In this commentary, the speaker examines the fallout from the SolarWinds supply‑chain breach, highlighting the massive scale (over 18,000 severely vulnerable organizations) and the varied responses across the cybersecurity ecosystem. The talk begins by praising the attackers for their skill, then moves to a series of "leaders and winners" who acted responsibly: FireEye for uncovering the intrusion, CISA for issuing rapid alerts and guidance, Microsoft for partnering with FireEye and deploying a kill‑switch against the malware’s command‑and‑control domain, and SolarWinds for publicly confirming the compromise. The speaker also commends the few companies (FireEye, Microsoft) and government agencies (Treasury, Commerce) that openly admitted to being breached, noting that transparency did not damage their reputations. In contrast, the majority of vendors stayed silent, and a subset of security firms are accused of exploiting the crisis with fear‑based marketing, inflated pricing, and opportunistic service offers. The speaker condemns such practices as unethical. Finally, the commentary closes with a salute to the frontline cybersecurity professionals working around the clock to detect, contain, and remediate the breach, recognizing them as the true heroes of the incident.
Chapters
The SolarWinds hack has had a significant ripple effect on the entire cybersecurity community, with over 18,000 organizations that were identified as severely vulnerable and at the mercy of nation-state hackers. In one blinding moment, the security community realized that some of the biggest and most well-defended companies, many sensitive government agencies, and a good chunk of the nation's critical infrastructure had been at risk for some time. That has set off a flurry of activity. Some organizations have shown leadership from the onset. Most have remained quiet, and a few have decided to take advantage of the fear to sell their wares and pursue profits. First, the leaders and winners. Hackers. This is to the hackers that pulled this off, whomever you are. I hate to say it, but I have to give credit where credit is due. Their skill, patience, and focus have paid off in one of the most broad-reaching hacks that allows mind-boggling access to entire enterprises. So begrudgingly, I say congratulations. Secondly, FireEye must be recognized for the discovery and for alerting the community. This was not an easy find, but when the company found a small string and began pulling, it unraveled something big and resulted in detecting what I believe is the hack of the decade. Thank you, FireEye. You have once again shown why you are one of the best in our industry. Next up is the CISA. This is the U.S. Cybersecurity Infrastructure and, uh, it's Cybersecurity and Infrastructure Security Administration. Yeah, I always get that wrong. Um, and they immediately recognized severity of what FireEye had reported, then quickly published an alert and guidance for those potentially affected. Uh, furthermore, they called for action by all the different government agencies to disable the products very quickly, and they gave a deadline. So well done. I mean, it was timely and with good advice, and that's something not necessarily seen all the time in government circles. So, uh, when you see that, we, we've gotta call that out and, and, congratulate them. The next one is Microsoft, because Microsoft, as an early partner with FireEye, they helped make sense of the Trojan and some of the binaries, and it was really a key player as part of sinkholing the attacker's command and control domain. And they were able to insert a kill switch to effectively neuter some of the malware, giving partial relief to victims. And this is a technique that they pioneered earlier on. It was either last year or the year before, and it's worked well as they've gone after different families of malware. So they were quick in jumping in to help FireEye and very quick into maneuvering all the hurdles to be able to gain control of that domain and then put that kill switch in. So lastly, I wanna recognize SolarWinds. Yeah, I, I know, I know this one's gonna be a tough one to swallow at first, but hear me out. The attackers are pros. Given what they can do, it's unlikely anybody could defend for very long against a persistent and directed attack. Systems get compromised. Now, don't get me wrong, that is no excuse. Listen, your products, your neck's on the line. But here is why you have my admiration. You quickly confirmed the breach and the Trojanized product publicly. That saved a lot of valuable time. And allowed security teams to dive into the necessary forensics within their organization. So for that, thank you. Okay, now on to the quiet majority. Now on the business side, only FireEye and Microsoft readily admitted that they were hacked. Even more impressive is that both of these companies sell security products and services. That was a bold move to come out and admit that their adversaries got the better of them. And there is a risk obviously that it could tarnish the reputation, which it didn't. A few government agencies also had the courage to report their breaches, with the Treasury Department and the Commerce Department being the first to announce it. Several more have since come out, um, you know, adding to an impressively long list. Everybody else in the business world though has remained mostly quiet. And I think they're fearful of repercussions. And this is at a time when the cybersecurity community really needs to be sharing and collaborating the most. I mean, how many large cybersecurity companies were probably hacked? I would imagine quite a few. Yet they haven't stepped forward to be honest and transparent. I, I Acting ethically tends to be easy right up until the point where there might be consequences. So finally, the despicable losers and manipulators. I've already seen the ads from several cybersecurity companies, some of them big players, and they're offering rapid detection or response services. They're indicating that they are experts in this hack and their products are especially capable. Many of those are also claiming that they detect and protected their customers. Rubbish. If you detected it, why didn't you report it? You were just as surprised as everybody else. What you really mean to say is now that it's been detected, you wrote a rule based on what others found to enable your widget or service to now detect it. And that you are following basic containment practices for the initial Trojan. I also doubt that of the known 18,000 companies that are affected, none were your customers. It's time to come clean. Several of these companies have the audacity to offer quick response teams to come out and help victims at what is likely an insanely higher than normal rate. I smell the stench of price gouging, or even better, the fact that there simply aren't enough actual experts to go around, so they're likely sending the B or C team. To customers. This is a fear— this is fear marketing. It's— and it's despicable. It's trying to take advantage of this crisis to pad their year-end revenue figures or sign up more customers to their products. It's misleading, and you should be ashamed. In my book, the only, only FireEye and Microsoft have earned the right to make any such claims. And to date, they haven't done any type of this shady marketing grabs. And for those who are interested, I'm not a customer of their paid security products other than what comes installed by default when you buy the Windows operating system. I'm not paid or compensated by either of them. I have talked to them and their teams and shared insights with them. For many, many times over the years. That and how they've acted in the past week reaffirms my opinion on how smart and professional that they are. Finally, I want to recognize all the diligent cybersecurity folks out there who over the past week have been neck deep working around the clock, many of them not getting much sleep at all, less than normal. Trying to determine if their organization was compromised, and if so, what other damage, tools, and backdoors might have been deployed. You are likely not being recognized, but you are heroes. Much of cybersecurity is about being relentless and adapting to the chaos and ambiguity that we have to deal with. Crisis events like SolarWinds are moments that people show their true mettle. For what it's worth, you have my respect and appreciation. Thank you.
