsel.

I think also fundamentally you have to take good notes. And somehow protect yourself. And it's kind of like if you're taking the notes, don't take notes that describe the problems. Take the notes that say—

Who you've communicated it to and who's accepted the risk. Yeah.

Make sure you put an email that you say, "Hey, there's a problem," or just at least take contemporaneous notes as you're walking out saying, Hey, I informed somebody that, you know, we don't have good access controls on the system. I need more money. They were looking into it. But you put it in there saying, you know, I've documented that we need more money. My problem in this is, okay, so if I say I need more money for better access controls, and then 2 years later there's a breach, it's like, gee, you said you need more money for access controls. You clearly, and then you continued on with it.

Well, well, well, okay, okay. Let's take that because I agree with you. I agree with you and I've always done it in my practice as well. If there was something that did not align with our security objectives, I always brought it up to the right level executives who could accept that risk and say, here's the unacceptable risk. You have signature authority, you have, you know, your fiduciary responsibility to this, whatever. I'm going to document it. You want to accept that risk? That's awesome. And we'll leave it be or we'll put a program in place, but you got to accept it, right? And your password kind of example, hey, you know, we need funding, you're going to come back. It should be, hey, I need funding. And if I don't get it, I have to report this in the quarterly report. It is potentially material and it's going to show up there.

Well, here's my problem. Well, here's the problem, though, and I'm going to keep coming back to this. Let's say I have bad access control on a couple of systems.

Okay.

And you're not going to go ahead and disclose in a public filing, well, I kind of have access controls in systems. They're important, but they're not necessarily critical.

Okay, but—

You're not going to have a whole disclaimer list like here's—

No, no, no. It's not an errors and omission list. But if the previous quarter you said we have great access control because that's what you believe, that's what all the data said. And now something came up and you realize you don't, you should be removing that statement from that filing. You don't have to list we have bad access control, but you shouldn't be stating we still have good access control. Whoa, wait a second. You now have more information than you did last quarter. The problem— information that indicates that you don't, you should—

that comes down to a very fine line. The problem is you could have more than acceptable access control, but not to the standard you'd like. And there's a whole bunch of fine lines of what you really want and what comes up to kind of reasonably acceptable things. And let me bring up another tangent here, but it's kind of relevant. When Peter Zapko left Twitter, he reported a whole bunch of issues that he basically filed as a whistleblower and stuff like that. The problem is he, and this is where you're reading it and it's like, as a CISO, it's like, you know what? Those things aren't great, but at what level are things that are not great overly critical to report to Congress? He has a right to report it to Congress and everything like that. And the fact of the matter is, but I wish those things would not exist, but those things are not necessarily putting Twitter at risk, which is the primary job of a CISO. You know, things should be improved. But if, for example, there is, I'm trying to remember, an Indian spy working inside Twitter, I have no reason to doubt. I mean, France even acknowledged it in every company in the world.

Sure, sure.

Every company has spies in of one form or another if they are a significant company. If you know that, okay, from a purist standpoint, oh my God, that's terrible. You took no action. It's like, then from thinking about from a realistic perspective, from looking at it, where do I put my resources towards? Getting rid of all the spies. I mean, I literally once had a, this is unfortunately a true story. Fortune 30 company, CISO calls me up, who's a friend, says, "Ira, I got a good one for you. China's all over my network. You know how I found out China's all over my network? 'Cause my systems have never been better maintained." And the reason was, was that China had spyware that essentially required the latest version of the operating—

of the operating system would close other back doors. Oh, yeah. Oh, yeah.

They had better security locking out other intruders. They updated to the latest version. They needed the latest versions for their spyware. And the CISO is like, what do I do? Do I know it's theoretically China? He goes, the only thing I know is it can't be my own people. 'Cause they're not the spot.

Okay, there's other systemic problems with this one.

There's a lot of problems, but you know, you're thinking, does he say the organization is up and running, had no significant incidents besides of like the FBI literally came in and said, by the way, there's malformed DNS packets coming out of your network. And that was one thing, but you know, it's like, what is, I go, he goes, what does it mean? I go, it means you're screwed. It basically said, why?

I mean, somebody's exfiltrating data on you, but yeah, okay, sure.

