Panel Discussing the SEC Case Against SolarWinds CISO

Hello everyone, welcome to CISO Platform. I would like to thank all our speakers today and our community partner Fire Compass for supporting the webinar. Fire Compass is a recognized leader by Gartner in continuous pentesting, red teaming, and attack surface management. Fire Compass is trusted by top 10 telcos, Fortune 500 companies, and also mid-market companies. Thank you so much for supporting this webinar. Today's session is CISO panel on SolarWinds breach, legal implications, and CISO ramifications. I do not want to mention it, but it's a very contextual topic at the moment. And I have multiple, multiple people just reaching out to me to, you know, deal with this and to know how to better protect themselves. Our speakers today are Matthew Rosenquist, Jim Routh, and Michael Reese. Thank you so much for joining us. I think we'll take the audience Q&A in the last 10 minutes of the session after the panel discussion. And today's moderator is Matthew.

Yeah, unfortunately my webcam is not working. I'm not gonna be working today, but that will not inhibit me from moderating this wonderful panel. So let's go ahead and jump into it. Welcome everyone to the live panel discussing the recently announced Security and Exchange Commission's case against SolarWinds and specifically against its chief information security officer. And I'm joined by two fellow cybersecurity professionals, Jim Rouse and Michael Reese. Now Jim has over 22 years in cybersecurity leadership as a CISO board member advisor for companies such as KPMG, JPMorgan Chase, Aetna, MassMutual, and most recently as the Chief Trust Officer for, uh, Siviant. Did I pronounce that right, Jim? Siviant? Uh, Savient. Savient, my apologies. And Michael's got 17 years in cybersecurity and IT as a director, a CISO, adjunct professor, and is currently the CISO of ChargeEPC. Welcome, gentlemen.

Thanks, Matthew.

Thank you, Matthew.

And my name is Matthew Rosenquist. I am your spirited and highly caffeinated moderator for today's discussion. I'm a CISO, cybersecurity strategist, and industry advisor with 35 years in the security industry. And again, I would also like to thank CISO Platform for hosting the community panel today. And we have to ask ourselves, so why are we discussing this case? And the answer is this topic has created a number of heated discussions in the hallways of CISOs across the country and globe, bifurcating the cybersecurity professional community into two opposing groups or camps, if you will. And this is, for For this year, this has been one of the most passionate topics people have just dove into, with one side declaring SEC actions to be an affront to the role of CISOs, essentially unfairly targeting them as scapegoats and making their already difficult job unnecessarily more problematic. And the other side tends to be stating that this is a matter where individuals broke the rules and are being held accountable.. And this case is not necessarily forcing any specific set of security controls onto public companies. So those tend to be the sides. I'm sure we'll cover lots more angles here, but let's get into the debate. But before I do, a couple, a couple of foundational pieces we do need to talk about first to set the stage. The SEC, for those who don't know, is an independent federal administrative agency with the mission of protecting investors and their rights, and that includes making sure there is not unfair market manipulations. This is part of their role and mission, and we're going to be talking about the complaint that the SEC has published. Now, the full 68-page complaint is available on their website, and it provides details on all the different claims, especially the claims of fraud. And for those of you who are interested in a formal definition of what fraud is, take a look at the Penal Code under Section 532, specifically subsection , and it actually talks about what fraud is when it comes to companies and their officials when they're filling out forms and things that they have to do in their official capacity. And lastly, it is very important to note throughout our discussion here that in our justice system all accused are innocent until proven guilty. The SEC prosecution has the burden of proof to establish guilt, and it is up to a judge or jury to decide that fact. We are not deciding guilt today, and we must treat all those accused in this case as simply that— simply accused. Innocent until proven guilty.

Okay.

And with that, let's jump into some questions. And Jim, I'm going to direct this at you first here. Why do you think there's so much, you know, vitriol in this case? I have seen tremendous fear and passion and anger expressed by professionals in our industry. So what's gotten people's goat about this one?

Yeah, I think first and foremost, this is a precedent-setting event, and that, you know, is not uncommon for the enforcement of new regulatory requirements once— because the way, you know, our legal regulatory process works is legislation typically initiates the need for change in regulatory governance, and then the regulators figure out how to enforce that change, and that usually takes years, and there's lots of interaction between the private sector and the public sector to work through the mechanics of how to actually do enforcement, and then the practices that enterprises need to adjust are kind of worked out during that process as well, and there's somewhat of a collaborative effort between the regulator and the private industry to kind of work out the kinks, so to speak, but when there's an enforcement action taken like this, it sets a precedent for how the agency, in this case the SEC, will do enforcement. And in this particular case, we've got a CISO that's basically being reprimanded for not sharing information at the right time around security posture, as well as not sharing the right information on both counts. And the enforcement action against an individual as a CISO, it sets a precedent, and that precedent has ramifications, and that's what's creating a backlash of practitioners saying, ho, ho, ho, wait a minute here. This enforcement action appears to be a bit draconian enforcing on an individual and not necessarily warranted. And then as we peel back kind of the layers, there's some pretty good arguments to support the notion that this is not a precedent that is good for the industry. It's actually a precedent that is negative, has negative consequences to the industry. So some of those negative consequences include potential Chief Information Security Officers interviewing for a CISO role and deciding during the interview process that they're uncomfortable with the potential risk to them as an individual, and they step down and say, take me out of the hat, you know, I'm not interested in, in interviewing any longer. And as a case in point, I I sometimes do some work helping companies bring on CISOs, and I'm doing a consulting engagement right now, and there's a dozen candidates. 2 of the 12 candidates have chosen not to pursue the role simply because they're concerned about their own personal liability, and this case, the SEC's case against Tim Brown and SolarWinds, is used as the catalyst for triggering that response or action. Now, when you're in a marketplace where cybersecurity talent is scarce in terms of the availability of talent and the demand for that talent, that's problematic. That's— and that's probably not necessarily what the SEC was attempting to accomplish, but that is a byproduct of this precedent-setting event. And that creates uncertainty as well as legitimate concern. So if I'm interviewing for a CISO role, I'm much more sensitive to the protection capability offered by the company to protect me as an individual, both from a civil, you know, perspective as well as from a criminal perspective as a result of another precedent-setting case that the FBI and the Department of Justice initiated against the Uber CISO Joe Sullivan, in which they achieved a conviction. So those two cases have changed the landscape, and CISOs are responding and reacting to that. On a second level, if you look at the actual, the 80-page document and what the findings were by the SEC, from my perspective as a practitioner, anytime a Chief Information Security Officer and an operations team within a security operations center interact with criminals, it gets a little bit murky in terms of deciding the right approach to protect the interests of the customers and their data and protect the interests of the enterprise. When I say murky, it's just, it's uncertain, and, and so you have to use judgment, and professional judgment's important, and now all of a sudden the CISO communities need to understand that there's consequences to, at an individual level, for the judgment that's made in interacting with criminals in an operational context. And once again, that's troubling at best. You know, most federal agencies attempt to foster a collaborative, easy flow of information between the private sector and the, and the federal agencies themselves. And actually, our cybersecurity policies as a nation are built on that premise. And this event actually is a bit of a disruptor in having trust and confidence to share information between private and public sectors. So at many levels, it is an unprecedented event that has a ripple effect that we're dealing with as practitioners, and there's no easy answers available. It's just kind of a change in the landscape.

