CYBERSECURITY

Otava Update on the Recent Hack of Government Agencies

Posted12.22.20 by
Carrie Kennedy
Blog

On December 17, 2020 a joint statement from the Cyber Unified Coordination Group (UCG), a joint response group composed of the FBI, CISA, and ODNI, revealed the UCG has “become aware of a significant and ongoing cybersecurity campaign.”

The statement goes on to say “we know this compromise has affected networks within the federal government.” In a coordinated government response to this hack, the Cybersecurity and Infrastructure Agency (CISA)  “remains in regular contact with our government, private sector and international partners, providing technical assistance upon request, and making needed information and resources available to help those affected recover quickly from this incident. CISA is engaging with our public and private stakeholders across the critical infrastructure community to ensure they understand their exposure and are taking steps to identify and mitigate any compromises.”

 Background to the Hack

According to a December 13, 2020 story published by Reuters, the cybercrime, allegedly perpetrated by a foreign actor, was believed to have utilized updates to software from the company SolarWinds, a maker of IT infrastructure management software products. In a December 14, 2020 8-K report to the SEC, SolarWinds reported that of its 300,000+ customers, they delivered communications to 33,000 customers that use their “Orion” network performance monitoring software, the main software believed impacted by the hack. SolarWinds states “[they believe] the actual number of customers that may have had an installation of the Orion products that contained this vulnerability to be fewer than 18,000.”

What Do We Do Now?

With the significant number of businesses potentially impacted, many agencies and vendors are making recommendations for identification, eradication and remediation of this SolarWinds based hack including:

An Advisory From SolarWinds

Kevin Thompson, President & CEO of SolarWinds, Inc issued the following email to customers:

Dear Customer,

You are receiving this email because you are a customer who owns SolarWinds products that we believe, based on our investigations to date, are NOT AFFECTED by the vulnerability in our Orion Platform products identified in our public statements and recent news reports.

We have been made aware of a cyberattack to our systems that inserted a vulnerability within our SolarWinds® Orion® Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1 only. We have been advised that this incident was likely the result of a highly sophisticated, targeted, and manual supply chain attack by an outside nation state, but we have not independently verified the identity of the attacker.

We have scanned the code of all of our software products for markers similar to those used in the attack on our Orion Platform products identified above, and we have found no evidence that other versions of our Orion Platform products or our other products contain those markers. As such, we are not aware that other versions of Orion Platform products have been impacted by this security vulnerability. Other non-Orion Platform products are also not known by us to be impacted by this security vulnerability.

If you aren’t sure which version of the Orion Platform products you are using, see directions on how to check that here. To check which hotfix updates you have applied, please go here.

Products believed to be NOT AFFECTED by this security vulnerability are: (Click here for SolarWinds latest list of known affected products and not known to be affected products)

At this time, we are not aware of an impact to our SolarWinds MSP products, including RMM and N-central. Additionally, we are not aware of any SolarWinds free tools or any of our agents that were affected by this vulnerability.

Our investigations and remediation efforts for these matters are still ongoing, and we will continue to update the Security Advisory page on our website as more information becomes available to us throughout our investigations.

Visit www.solarwinds.com/securityadvisory for more detailed information.

We also encourage you to review the Form 8-K that we filed this morning with the SEC. You can find this filing on the investor relations page of our website and on the SEC’s website.

Security and trust in our software are the foundation of our commitment to our customers. Thank you for your continued patience and partnership as we continue to work through this issue.

Sincerely,

Kevin Thompson
President & CEO
SolarWinds, Inc

Solar Winds and Otava

Otava does not utilize the SolarWinds Orion product in our environment.  However, Otava can provide clients with “denied” logs from firewall or live captures of their traffic, should either be required. Should you require additional information, please consult advisories provided by the Department of Homeland Security, SolarWinds and any other businesses or vendors known to be affected by this hack to determine any potential impact on your business.

Related Articles

Tackling the rising costs of cybercrime and data leakage: The technologies we adopt in business today to increase our competitive advantages and improve business economics: e.g. cloud, IoT, SaaS and mobility, also increase the amount of high-value data that is created. (Read more)

Ransomware Attacks up in 2020, How to Protect Yourself: In terms of a broader security strategy, adopting a zero-trust model can go a long way towards strengthening your security posture. (Read more)

 Cyber Attacks: Dangerous and Expensive Implications: The damage wrought by a cyber-attack can be disastrous. How can you better protect yourself? (Read more)

About Otava

Otava provides the secure, compliant hybrid cloud solutions demanded by service providers, channel partners and enterprise clients in compliance-sensitive industries. By actively aggregating best-of-breed cloud companies and investing in people, tools, and processes, Otava’s global footprint continues to expand. The company provides its customers in highly regulated disciplines with a clear path to transformation through its effective solutions and broad portfolio of hybrid cloud, data protection, disaster recovery, security and colocation services, all championed by an exceptional support team. Learn more at www.otava.com.

Get started with Otava now!

  • This field is for validation purposes and should be left unchanged.