CISO Tradecraft® #246 - Tim Brown on SolarWinds: What Every CISO Should Know
Aug 18, 2025
Tim Brown, CISO of SolarWinds, shares his firsthand experience dealing with the infamous SolarWinds breach, diving into the role of the Russian SVR and the complexities of supply chain security. He discusses the crucial lessons learned regarding organizational communication and the accountability of CISOs in today’s evolving regulatory landscape. Listeners gain insights into the legal challenges faced post-breach, including SEC implications, as well as the immense personal and professional impact such incidents have on cybersecurity leaders.
AI Snips
Chapters
Transcript
Episode notes
Rapid All-Hands Incident Response
- Tim Brown described being alerted by Mandiant on a Saturday and working nonstop for weeks to investigate the compromise.
- He ran dual war rooms, worked through Christmas, and stayed at the office for three intense weeks.
Company As Conduit To Targets
- SolarWinds was used as a conduit rather than the primary target in the attack.
- The adversary aimed to reach specific government agency targets via SolarWinds' distribution.
Downloads ≠ Exploitation
- 18,000 customers downloaded the compromised update, but far fewer executed the second-stage payload.
- Under 100 customers progressed to active exploitation due to network configurations and firewall protections.