Well, I think we're going to be able to talk about a lot of those different vectors that you mentioned here today, because there are definite aspects of certain accountability and responsibility, right? And that obviously comes to personal choice and therefore personal judgment. You know, we've got very specific claims within the SEC filings, specifically around fraud, and there are very clear legal definitions for that. So there are definitely aspects that I think our community is passionate about. Michael, tell me kind of what you've experienced here. Why do you think people are kind of riled up here?

Yeah, I think you're seeing the division right now of You know, we've always, as CISOs, we've always said we want a seat at the table, right? And in some cases, we've gotten that seat at the table, and look what's happened. Now we have the seat at the table, and a lot of CISOs aren't under the indemnify policy, even though your CEO, your CFO might be, your CISO's not. So your CISO is sitting alone, and we're seeing what can happen. With that. And this is a perfect example. And again, let's, let's make sure we're not being the judge and jury here. We're seeing the filing from the SEC. We see what they have coming to the table. They've kind of put their cards on the table and said, this is what we're going to charge both SolarWinds and Timothy Brown with. You can look at that and say, yeah, man, it's pretty clear that there's some fraud involved here. We haven't seen the other side of that, right? We haven't seen the discoverable items from the— you know, you've seen the prosecution side, but you haven't seen the defendant side. Once you see all of that evidence put together— and, and as forensic investigators, we go out and we, we find the facts and we put the facts on the table. Then the attorneys start dealing with those facts, and they can manipulate and change them and make them kind of go in the favor they want them to go. So again, let's be real careful not to say, hey, we're gonna be judge and jury here, and we just— we find him guilty because of what this SEC filing says. Again, for us at CISOs, we need to be very careful because this is going to be a new precedent. You know, Jim mentioned the whole Uber case with Joe Sullivan. That was a The fact that they said, hey, we're going to hit you with a 3-year probation, and there's statements that were made is we're going to go after and we're going to do harsher penalties in the future. And so I think this is a chance for the SEC to step up and say, now we're going to implement those harsher punishments and we're really going after SolarWinds and Timothy Brown on this. I think we need to be careful and not just what I'm going to call check the boxes. When we're doing our security, um, questionnaires, that SIG that we always have to fill out, everybody just kind of goes through the motions and says, yeah, we're doing this, we're doing this. If you start looking at what the SEC filing is about, it, it really looks like, hey, people were just checking boxes and saying, hey, we're doing this, and they're really not doing it. So it— we're going to have to start really walking the walk and, you know, saying what we're doing and showing that we're really doing it. It's no longer just a verbal, yeah, we did that, we checked the box. It's more than that. It's really coming down to that GRC, governance, risk, and compliance questionnaire, and being really truthful about it because you're going to be held liable. And it's nothing new. It's just, you know, this one kind of went a little wild and the SEC is trying to make an example out of them. I think we're going to have to be careful because it could It could go either way and it could really hurt us as CISOs or it can give us a better foothold and really be able to go and say, we need these extra tools, we need this extra money and really get it. So pros and cons on both sides.

Yeah, you know, I would agree, gentlemen, right? I think this is getting the attention of CISOs and, you know, Michael, as you said, what, for 10, 15 years we've been asking for a seat at the big table, right? We wanted to sit at the big table, but, With that, there comes accountability. And the SEC rules that have been out there for reporting and, you know, being truthful in documentation and protecting shareholders, that isn't anything new. They bring cases against other executives. If a CFO decides to cook the numbers and, you know, put in fake revenue figures to ultimately deceive their investors, well, guess what? The SEC is going to come after them as well. So when we look at, okay, well, if you put in deceiving information in regards to security issues, well, who are you going to come after, right? It's, in this case, it's going to be those people that said, yeah, I want a seat at the big table. I want the C-suite title. It also comes with accountability. So, and I'm not sure if our CISO community is mentally there yet. Yet, because you're right, they may not be covered by D&O or E&O. They may not have, you know, different programs in place for proper documentation and so forth to, or feel empowered to be able to say, no, I'm not going to sign off on something. So I think this as a precedent type of case, I think it will change our industry one way or another, regardless of whether someone's convicted or not. I think it will change the behaviors in our industry hopefully matured in a good, healthy way. And it may require tools, it may just require kind of behavioral changes on the CISO part, but I think it will leave an indelible mark on our community. So, you know, one of the things I want to talk about here is, you know, what are the charges, right? What is actually being stated in there? Because different people throw different things around there. You know, the SEC requires that public companies on a quarterly basis when they're seeking funding and when a material incident occurs, that they're required to file very specific SEC forms, S-1, S-8, 8-K. And these formally attest to these certain aspects that investors or prospective investors, they need that information and they have a right to this information, but they need that information to decide if they want to put their money into the company or keep it in the company. And this is about disclosure and it enables investors to make informed decisions. And generally speaking, right, if you tell the truth on these forms, you're fine. Nobody's going to come slap you on the hand if you're telling the truth. Regardless of what the truth is, right? But the key is to tell the truth so the investors are properly informed and they can make good decisions. If you intentionally deceive investors on these forms, then the SEC can come after you. And in reading this 68-page, you know, complaint, it makes it very clear that the SEC is taking the stand that the company, and especially the CISO, intentionally deceived investors, thereby fulfilling the requirements for the crime of fraud. So are you guys reading something different in, in the declaration or in the, in the complaint than that? Well, there's Jim.