Yeah. And so you have that, but then a CISO is sitting there like, you know what? They're in the network, but they're not harming my network. They're there for—

Yeah, they could be harming your business, right? They could be stealing intellectual property, trade secrets. They could be harvesting and recruiting other people. They could be going downstream to your customers. There's a lot of government people that use Twitter. And so we were very interested when the whistleblower came in and said, hey, they're allowing federal governments or opposing governments to get inside your Twitter feeds for your government employees, even though we say we don't.

And that's 100% accurate. But let me ask you this question. And I know not mine, but Can you tell me most companies do not have a systematic issue where, for example, companies with Chinese manufacturing facilities do not already assume China has access to their networks? And then does the CISO say, "God, we're screwed," you know, because why? We could just basically assume China owns us in China.

That CISO should again be bringing it to the right level to the board probably and saying, "Are you going to accept this risk?" I know you I know you want to have business in China. I know you want the end of that market. Are you willing to lose your IP? You are. You're signing off. And as you said, document the heck out of it.

And you sit there, you go to the people and the people say, well, look, from our— we have run it by the lawyers. The lawyers have determined X, Y, Z, that this is not— even if you are correct, which you don't have definitive proof of, number one, but even if you are correct that all these indications are that China owns our network, are you then going to go ahead and say, well, I want that in the 10-K. And if that's not in the 10-K, do I go ahead and report that? Even though you have government records saying China, this is like from the National Counterintelligence Executive, pretty much says by default companies in China should consider themselves compromised.

Yes. Yes. So there's a difference between listing that, right, which doesn't really make sense, versus going out and making a statement to say we are not, we do not have a problem with this. Those are two different extremes, right? I wouldn't recommend either one. If you know that your network is compromised, don't state that it isn't. And if you, you know, on the other hand, I wouldn't necessarily state that it is unless it's a material issue to you, right? You don't have any facts, you just suspect, expect, okay, then no, don't state that either. But there's a big, big gap in between those. It's not one or the other. You can omit it, right, if it's not material, if you don't have any facts or anything like that. But okay, so back to the question. You said D&O insurance, personal attorney option, which will be sticky for executives. Take great documentation, right? And I'm in for all of these, especially the documentation, and the CISO should be doing that anyways. What else? I've got a couple on my list here.

I'll let you go because I didn't know you'd ask the question. Those were my 3 off the top of my head.

Okay, okay. I would add 2 to what you're saying because I— and I love— I never even thought of personal attorney. So, I'm adding that to the list. To my list, personal list, but you should have a review board, right? And if you are going to have these issues and it goes back to even some of the newer trends with SEC, what's material? Well, in general, companies have a materiality level anyway because they have to report that for other financial or business things. So they already have a materiality threshold. It's absurd to think a company doesn't. They have to report this every quarterly. For the cybersecurity things, you should also have a review board, right? Because it shouldn't just be the CISO that decides this should go in the quarterly report or not. There are certain executives and potentially even board members, right, that need to weigh in on that. Set that up. Have an oversight board. That's one thing I would say. And the second thing I would say, and this is where it gets— I know you're not going to like this. You're not going to like this. This. Um, have an ethics board as well, including a whistleblower program. Okay, ethics board should be able to review these things, and you should be able to go to the ethics board and go, you know what, normally I kind of know where I should be going. In this case, In this case, I'm just, I'm on the fence. I don't want to do anything wrong. I don't want to hurt the company. I'm not sure. Bring in the executives on the ethics board. And again, that's another oversight review.

Well, I'm going to play devil's advocate for you a little bit because when you say the review board, I would highly contend that when Tim Brown took these issues in filing the 8-K, He went to what would normally be the review board, which would've included the COO, CFO, CTO, CEO, EC, whatever O. And they were all sitting around to figure out what to put in that AK. 'Cause I will again put money that Tim Brown did not personally fill out the AK, say, "Yeah guys, don't worry, I got this covered up.

I got this." I agree with you. But again, we're not talking to Tim. We're talking to all those other CISOs.

I'm talking to all the CISOs because here's the thing, a good CISO like Tim did would bring these type of concerns, these major concerns to the executive meetings on a regular basis.

Yes.

