In this presentation, the speaker argues that the SolarWinds supply‑chain breach demonstrated how compromising a single IT‑tool vendor can give attackers access to thousands of high‑value targets, making such attacks powerful force multipliers. The speaker emphasizes that the technical and strategic complexity of these attacks limits them to nation‑state actors, but the success of SolarWinds will motivate many more state‑backed offensive groups to pursue similar supply‑chain compromises across a vast ecosystem of software, security products, hardware, firmware, and cloud services. Because no single organization can feasibly audit every vendor’s binaries and updates, the speaker calls on large cybersecurity firms (e.g., Cisco, Microsoft, Kaspersky, FireEye) to prioritize building shared detection capabilities, tools, and processes, and to collaborate on hunting and publicizing compromised vendors. This collective effort is framed as essential to preserve trust in digital technology, protect critical infrastructure, and stay ahead of increasingly sophisticated supply‑chain threats.
Chapters
It is time that our industry evolves our collective capability to be able to detect SolarWinds type of supply chain attacks. Now, SolarWinds showed us that even with a single IT provider, right, that if they get hacked and their products get compromised, they can undermine— the attackers can go after the infrastructure of hundreds, thousands, or even tens of thousands of targets. And in this case, it was, you know, government agencies, critical infrastructure, um, you know, major telcos, you know, huge companies, uh, Fortune 500 companies out there within the US. And that was one company, one supply chain company, an IT tool vendor being compromised. So This is essentially— it's a force multiplier attack, right? You attack one and the rewards are tremendous. Now, that type of an attack, a supply chain attack, is, is not easy. It does scale out, but it is definitely not something that the average hacker can accomplish. The technical overhead, the strategic planning, the patience, the, the lab work, the research, um, it's astronomical. It really is. And for the most part, only nation-states can afford to go down that path or have that wherewithal to really make that happen effectively. But it is possible. SolarWinds has shown us that, right? So we need to understand and we need to be able to adapt. And with the success, if you're looking at it from the attacker's perspective, from an offensive security perspective, the success of SolarWinds and whoever was behind that is overwhelming. I mean, that is something that nation-states, the offensive groups, you know, drool over that kind of capability. And many of them are already going down this path. They have been for a while, but now the rest of them Seeing that level of success, well, that's a motivator, right? So now we're going to have every nation-state that has an offensive type of cyber program, they're going to be looking to be able to compromise one of the thousands, tens of thousands of different IT companies out there, service providers. So that's gonna change the landscape, right? The threats have just increased. And keep in mind, supply chain risks have always been there. We've been talking about them for the better part of a decade. We've known they've been there, but because something like this hasn't bubbled up too much, right, it's easy to, to rank that lower on the risk scale. Well, that's now got to change, and our capability as an industry has to go higher in this space. So with the, again, thousands, tens of thousands of different companies out there who might also be hacked and give that level of access or even more access to a company or to a nation, to governments, we have to change, right? And there's not a single company or organization that can go out there and do that kind of work to be able to assess every single vendor that they have and tear down the binaries and look at the engineering and the architecture and determine whether something's been compromised, not only when they install it, but for every update, for every change throughout its livelihood within the organization. It's just not viable. In reality, it's the cybersecurity companies that probably have the best capability to be able to allocate resources and start to figure that out, to find that next company that's already been hacked and raise it in the news. And as it turns out, it benefits them, right? For a security company to be able to identify that and say, hey, look what we found, look how good we are, that translates into more customers, more revenue, higher prices, all sorts of good things for them their organization, their stockholders, and whatnot. So it makes a lot of sense. And we do see some of the big names out there that are looking into this, but we really need, right, all those big companies that are involved in digital security, whether it's the, you know, the Ciscos of the world, the Microsofts of the world, the FireEyes, the Kasperskys, you know, all those kinds of companies they should be prioritizing, and because they have limited resources too, and, and trying to start to interrogate. And it would be great if they could even work together on something like this. And part of the exercise is not only to identify companies that are currently being impacted this way, that are currently undermined and compromised, but it's also to build the processes and the tools, the overarching capability to make it more affordable, to make it easier as time goes on. This is part of the normal evolution and adaptation of the cybersecurity industry that we have to promote. So this has to happen, and it's not just the IT tools, right? If you think about it, um, the IT tools are definitely going to be targeted, but security products will also be targeted. Think of a nation-state who can undermine and get inside of a security tool that you're using, right? They probably would be able to do even more damage and not be detected for an extended period of time. Hardware and firmware manufacturers, developers, and even cloud services. Again, if a nation-state is able to undermine those one company, potentially hundreds of thousands of victims, top-tier targets, would then be theirs for the picking. So, you know, we need to have the security industry start working together. They need to start pivoting. They should be working on those prioritizations, setting up teams, allocating, starting their hunting processes with the idea of we're going to get better, we're going to develop tools, we're maybe even going to share tools across the board and methodologies to see what works. Because at the end of the day, supply chain attacks are very, very dangerous, and it's something that we need to protect from. We need to protect the trust in digital technology. And when suppliers like this are getting undermined, that trust goes out the window. So for the benefit of all digital technology and for digital innovation and investment, we have to protect trust. So stay tuned because I think we're going to see leaders in the cybersecurity space over the next months and, and throughout 2021 start to put teams together and look at this and come back to the world and say, look what we found, look what we've created, look what we've done to be able to start to detect these types of supply chain attackers across a myriad of different tools and digital services. And that's what we need as an industry. We have to grow, we have to evolve at the same pace as the attackers. So I'm looking forward to see which of those security companies are going to show true thought leadership and help the world. So stay tuned.