There's two dimensions of the, uh, fundamental— this is simplistic, but there's two dimensions to, uh, the SEC complaint. One is the timing of the notification, and the second is the content of the notification. And you can take it in either order, but those are essentially the two things. The thing to remember, I was a CISO in, uh, six large public companies and every single one of them had policy that at any time information going to a regulator had to be funneled through the legal department. So the general counsel was essentially accountable, responsible for all filings, uh, in any kind of regulatory basis. And any security incident, uh, in terms of notifying the regulator, it had to go through legal. It was actually controlled by the general counsel's office in every—

okay, and there's a question though, or clarification on that, because you said something that kind of raised the hair on the back of my neck here. You said it goes through legal and they're responsible. Now, every lawyer, corporate lawyer I've talked to has said, no, we advise We don't take responsibility. The content is still yours. You're still making the declaration. We will advise you, but we don't own it. Are you saying for the companies you worked for, the attorneys were the responsible parties, or were they simply a pass-through to advise and maybe, you know, make recommendations prior to it being released?

What I'm saying is that the corporate policies clearly defined the responsibility for when to offer information to a regulator and to vet that information that goes to a regulator, so the legal departments controlled the process and were accountable.

Now look, got it, so they were accountable for the process, not necessarily for the content, so they weren't the ones not signing off on the accuracy and legitimacy of the content. They were overseeing the process, getting it from the company to the regulator, correct?

They're also determining when to share information with the regulator, like the notification. So a CISO independently can't say, I'm going to notify law enforcement and I'm going to notify a regulator of a particular security incident. That is not in the that's, you know, in at least in my experience, that's not what the CISO has— is accountable for. The CISO is accountable for bringing that information to the legal organization. And there were very frequent times where I, as a CISO, said, I think we need to tell a regulator, and this is what I think we need to tell them. But that was always vetted and edited by the legal department. The legal department handled the actual notification. My point is that it— the CISO is the one in both the Joe Sullivan case, Uber case, and the SEC actions against Tim Brown. The CISO is the one that's bearing the accountability for when to notify the regulator and what content of information to provide, and that is inconsistent with corporate policy where it clearly states that no one in the company, CISO or anybody else, can notify regulators of security incidents without going through the, you know, the process that's controlled by the legal department.

So, but then that's a policy issue then, right?

It is a corporate— so what this action is enforcing is in a direct contradiction to corporate policies in most major companies.

So then what takes precedent in your mind? Does the federal SEC guidelines take precedent and say, hey, you should craft your policy to be in alignment with it, or does the policy of independent companies take a precedent and say, oh no, follow the policy, ignore even if it's in conflict with the SEC federal requirements?

My point is that the SEC action for enforcement against SolarWinds is inconsistent with the majority of corporate policies today in the notification of a regulator and law enforcement. So, and it's clear that corporate policies are the ones that have to change and adjust as a result of this precedent.

And Michael, do you think there is— this precedent is going to drive companies to change those And I would say they're heavily ingrained. I would agree with Jim that these policies within companies are very heavily ingrained, and in many cases, CISOs are not by default empowered or necessarily given that voice to be welcomed to drive communications to the SEC or to other federal agencies and it's definitely a risk to your career. Do you think it's going to, you know, this precedent, this case is going to change that from the corporate policy perspective?

It absolutely is going to, and we've seen that in other arenas just around. If you take General GRC and some of the things that have come up with privacy acts, it's changed corporate policy because those acts are now acts that you have to follow, and if you don't follow them precisely as the guidelines say, then you're penalized for that. So I think it's good, it's going to force us to change some of the policies within companies. If you look at how this was filed though, one of the interesting things is the Form 8-K has to be filed if there's a breach. So SolarWinds said, hey, we had a breach. They filed a Form 8-K that was drafted by a group of executives, and it spells it out, drafted by a group of executives including Brown and signed by SolarWinds CEO. So if you look at that and say, okay, who crafted this? Who actually checked all the boxes and wrote all the information down in this form? I don't know if you can really say, and we don't see the evidence here, we don't know if that was all Brown who did that. It sure makes it sound like a group of executives did it. Including Timothy Brown. So are you going to go after all those executives now? Because they all— they're all frauding. I mean, if they signed it, they're agreeing to that statement that was written. So I think, again, you've got to be very careful on how you're reading this and what are the actual facts of this case. And we haven't seen them yet. So again, don't, don't just make a conclusion, oh, he's guilty, it says right there. Um, but it's interesting the way the SEC is spelling this out to make it look like, hey, it's all them, it's all them. But I, I don't think the SEC is being very clear about some things.

