SolarWinds Orion is one of the network monitoring platforms caught in a major supply chain security breach. Here is what your team needs to know. Companies throughout the world use the latest technology and the internet to scale their businesses. The path to success is innovation and expansion. Therefore, keeping up with the latest tech trends will make a massive difference down the road. Every successful company had to build IT infrastructure that is reliable, scalable, and optimized for performance.
In any industry, top competitors run robust IT infrastructure. It lets them store data and applications at scale, access them quickly, and keep server downtime near zero. However, not everyone has the knowledge or expertise to create a reliable IT infrastructure and maintain it. The IT industry has high demand for specialists across multiple sectors. Because of that, many seize the opportunity to develop IT monitoring platforms that help other companies.
One such platform is SolarWinds Orion. Behind it lies the company’s mission to empower all businesses to adopt technology successfully. SolarWinds are some of the best in the industry for providing a wide array of management solutions and IT monitoring. Their knowledge expands in areas such as database performance analysis, network monitoring, cloud technology, and security.
However, even tech companies face issues, and the cause is not always technical. Security breaches are a real threat to any company’s IT infrastructure. Most recently, CISA (Cybersecurity and Infrastructure Security Agency) issued an emergency directive. It tells users to power down SolarWinds Orion Products due to a security breach. Here is what you need to know!
SolarWinds Orion Platform
SolarWinds Orion is one of the most popular products from their line. The Orion suite features six tools. Three cover network work: NetFlow Traffic Analyzer, Network Performance Manager, and Network Configuration Manager. The other three are Server and Application Monitor, Virtualization Manager, and Storage Resource Monitor. All these tools combined offer a complete oversight over applications, network, and storage resources.
The Orion platform gives you the freedom to choose the tools that are most useful for your business. Whether you manage 10 nodes or 1,000, SolarWinds offers solutions that reduce downtime and improve efficiency. The most popular Orion tools include the Server and Application Monitor (SAM) and the Storage Resource Monitor (SRM). The Network Performance Manager (NPM) is popular too.
These tools give you fully customizable dashboards. Users can focus on the metrics that matter most to the business. The Orion platform and other SolarWinds products are entirely modular, so you can integrate other tools into the UI seamlessly. SolarWinds designed its products to scale quickly as your IT infrastructure grows.
SolarWinds Orion Products Security Breach
Digital threats are a real issue nowadays since they can knell even the most robust tech companies. If a company’s IT infrastructure is at risk, it can cause massive revenue losses. In the worst case, it can end the business. Cyber attacks are a real issue. Organizations such as CISA work with partners to defend against today’s threats and to build secure, resilient infrastructures.
What the CISA Emergency Directive Says
CISA issued an Emergency Directive 21-01. It urges all SolarWinds Orion users to power down the products immediately. It also tells them to review their networks for signs of a data breach. The emergency directive comes “ in response to a known compromise involving SolarWinds Orion products that are currently being exploited by malicious actors.”
CISA director Brandon Wales said the directive aims to limit compromises inside civilian networks. He urged all SolarWinds Orion partners to assess their exposure and secure their networks quickly. The directive also told organizations running SolarWinds Orion products to report back by noon once they shut them down.
The Department of Homeland Security issued an emergency directive. It orders all federal agencies to take SolarWinds Orion products offline immediately and report any incident.
SolarWinds published a security advisory while it analyzes the threat. It urges customers to upgrade Orion to version 2020.2.1 HF 1 as soon as possible. However, if an immediate update is not possible, SolarWinds offers a few guidelines to avoid compromise. They include disabling the platform’s internet access, limiting connections and ports to the essentials, and placing Orion behind firewalls.
Impact on SolarWinds MSP Products
Hackers have targeted the tools MSPs (Managed Service Providers) use to manage IT systems for years. This breach, however, did not involve the SolarWinds MSP business. The Orion platform supports the traditional IT infrastructure management business, but it’s not connected to the SolarWinds MSP business. The company says it is not aware of any impact on its remote monitoring and management (RMM) products. It knows of no impact on other SolarWinds MSP products either.
SolarWinds says the Pentagon and all five military branches use its technology. So do the State Department, NSA, NASA, the Postal Service, the Justice Department, NOAA, and the President’s office. SolarWinds reported that the government departments know about these reports. They are taking the necessary steps to remedy any possible issue.
FireEye on SolarWinds Security Breach
The Washington Post reported that hackers breached the U.S. Treasury and Commerce Departments through SolarWinds. FireEye, a security vendor, also suffered a data breach. It remains unclear whether the two incidents connect. SolarWinds disclosed that attackers ran a manual supply chain attack against its platform. The attack was highly sophisticated because it targeted Orion, the network monitoring product.
The breach targeted Orion versions released between March and June of 2020. Some sources also say it came from outside the country. The breach was narrow and extremely targeted. Attackers executed it manually, but nobody named a specific country. A FireEye blog post stated that the attack targeted multiple public and private organizations. It used trojanized updates of the SolarWinds Orion software. The victims remain unnamed, but FireEye is working closely with SolarWinds, the Federal Bureau of Investigation, and other partners.
FireEye’s Own Breach
FireEye soon announced a security breach on its platform. It believes a state-sponsored attack aimed to gain information about firms’ government customers. FireEye reported that the attacker gained access to its internal systems. However, the attacker didn’t exfiltrate data from the primary systems where FireEye stores sensitive information.
However, the attacker managed to steal some of FireEye’s security assessment tools. It is uncertain whether the threat actor is going to use the tool himself or disclose them publicly. FireEye disclosed the hack after the market closed, and its shares dropped about 11%. The Washington Post reported that hackers with the Russian intelligence service attacked FireEye. They also compromised some governmental agencies, such as the Treasury and Commerce departments.
FireEye saw a pattern in the attacks that share common characteristics:
- Attackers used limited malware to avoid detection and complete their mission.
- Attackers inserted malicious code into SolarWinds Orion software updates, which gave them remote access to victims’ environments.
- Attackers blended into regular network activity so defenders would not catch them.
- Threat actors are carefully covering their tracks with a high level of operational security and other tools.
FireEye reported that the data breach took place for months. Many also point to an operation that targeted the State Department and the White House. The hack also prompted a National Security Council meeting at the White House. U.S. intelligence officials worry that hackers might have used a similar tool against other government agencies.
Conclusion – Prepare for the Future
While the SolarWinds Orion Platform has suffered a data breach, many other platforms are gaining ground. The marketplace is competitive, and network, application, and resource monitoring is crucial for business growth.
Even if your organization isn’t running SolarWinds products, it still might not be out of the woods. If a third party or vendor you use runs this software, that vendor could have an infection. And if they have access to your network or systems, attackers could reach your organization through that connection. Even if your organization has a program, it is a good time for an overhaul and improvement.
Volico Data Centers does not use any technology branded or marketed by SolarWinds. No one has identified any product we use as vulnerable or involved in this security incident.
Considering moving away from Solarwinds after the recent cyberattacks?
Contact us today to find out how Volico can help you manage your attack surface. Ask us about this critical threat, its indicators, and mitigation strategies across the global attack surface. Volico can help you identify and mitigate those attacks before it is too late. Reach out if your organization could use our help. Our Managed Security Services include DDoS Mitigation, Managed Firewall, Disaster Recovery, Business Continuity, and more.
• Call: 888 865 4261
• Chat with a member of our team to discuss which solution best fits your needs.