I mean, in some cases, depending how notable, they bring it to board meetings where a good CISO has their time with the board meetings and organizations that are notable, the CISO has meetings, not regular meeting. Well, they have regularly scheduled meetings, for example, with members of the audit committee. They have, you know, with board members who are there to do fact-finding, and they do personal reports to those people before board meetings happen in large organizations. And if they are not disclosing it, then, then there's a problem. But the odds are, again, I keep coming back to these review boards and then you have an ethics board. I mean, if you need an ethics read after you go to like the C-suite, there's a fundamental problem. This is why I'd rather have— and then the ethics board, frankly—

Checks and balances though. Checks and balances, right?

But I don't— but that's more of a corporate, like, I have never seen a, and correct me if I'm wrong, you've worked in major corporations as well, but I don't know where there's like an ethics committee that then reviews corporate filings before the corporate filings are filed.

No, no, no. But they will address any issue that comes up that potentially could be unethical, right? And for example, at Intel, it wasn't just following the letter of the law. It was ground into us. And Intel had back in the day, 20, 30 years ago, they had one of the best management training programs ever. And I remember going through that and it was just drilled into us. It's not just following the law or the rules or the policies. You need to act so that there is no perception of malfeasance, which is a much higher bar, right? And one of the things that was established as part of all that is to have a separate and independent ethics committee that you could go to confidentially behind closed doors and go, hey, I've got this issue, help me with this, right? And that opened up all sorts of other doors. And it's the difference between management who often look at something and go, with the dollars and cents goggles, can we do something versus the ethics board that takes a step back, says, I'm not going to look at the finances. I want to answer the question, should we do this? And there could be alignment, but there can also be conflict.

I'm not going to disagree in theory that if such an organization exists, it would be wonderful. I am just saying that it is let's just say not necessarily standard practice throughout industry as a whole.

That's why I say, hey, if you can, you know, especially with AI, we're seeing AI ethics boards pop up more and more, more and more.

Well, because my problem, my problem, I guess, with what you're doing based on the question you're asking is what can the CISO do? And you're saying the CISO will create an ethics board? I don't think—

no, no, no, no, no, they wouldn't create it, right? That would be something for the company, right? And CISO could use it, so could anybody else, right? Or anything else can go there to get things quickly resolved, right?

But what I'm saying, for the purpose of what can a CISO— like, if you're going to be a CISO of an organization, what steps do you take? If you're on the point where you have to implement ethics, you're kind of screwed anyway.

I don't know. I mean, if, okay, let's say in this case, the CISO, there was an ethics board. And again, as I was blindly throwing the dart and the CISO says, "Oh, I'm not comfortable with this. I know what is stated in there is not accurate. It could be misleading." I'm just not sure, but all my peers are saying do it, sign off on it, peer pressure. Maybe I do go have a quick chat with the ethics board and say, as an independent audience, right? And typically the ethics board also has a link into the board of directors in some way, shape, or form, right? Escalation, the bat phone, right? Hey, I've got this quandary. Is it just in my mind or is this something? That we should take to the next level, maybe take a pause and look at it from different perspectives. I even get an outside view. I don't know, but he might have been able to go to that board and they might have said, whoa, wait a second. No, we would recommend these words be removed. Right. If it isn't current, remove it. Who knows?

I'm still putting myself in his place. And by the time you're sitting around there, with— you got it. You can't disagree with this. By the time you're sitting around looking at this corporate filing that has been likely reviewed by the CEO, who would suppose— CEO, CTO, if I read the document correctly, who's his boss? The CEO, CFO, chief legal officer, and an army of outside lawyers who are helping them file this. And then, by the way, you know, I know all of you are saying this, kind of makes me feel icky. Can you guys— can I give an ethics review board? By the time you have it, you theoretically assume— and I hate to admit this after I talk about class action attorney— but you kind of assume that the lawyers are there to bring in all concerns for the organization and protect it.

They won't. I've dealt with far too many corporate lawyers that it's, how do we get this done. Well, it's kind of like the question, how do we get something done?

I mean, it's like HR people. Everybody thinks they're there for the benefit of the employees. It's like, no, no resources.

They're there for the company.