Well, you know, and I'm going to take a counterpoint on this because if— and, and it would make sense, right, for any corporation, if you're going to file something, especially an 8-K, a disclosure saying, hey, something bad happened, some of the material, this is gonna go to the shareholders, this is an SEC form I would fully expect that there would be every senior executive in that room probably reviewing it because it impacts their business, right? And including the lawyers are definitely going to be in that room and probably even marketing, right, to see how they can spin it. That's part of their job too. But when it comes down to the content, if it were a, let's say, a financial disclosure, right, we're going to have to report our sales drop 50%. The owner of that data, right, the senior-most executive that's responsible for that information is actually the chief financial officer. So if you had to file an 8-K and okay, all the executives come in the room, it would be expected that it's that financial officer who is the expert that is providing the information that should have, in theory, in theory, the loudest voice for credibility saying, hey, well, these are our numbers. And if those numbers are wrong, drastically wrong, right? I mean, I could see why the SEC would go after the chief financial officer in that, in that incident. Now, in this case, we're talking about cybersecurity, right? We all know it's kind of convoluted. It's kind of messy. Not every executive truly understands that. The CISO is that guy or gal, is that expert. Has direct access, and it's their opinion as a senior executive to come in with a statement. And if something's wrong, they should have the expertise to identify it, call it out, and make sure that it does not go into those forms as something that could deceive the investors. That's part of their, their duties. So, you know, on the flip side here, I can see why the SEC would call out the CISO in this case to say, hey, CISO, you were the top dog when it came to reporting the cybersecurity issues. If it were financial, you wouldn't be here. We'd be calling out the CFO. But in this case, it's cybersecurity related. I know it's unusual. I know you may be new in this industry as a CISO community, but guess what? Your feet's on the fire. This definitely falls in your ballpark? I mean, can we— would we agree that it could go both ways? Again, we don't have the data. Just, just as Michael said, you know, we don't have those facts. Maybe he was gone that day. Maybe there was nobody in there from— who knows? Who knows? But, you know, I can see potentially the accountability pointing back. And as Jim said, you know, I think this is, you know, a move by the SEC to show a precedent and put pressure on companies to change, potentially change those policies. I don't know, Jim, what do you think?

Yeah, I think it's— I mean, I can't, you know, predict what is driving the SEC, but, you know, I think what you're pointing out is somewhat reasonable. The content for any kind of security disclosure publicly should come from the experts, and the experts are in the cybersecurity organization, and the cybersecurity leader represents that. So No, I have no qualms about that. That, and I think most CISOs would say, hey, I'm willing to step up to that responsibility. And that's part of the package here, and that's the way it should be. So, so I accept that as kind of one of the responsibilities. But I just want to point out that, you know, it takes two to tango. In other words, the CISO has to convince the legal department on both what information to share and when to share that information. And I don't think that's necessarily a bad thing. I think that there's, you know, some give and take that is probably helpful in protecting the enterprise. But ultimately, in terms of the technical content of the disclosure, that really does fall upon the CISO. And I think most CISOs are willing and ready to accept the accountability for that. Yeah.

And just to add on to your point, I think it's not only legal. I think the CEO has probably more culpability than legal or any other executive other than the CISO this. The CISO provides the information and can make very informed statements and call out, you know, things that are not factual. But at the end of the day, I think the CEO has certain responsibility at being at the top of that pyramid to also make sure that everything that's being said is meeting with their fiduciary duties, is, you know, accurate, and the company is being forthright to their investors, or in this case, also prospective investors. And we're not necessarily seeing this, right? The case is pointed at SolarWinds the company and then specifically calling out the CISO. So maybe there should be more culpability at the top end. Would either of you agree with that, or do you think it's— the SEC filed the case correctly just at the company and the CISO?

This one's going to be a little sticky when it comes to that, because remember, the CEO had just come in, I believe, in 2020, and now they're going all the way back to 2018 and saying this really happened in 2018, was the beginning of this with the whole password issue. Um, and that's where some of the fraud comes in. Well, we didn't know that, and yet here's another document says, oh, we knew, we knew there was the password issue, we knew there were all these different problems. And I think that's what's getting them in trouble right now. You mentioned it earlier, it's a matter of being upfront and being honest. Don't lie when it comes to that, those documentation, because you can't go back and say, hey, I have attorney-client privilege. No, you don't. Those documents went public, so therefore they're going to go and find all those documents that were released that said, hey, we knew about all these different issues But yet the shareholders never knew. So all this was kept internal. So you can't really go to a new CEO who just took over and say, now we're going to blame this on you because you should have known. Well, let's go back. Do you go after the old CEO? So there's a lot of different variables in this to go, you know, who's going to be the scapegoat? And that's really what it's going to come down to. And I think they're both going to have a great defense to put on, both SolarWinds and Timothy Brown. So it's, it's going to be a very interesting case, but let's be careful not to judge it and be the jury up front. But we can take all this information and apply it to what we do at CISOs today, and that really is coming down to you need to do your job, you need to make sure you document stuff. And, and if you have to send that documentation up the line, then do it. And I hate to say it's a CYA, you know, but in some cases that's what it is. I do it all the time. I cover my butt because I don't know what's going to happen. That's, that's just the way we have to do it, and everybody else is doing the same thing. So don't, don't lie on those documents because you're going to get caught eventually.

Jim, do you think there's a wider net of culpability here that the SEC has missed?

Uh, no, no, I don't think there's a wider net of culpability. In fact, um, I think it's probably more narrow. I think they've overextended a bit, uh, in their reach, uh, and their enforcement action. And as I said, I think it's gonna— there's a consequence of doing damage to the entire industry in reducing the incentive to share information early and share, you know, sensitive information with the regulators overall. And I think that's actually not helping resilience across enterprises, it's hurting resilience across enterprises. So You know, I think any regulatory agency has to balance a relationship with the private sector, recognizing the majority of critical infrastructure resides in the private sector, and achieving a level of resilience that is necessary means cooperation and collaboration. And this doesn't foster collaboration or cooperation. It actually constrains it going forward, and that's not a healthy indication for the industry at whole.

