Shoba Pillay and Jennifer Lee on the SEC SolarWinds Enforcement Action
Jan 23, 2024
auto_awesome
Shoba Pillay and Jennifer Lee discuss the cybersecurity and national security implications of the SolarWinds hack, the SEC's enforcement action against SolarWinds and its CISO, challenges faced by companies in addressing cybersecurity and accurate disclosures, SolarWinds' response to the SEC complaint, and the impact of the SolarWinds case on cybersecurity disclosures.
The SolarWinds intrusion showcased the vulnerabilities in software updates, highlighting the need for enhanced protection measures against supply chain attacks.
The SEC's enforcement action against SolarWinds emphasizes the importance of accurate disclosure of cybersecurity risks and raises the potential for increased accountability for CISOs in the future.
Deep dives
Overview of the SolarWinds intrusion
The SolarWinds Corporation, a software as a service company, experienced a cyber attack in which a nation-state-sponsored Russia-based threat actor gained access to its network and injected malware into its software development process. The malware, known as sunburst, was unknowingly distributed to SolarWinds customers through software updates. This allowed the threat actor to gain access to the networks, systems, and data of thousands of government agencies and private sector companies using SolarWinds' Orion software. The intrusion went undetected for several months before being discovered.
Significance of the SolarWinds intrusion from a cybersecurity perspective
The SolarWinds intrusion was exceptionally nefarious as it involved malware being deployed through a software update, a method that is difficult for customers to detect and protect against. This attack changed the landscape of supply chain attacks, demonstrating a sophisticated level of intrusion and highlighting the vulnerabilities present in software updates. The incident exposed the cybersecurity risks faced by organizations and the challenges of protecting against such sophisticated threats.
National security implications of the SolarWinds intrusion
The SolarWinds intrusion posed a significant national security risk as multiple federal agencies, including Treasury, Commerce, and DHS, were compromised. The threat actor had access to sensitive data for months, potentially enabling extensive intelligence collection by a foreign nation-state. The attack, coupled with other threat vectors, could have severe implications for U.S. national security.
SEC's enforcement action and its implications
The SEC filed a cybersecurity-related enforcement action against SolarWinds and its Chief Information Security Officer (CISO), Timothy G. Brown. It is the first time the SEC has issued a company for cybersecurity-related fraud and internal controls failures. The SEC alleges that SolarWinds misled investors by overstating the strength of its cybersecurity practices, referencing claims made in public statements, interviews, and blog posts. The enforcement action highlights the SEC's expectation for accurate and complete disclosure of cybersecurity risks and suggests that CISOs could face increased scrutiny and accountability in the future.
The fallout from the SolarWinds intrusion took a new turn with the U.S. Security and Exchange Commission’s (SEC) decision to file a cybersecurity-related enforcement action against the SolarWinds corporation and its Chief Information Security Officer (CISO), Timothy G. Brown, on October 30 of last year. To talk about the details and significance of this enforcement action, Lawfare Senior Editor Stephanie Pell sat down with Shoba Pillay, a partner at Jenner & Block and a former federal prosecutor, and Jennifer Lee, also a partner at Jenner & Block and a former Assistant Director in the SEC’s Division of Enforcement. They discussed the cybersecurity and national security implications of the SolarWinds hack, what the SolarWinds enforcement action suggests about the SEC’s expectations for disclosure obligations of companies, and whether the SEC or another agency is best suited to determine whether and how SolarWinds should be held accountable. They also discussed larger takeaways and messages sent by the SEC’s decision to charge a CISO in this case.