Humans as a resource. And these people are there to help manage the human as a resource. In other words, who walks in the door, who leaves the door, and the appropriate efficiency of those people while they're in and out. I understand that, but I'm just saying from a practical perspective, every resource of SolarWinds was probably dealing with this. Every major person was filling this out. And my problem is, again, coming fundamental— Sorry, I know you had another question before we— But it still comes down to, I mean, I see they're walking in In theory, he had the— he was supposed to, I assume, led to believe that he was given the best advice possible on what to say and how to say it, and that they heard everything he said and told him, here's what you should theoretically be doing. Could be wrong, but I sincerely doubt it from having seen these organizations, Simon time and time again. I'll leave it at that, and I don't know if you have another question, but—

No, I don't have another question. I just want to follow up because if we role play a little bit and, you know, I've been put in a position as, you know, head of security and asked to attest to certain things, right? And I knew I wasn't going to do it. Nope, I'm not going to attest to that. That's absolutely not true. "Here's my resignation." And literally had my badge in my hand. Nope, not gonna do it, right? Having an ethics board is actually a sidestep. It's a tangent. It's a resource. Because instead of going, "Boss, F you, not gonna do it. Here's my badge. Find some other patsy," right? I can go, "You know what?" I'm going to bring the ethics board in. Let's have the ethics board because I think there is an ethical issue with you asking me to sign off on this when it's not true. So let's bring the ethics board in and review it before I hand it. And, you know, in the case that I'm talking, I won't get into details. The ethics board came in, very senior managers, very with high clout. They looked at it and said, oh, heck no. That is unethical. No. And why didn't you tell us about this? Well, right. And I didn't hand in my badge. Now, if they would have said, yeah, go ahead and sign it, I would have handed in my badge and I would have walked.

Well, um, so I mean, I fully appreciate what you're saying. Again, really shouldn't— I don't know, I shouldn't talk about Walmart, but put it this way: if anybody mentioned anything they knew was even borderline ethical, the CISO would fire them immediately. You know, there would be no doubt about it. Ethics was embedded in there. And I wish for the sake of the peers that all organizations behave this way. The problem I have and the reason, you know, for lack of a better term, my response to the SEC on LinkedIn was, I'll just use the word guttural. Is because, you know, we're looking at what is the reality of the job of CISOs, of good people being put in positions. Like, I'll give you like an example where I knew I was going to be— there's no polite way to say this— I knew I was going to be fucked in this situation. I was once doing an investigation, bank robbery, and I was like investigating this major bank robbery of a major bank. And what happened was when you're investigating one bank robbery, there's a dozen others that you're going to find along the way. Just once you attach a line analyzer, you're going to see so much you didn't realize was there.

Right.

So anyway, a Friday afternoon, I find a new attack against a bank system which appeared to be somewhat significant. So I go ahead and I call up and I work for a contractor at the time, could figure the stuff out. But anyway. Worked for a contractor at the time. I called up the manager who's managing this thing, big guy, big in the company and everything. And apparently he's with his family in Disney World. I call him up on his cell phone and say, "Found another incident. I need you to report this to the client as soon as possible." He's like, "Sure, no problem." I go up my chain of command directly there. Anyway, come back Friday. So come back, that was Friday afternoon, still work till 10 o'clock at night, catch a plane home and then fly back to New York City, get in another. And then in the morning I get a call from the bank's manager of our effort. And then I go, oh, by the way, so did you look into the thing I found on Friday? And they're like, What thing?

What thing? Oops.

And the woman, she's like, I go, do you know about EFT, blah, blah, blah?

Yes, yes, yes.

She's like, no, I don't. She's like, what did you do with this information? I go, I provided it to so-and-so who said he would contact you immediately. And then she was like, when did you provide this information to him? And I knew I was going to be royally fucked.

Yeah, you're not going to have a good day at that point.