Well, let me take an opposing view on that because the SEC's mission, what we pay our tax dollars for the SEC to accomplish, is not to foster CISO communities or, or even be nice to CISOs. It's really about protecting investors. And so I would expect as, as a taxpayer right, that if the SEC has a situation where the tax— or where the investors, the investors are not being properly informed as per their rights, they need to go after it. That's, that's what I want them to do. I don't want them to sit on their laurels and go, ah, you know, maybe that'll be too disruptive to the CISO community. No, you know, I, I want them to go after anybody who is intentionally committing fraud to the detriment of investors. That's their job, right? It's not to handhold CISO communities or to go, oh, poor CISOs, oh, this might be disruptive. This is to identify and prosecute fraud, right?

This is, uh, it's not binary. The decisions and enforcement actions of the SEC are not binary. They're They're judgmental, they're subjective, they're, you know, they're based on established practices and norms. And the established practices and norms are what have to evolve and change to improve resilience. And punitive action against individuals specifically is— it doesn't foster that, doesn't improve that. It actually makes it more difficult. So what I think what you're saying is that from an investor perspective, I want the SEC to be proactive in going after potential criminal activity. I'm not necessarily seeing criminal activity in the information that's been shared so far, and I, you know, being a practitioner, I'm going to reserve judgment until all facts are available, as Michael said, and I'm not gonna automatically blame the practitioner because I know how difficult it is to make the right decisions at the right time at enterprise scale for cybersecurity, both yesterday, today, and tomorrow. So that's my view.

Okay, so let me ask you guys some tough questions here. Right? And let's talk about the specifics of this case, right? The SEC complaint against SolarWinds and CISO. And I'm referring specifically to paragraphs 14 through 17 in the document. So if people want to go look at that, right? The SEC claims, and again, this is claims, they haven't proven it yet, but the SEC claims that the CISO knew of attacks against 3 different customers, one in May 2020, one in October 2020, and the other in December. 2020. Now, after the last attack, the one in December, they then decided to file a Form 8-K disclosure to the SEC. This is the form that basically says something bad has happened, something material here, we need to inform the investors because this can impact them, right? But they failed to disclose that the vulnerability at issue had been exploited over the previous 6 months and impacted 2 other customers, one of which was a government agency. They simply omitted that fact. And so they were only reporting on the December attack, not on the one in May, not on the one in October. Right. So this omission, it seems kind of huge. And I'm thinking investors would probably want to know that. So here's my ugly questions to each of you. And if you don't want to answer, I'm fine with that. But my first question, and Michael, I'll start off with you. If you were the CISO in that situation, right, would you fill out the 8-K SEC form and choose to omit that important information to the shareholders? The fact that you had seen this attack 'other customers going back 6 months.' Would you omit that?

I would not omit that. And I think one of the other problems to that is if you, if you read on the 15th item, it's admitted that he knew it was omitted and made a comment to somebody else, 'Well, I just lied,' in quotes. That doesn't help the case. And I get— that's where, when Jim was talking about intent, right? If you're going to be the bad guy, there has to be intent to what you're doing. This is where I look at, hey, there could be some intent right here if you just take it for face value. Again, I haven't seen the other side. You're saying one side of the story, and we don't know if all— if that's actually in context also, right? Because we're only seeing a little bit blurb, and sometimes they can take things out of order. So until you read everything and you see it all, you really don't know. But yes, from what I'm seeing, I can say yeah, he, he obviously knew. They knew there was an issue prior to this when they filled out the paperwork, and they omitted it. So does that bring intent. It kind of does. I mean, in the legal system it does. You have to still prove it, but you, you can't omit things like that, especially if, if we as CISOs, we want a seat at that table. We have a responsibility now, and that responsibility is to make sure everybody knows what's going on in our security realm. And if that means you have to bring out the old dirty dirt, that's what you have to do. Okay, so good or bad, it doesn't matter. That's our job. That's what we get paid for. We are the SMEs. We're those guys. We're the experts in this arena. They're relying on us to be able to tell them what's right and what's wrong in the cybersecurity world. So we have to do our job.

So Jim, same question to you. You're the CISO in that situation. Would you fill out that AKSEC form and choose to omit the prior attacks knowing, you know, going back 6 months?

So based on the limited information that I have today, I would say no, I'd want to include that information.

There were—

it's obviously related. What I don't know is when Tim knew what he knew, and I also don't know the guidance that Tim was given by his legal counsel that was part of the decision of what to disclose and when, and I don't want to speculate on that. So, fair enough, you know.

Yeah, definitely fair enough. We don't know those facts, and that's going to have to come out in court because, as Michael said, you have to— for fraud, you have to actually show intent. There has to be an intentional deceit on behalf of you in your capacity. So, okay, so then second question, same scenario. If you were a shareholder, right, of SolarWinds at the time, would you want to know as part of that disclosure, because you have a right to be informed, would you want to know that the management of your investment has known about active attacks for 6 months in their primary product?

Jim?

Yeah, what I would want as a shareholder is for the company that's in this case a software company to recognize that software supply chain poisoning, which is the net effect and impact on enterprises, is probably the number one risk to the enterprise from a cybersecurity standpoint, and therefore the right attention, right level of resource allocation, and right level of practice needs to be put in place as part of a response to ultimately the first indication of an incident or a, you know, a breach. And so what I would want to see as a shareholder perspective is actually the response to the event and what lessons learned are being applied to improvement in practice going forward to reduce the probability of similar events in the future, simply because supply— software supply chain poisoning is absolutely critical to any software company, and certainly SolarWinds that sells a lot of frontline protective capabilities from a network perspective to their customers. They— their customers deserve, you know, to know what the response was and what the proactive steps to reduce the probability of that happening in the future are. And that's actually more important than the actual incident information is is to know what the response is. And that's reasonable, I think, from an investor standpoint as well as a customer standpoint.

Yeah, I don't think anybody would disagree with that, right? Understanding how they're going to address this, recognizing the issue. But let me, let me push down a little harder here because we're talking about the 8-K form. The 8-K form is about timeliness of information to the shareholders. And what you were talking about is more of a strategic direction and what we're going to— That may take months or years to truly figure out. The question again is on the 8-K form as an investor.

Maybe months, not years.

Okay. Okay. But would you want on that 8-K form as an investor to be informed that the company knew about the attacks in their products going back 6 months against several different customers in their primary product?

Yes.

Okay.

Last question here, and then I actually want to pivot and get some of your recommendations. And I think this is a no-brainer as well, right? And it's because I'm approaching this from different perspectives, the CISO perspective, the shareholder perspective. If you were actually a customer, right, you had SolarWinds products installed in your system, can we collectively agree that We would also want to be informed from our vendor that yes, not only were they hacked, but they knew of this situation and there were other customers that going back 6 months, you know, as a customer of theirs, I assume we would want to know that information. And if that has to be revealed in an AK, so be it. But is there any disagreement that as a customer, they were probably expected to be informed prior, or at least with complete information?

Yeah, I think that's a reasonable, consistent expectation of customers.

Okay, okay.

All right, so now that we've kind of torn this fun little case apart, where do we go from here, right? It sounds like this is a precedent. It sounds like a message is being sent, whether it's direct or indirect, and It's going to be concerning to CISOs. We've already seen that, and it's probably going to shape future CISOs. So my question, and Michael, I want to start with you here, how should CISOs today adapt? And again, the case isn't decided. There is no conviction. Innocent until proven guilty. But from the perspective of what we're seeing in the news and what we're all discussing as a community, How should CISOs start to adapt? Your thoughts?

Yeah, it's a game changer. It really is. And we can say, oh no, we kind of saw some of this happening and the CISOs, you know, they want a seat at the table, we're going to give them that. It changes the direction of what a CISO is going to be responsible for. And I think Jim had a great point, you know, he's working right now with the company, they're looking for a CISO. You had 2 folks just drop out because of this. It's a liability, right? So you as a CISO have to decide, is that the role that I'm ready to take, take on? Because it's a new role. It's not a role that we all used to have. Yeah, you might have been even an officer of the company as a CISO, but you were never put to your feet to the fire to say, hey, you are liable. For that, for what's happening on the security side. And we know, guys, this, this breach that happened, this wasn't a little bitty breach. This was huge for SolarWinds. I mean, if you start looking at what happened and look at— there were probably hundreds of people in Russia involved in trying to get to the back end of SolarWinds. And it doesn't matter how they did it. If the bad actor wants to get in, they will find a way to get in. So you can't just automatically say, oh, CISOs have to stop everything. We try to stop 100%. That bad actor only has to get in one time. So there's a lot of responsibility on us as CISOs to make sure we're securing our environments. And we've seen since COVID that environment has stretched all the way out to, to homes of our employees. So the terrain is a lot bigger that we have to manage, and we have to know every single asset that's sitting out there. How do you, how do you control something if you don't even know you have it? So it's going to change the game for us. We need to really understand what our environment looks like inside and out, and there's, there's no room for error. I hate to say it because this is what's going to happen as, as a CISO. The difference for me is to make sure you have things documented and you're letting your upper management, your C-suite, your investors know what's going on. Don't— again, don't try to hide it because the truth is going to come out if something happens. They're going to dig in and they're going to dig in deep and find out what really happened. So just again, it's honesty, right? And knowing what's really going on and being collaborative with everybody involved, because that's what it's going to take.

Got it. So it's that mental shift for accountability, responsibility, and you also mentioned, you know, a good documentation process, right? And especially if something comes to court, you do want to have that good documentation to show that you were acting ethically, to show that you were doing the right thing, you were acting, you know, in good faith. Right? And mistakes might get made. It happens. But if you've got that documentation to show, hey, yes, you were acting in good faith, you know, it's, it's kind of tough for somebody to get convicted for fraud when they can show that. So, Jim, you know, how do we change? What should we be thinking about? What's your advice to CISOs as we look forward, even not knowing the resolution of this case?

Yeah, I think there's actually 3 levels of fundamental change that we are seeing and will continue to see going forward from a CISO perspective. The first is that identity access management capability embedded in a DevOps process in a software pipeline is really weak from a practice perspective in the industry today. And there's a whole bunch of drivers and reasons for that, but essentially cloud-first software development is fundamentally different than on-prem software development. And as cybersecurity practitioners, we have to understand the differences and put the right level of controls in place. And it's very, very different in a, you know, cloud-first model. And that's one of the, you know, the impacts of learning from this incident in SolarWinds is that we have to have better identity access management processes to govern access to the software supply chain. And that software supply chain is really cloud-based. And so how we do that is fundamentally different than the way we do it on-prem. So that's a fertile ground for lessons learned going forward as cybersecurity practitioners and certainly as CISOs. The second is that the CISO today, whether enterprise is accepted or not, has and should have more influence over when a security incident is reported to regulators and what the content is. And for the simple reason that, like it or not, the CISO is the one that's being held accountable for. So that should automatically provide, you know, impetus for the CISO to recognize that their say may carry more weight than legal or the chief counsel or in the legal reporting process that's in place in most enterprises today. So there's a fundamental shift that I anticipate seeing as a result of that. And the third, which Michael— the point that Michael made is that CISOs coming into a new organization, they're spending a lot more time today negotiating the indemnification protection that's part of the responsibility, whether it's a company officer position or not. And that's changing the dynamic in the marketplace. So those three things are really happening as a result both of the incident itself in terms of a software supply chain poisoning event, but also in the SEC enforcement of the reporting responsibilities at the enterprise level. So, you know, I see those three changes going forward.