And at that point, I'm like, I'm not lying to a customer to save an asshole's, you know, and frankly, they could have fired the whole company, but I was not going to lie. And I basically said that I was pulled off the project when it was convenient to do so. After most of the work that I was personally wonderful for was done. So anyway, those situations happen where people are asked to do things, but then you have situations where I see my peers surrounded by people who are theoretically as well-intent in their minds as they are, who want to do the right things, and all these people are telling them to do this. You know, if they're basically claiming Tim made these statements and attested to this, and if he made this now, to the extent he was given, I'm assuming lots of guidance on what was right. I'm assuming there was no ethics panel, nor is there likely many ethics panels on companies of the nature of SolarWinds. As an example. And when I step back and think, okay, was getting bad information and with well-intent after he supposedly disclosed everything, where again, the part of my problem with the SEC is they're accusing him of not disclosing information to management while every other paragraph says he disclosed everything else. Um, Yeah, I think at what point does he become really personally liable of having good intent to do as much as he can of the whole plethora of incidents where, well, cybersecurity isn't perfect. It's never going to be perfect. But how perfect, how imperfect? And I know that's a fine line of, or of strange wording, but how imperfect is the point that I'm now lying on a 10-K? Or at least providing guidance. And this is where I think the role of CISO is somebody who is— the problem is somebody who is well-intent, who is doing the best they can with the resources provided, is then taking their guidance and then having to rationalize, okay, I'm not perfect, no company's perfect, but where is this imperfection a problem that is fundamentally makes me a liar and libel. And that means that you have to sit there and like get your own lawyer and say, here's everything that's right. Here's everything that's wrong. You tell me what I'm supposed to do now.

I think coming out of this, we may get more insights on— because you're right. I mean, are you stating what's perfect? Are you stating what's imperfect? It can get difficult. You know, and I think at the end of the day, the SEC is gonna have to prove that there was intentional and willful deceit, right? Deception on behalf of SolarWinds and the CISO specifically to mislead investors. And if it is proven, right, regardless of what's perfect or imperfect, if it's proven there was intentional deception to the shareholders, it's a crime. Right. But I think it's going to be an interesting case that we're all going to be watching. And there may be some nuances that will help us understand that level of imperfection or perfection. I mean, personally, even if you're the worst CISO in the world and you're incompetent, you still need to be honest on the forms. If you're putting something that's dishonest, you should be held accountable. If you're honest and say, yeah, I haven't done jack, we're completely insecure. I've got two squirrels doing all the work and they are not very good at cybersecurity. Okay, great. Right. But at least you're being honest about it.

But again, I need to just— I'm not disagreeing with you. But again, the point where it really becomes vague is the word intentionally deceitful.

Yes.

Was Tim intentionally deceitful for— and I'm going to phrase it this way because this is the best way in his defense to phrase it, because I'm probably— well, maybe this is my assumption, knowing what little I know. What little I know implies Tim believed that he was giving the information that he was told was reasonably accurate given the circumstances he described to the people filling out the documentation, filling out the 10-K, and he believed it was accurate.

I—

and frankly, if that was not the case, the heinous case or the heinous fact of this whole case is He did not do this in a vacuum. It wasn't Tim Brown and SolarWinds as a whole, because SolarWinds as a whole, nobody else gets punished. The company at most gets fined. Tim goes to jail. I don't know if Tim can go to jail. I don't— I'm not sure.

Yeah, I don't think you can go to jail. Yeah.

So if they're not going to put SolarWinds in jail, Tim is the only one they are putting out there And he did not do what he did in a vacuum from even the description that was there that every other paragraph said. And Tim informed his people. They did not charge the CIO/CTO. They did not charge the CEO, all these people who he would have given the information to and so on. Sorry, I'm beating that to death, but it is—

I think it's a good point and I agree with you before. I'll agree with you now. I think there's culpability beyond him, and I would assume so. Again, I don't have any of the facts, but I would, you know, again, bet a large sum of money that there is culpability beyond him. And to single him out is probably unfair unless they can actually prove he had that intent, he acted maliciously, he was a driving force or something to that sort, or, you know, he did it for personal financial gain and they've got some statement from him saying so or whatnot. We just don't know. But I think, and I wanna kind of close up here, I think everybody in our industry is gonna be watching how this unfolds. And I'm guessing there's gonna be a few trick shots, epiphanies or something that may happen here. I don't know. But no matter what happens, I think people are gonna be watching and I think CISOs are going to be a little more nervous and a little more careful, I would hope. I would hope.

Yep. I don't disagree.

Okay. Well, thank you. Thank you so much. And thank you everyone for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders such as Ira, right, on the most relevant and interesting cybersecurity challenges, perspectives, and best practices. Thank you, Ira. Great conversation.