Yeah, and I've had some interesting conversations with the industry, you know, with a number of recommendations. And let me list off 5 here and tell me if you guys agree or if there's a particular one that you guys, you know, think is more valuable or maybe one you think should be off the list. Number 1 is to clearly document the roles and responsibilities of that CISO, right? Are they going to have final say? Do they actually have to sign off on it? After legal reviews and gives a thumbs up, does any minor changes, does it have to go back to the CISO to get approval for these types of disclosures? That'd be one, the clear document of roles and responsibilities. The second, if you're going and getting a job as a CISO, you really should have, you know, D&O insurance and maybe E&O insurance. So we're talking, you know, directors and officers insurance, we're talking errors and omissions insurance. For that, that coverage, that liability coverage. The third, and this actually came— I have to give credit to Ira Winkler. I was chatting with him. He actually recommended to negotiate that the CISO can have a private attorney, their own private attorney, review legal documents before they go out for these public, right, the SEC filings, not necessarily for everything. I thought that would be a fundamental shift. I don't know of any corporation that allows that, but I think that might be a great evolution in our industry to be able to have your own private attorney to make sure that you aren't, you know, in a bad position later on. The fourth would be have an ethics program. I've seen this work actually quite well, even in large organizations. If you have a formal ethics program and an ethics committee that reports up, there may be opportunities and additional pressure to make sure that potentially deceptive information is not inappropriately pushed out to investors. And the last one is, and this goes back to what Michael was saying, make sure there's clear documentation, a clear process of that documentation, especially for these decisions and final content of what's being published in these types of public disclosure forms as part of the SEC. So that would be my list of 5 things.

Does—

do any of these strike you as relevant, important, or a waste of time?

Jim, in terms of having an outside attorney that's hired personally for the CISO to review documents before they go out. I, I don't see that being practical, and I see it being a bit problematic. However, Ivar's point is valid in that a lot of indemnification coverage gives the right and the legal fees paid by the enterprise for legal protection with the same law firm that's providing legal protection to the enterprise., and there might be some cases, it certainly was the case in Uber, where that's a conflict of interest, uh, yes, and so I think there in the indemnification coverage, CISOs should look for coverage for legal defense for them personally, uh, because, you know, Tim Brown needed that, you know, Joe Sullivan needed that, uh, and it was, and it's, and so that should be an independent counsel, it shouldn't be part of the same law firm that's representing the enterprise, because that could in some cases be a conflict of interest.

Yeah, it's a great point. Great point. Michael, any thoughts on those, those 5 areas? Anything resonate with you?

I agree. The only one I was going, wow, this could cause some issues, would be having your own attorney. But in this case, I believe if you go back and read some of the transcripts, They both have the same law firm, it's DLA Piper. So, they're being represented by the same attorney at this point, which may be okay in this particular case. In the Uber case, it would not have worked out to have the same attorney or the same law firm for both. It's definitely a conflict of interest. So, you got to make sure that that's, you know, you're looking at that in play and I'm sure your attorney would— let you know that. No, those are, those 5 are great. I mean, that's what we need in order to move forward.

Yeah, I would concur. The whole private attorney thing, I like it. And, you know, my advice to CISOs is it doesn't hurt asking. I mean, you're going to have to be bold anyway. Start being bold when you're negotiating for the position. You want to make sure it's covered. It doesn't hurt to ask, to float the idea. And depending on the organization, you may want to push harder, right, to make sure that you do have that. And there's probably going to be some barriers on when you can bring in a private attorney. Obviously, um, it's not going to be on every document and everything that you're doing for the company, but definitely on public disclosures. All right, so we're going to open it up. I believe there's some questions here from the audience. What do we have out there?

So the first one says, did SolarWinds and its CISO fail to disclose material cybersecurity risks to investors?

All right, Jim, Michael, we talked about it, but what do you think?

Potentially.

Okay, I've got one potential. Michael, what would you say?

I'm going to say potentially also because it depends.

I'm going to say, and it's another way of saying potentially, but I'm going to say if even half of what's in the SEC complaint is true, I'm going to say yes. If it isn't true or forthright, then I'm going to say, ah, no, you know.

We don't have the full picture. That's true.

Okay, now I'm seeing the questions here. So the second one, did SolarWinds and its CISO ignore repeated red flags about the company's cybersecurity vulnerabilities. And Jim, you started talking about this, right? Especially when you talked about, you know, supply chain issues. And Michael, you talked about, right, nation-state attackers. And I mean, ultimately the audience needs to know what— there were 18,000 potential victims at the compromise of their primary product. Now, not all of them were victimized, but, you know, Jim, I'll start with you. Do you think From a risk perspective, and kind of gets away from the case of fraud, but just from a risk management perspective, did SolarWinds drop the ball here?

Uh, no, I don't have information to support that premise at all. What I would say is that identity access management practice in software development in a cloud-first model across every single enterprise sucks, right? It's inadequate, insufficient, not enough, and that's every enterprise. And so we all have— every enterprise has to step up and deal with that challenge, and that's not necessarily unique to SolarWinds.

Yeah, Michael, your thoughts?

Yeah, we see that across the board, right? And I know Jim used the word DevOps, I'm getting away from DevOps. It's DevSecOps. You have to include security when you start building that product. You've got to understand what that flow of data is. So if something happens, you're right there. So yeah, I think that's the first thing we need to do is make sure at the LT— that software development lifecycle— we know what's going on with there and we're building a software platform that's going to work. And it's gonna be secure. But that starts at the beginning. That starts at the beginning of that DevSecOps. I totally agree with Jim.

Yeah, I'm in line with you guys. The reality is, were there red flags? Yes, but that's our daily job. We're dealing with red flags every single day. And so I haven't seen all the data. I don't know what they knew when they knew it. And so I can't say that, yeah, there were obvious red flags that they should have jumped on. I think there were red flags, but okay, out of the million red flags that we deal with, how did we know that this combination was, you know, something so severe? At the point that the security firms came to them and said, we can definitively show that your product is hacked, which is what happened in December, At that point, they did respond to it. So I do like that fact, but I'm with you guys. You know, it's tough, especially when there's insufficient visibility, insufficient controls, and we do not have good security baked in as part of product development across the industry. It's not just SolarWinds, right? It's, well, unfortunately it's everybody. This is just the state of maturity that we have. Another question came in here. You know, what do you think about a negotiated contract clause that provides protections and rights to private defense. I think we talked about that a little bit. Is that something that should be negotiated when you're taking the job? Do you think, you know, Jim, and you talk with a lot of CISOs here, do you think that's something that CISOs that are currently in the job, is that something that they can, you know, bring up with the CEO or the board to kind of implement retroactively? Is this something feasible or is it just too, you know, sticky as Michael indicated? Oh, can't hear you, Jim. I still can't hear Jim. Can— okay, then I'm going to go to Michael on this one.

I think you can negotiate anything, even if you're already in a CISO position. Either you're taking a new job as a CISO or you're already the CISO. The worst thing that can happen is they say no. So why not try to negotiate something? And again, it could be kind of strange because they may say, hey, we want you to use this particular law firm, and if they're already using it, it could be a conflict. But why not give it a shot? I mean, you're going to go to the table and ask for things, you might as well.

Yeah, the worst case they can say is no, right? And then you've got to make a decision whether you're comfortable with that or not.

Correct.

Jim typed in here and I'll read it for him. Yes, you should discuss this if you are a current CISO. The probability of resolution is not high given the lack of leverage. Yeah, you know, I think he's absolutely spot on there. Absolutely spot on. So that kind of brings us back, you know, when we talk about this D&O and E&O coverage, Do you think this may perhaps change the insurance industry? Do you think the insurers are going to start offering something special, something unique for CISOs because of this demand, because of this case, and they see an opportunity to expand their market? What are your guys' thoughts? Michael, I'll start with you. I think Jim will probably have to type his answer.

I think it's absolutely possible. I mean, look at what happened with cyber insurance. There was not a market, all of a sudden there's a huge market for cyber insurance. It's going to be a tough one because we— I don't think we have enough data to be able to support that right now. As we see, depending on what happens with this case, as we see more and more of them, absolutely there'll be a market for it. I mean, anytime they can drum up a market, they're going to.

I think Jim's still typing here. Oh, so he says the evolution of indemnification coverage originates from Delaware law based on 3 levels. But again, from a business perspective, I would say, generally speaking, if insurance agencies and industry, you know, smell blood in the water and think that they can make a profit, I think they would probably explore that opportunity to increase their overall market. Um, all right, so let me take another question. Do you think senior information security leader role should shift from a CISO to another pre-existing executive officer? Oh, this is a great question. So, you know, we've got CISOs out there, we've got chief security officers. Many times they report into CIOs or CTOs. We've got Chief Trust Officers. Jim's a Chief Trust Officer. So we've seen a growth in the industry of Chief Trust Officers as well, where CISOs may be reporting into. So question goes to you, do you think that the responsibility for all this should transition away from the CISO? And it almost sounds like, hey, you get pushed down to the kids' table. Right? And one of the more senior officers, right, that Chief Trust Officer or that CIO or CTO or whomever it is, that they should own the, you know, accountability and the final say for cybersecurity disclosures in those forms we talked about, right? What do you think, Michael?

I think this could be a division in the road right here, because we've always— and I got to be careful how I was to say— we've always said, look, if a CISO is reporting to a CIO, it's a very gray line, right? It's almost like the fox guarding the henhouse. If you have an issue within your IT department where they're not disclosing something, and you as a CISO report to that CIO, and the CIO is not reporting it, then you've got a problem. You cannot be held liable. That's on the CIO. So now you're, you're underneath that CIO. You really need to be on the same playing field as that CIO. So if that CIO reports to your CEO, your CISO needs to report to your CEO. So again, your peers, you're not under them. This could be that line that finally gets drawn to say, CISO, don't report to a CIO. CISOs don't report to the CFO. They need to report to a CEO or maybe a COO. But I think this is the time to really figure out what does that topology look like in business.

So you think it's time to double down basically for CISOs to have them step up. But as part of that, then they have to truly acknowledge that accountability and potential liability and potential criminal proceedings against them if they make a misstep. So again, that may be, as you said, a fork in the road. Does the CISO really want that accountability? And Jim is chiming in here, he believes that the CISOs will step up to evolving accountabilities and this event will accelerate this trend more than putting responsibility or reporting to another leader. So it sounds like you guys are in alignment here, and it makes a lot of sense. You know, as we said, this is a precedent type of case that's already generating huge amounts of discussion and learning. This, I believe, will evolve or help evolve the CTO role in industry. So that's just fantastic. All right, we are 17 minutes after the hour here. I'm going to wrap this up. I do want to thank both of you. For your insights and CISO Platform for hosting this community panel discussion. I hope everyone listening has broadened their knowledge and perspectives. The cybersecurity industry is challenging enough without additional fear and uncertainty and doubt, and we must all constructively communicate and work through challenging issues just like this together. Thank you all.

Absolutely, thank you so much for this wonderful session. Thank you to all the speakers for, you know, this beautiful, beautiful session. I know we're over time and we were all, you know, really involved in the session. So thank you so much. I'm so sorry, Matthew, we couldn't see you on the webcam, but next time we'll fix that.

I would just scare people, right?

I don't want to look at my face. Never mind, uh, we'll try to see if we can fix it in the recording in some way. Uh, just before we leave, I'd, uh, once again like to thank our speakers and our community partner Fire Compass for supporting the webinar. Fire Compass is a recognized leader by Gartner in continuous pentesting, red teaming, and attack surface management. Patterns is a trusted company by top 10 telcos, Fortune 500 companies, and also mid-market companies. Thank you so much to the speakers, extremely grateful and honored to have you in this discussion. And to all the audience, we were full today. There were people who weren't able to join us, so that is great. It was a very exciting session, and I think it was houseful till almost the end. And now we'll wrap and hope to see you all in another very interesting session, the next one, which we'll plan soon. Thank you so much, Jim, Michael, Matthew, extremely grateful for joining us today. Have a good morning. Bye-bye.