A Successful Solar Winds Investigation

Washington loves commissions and formal investigations. It’s often political blood sport with more heat than light. But some are, on a rare occasion, enlightening, instructive, and sometimes positively prospective with excellent recommended changes for the future.

In the past 20 years alone in the Intelligence arena, I have seen the 9/11 Commission, the Iraq Weapons of Mass Destruction Commission (WMD), Enhance Interrogation review, and the Russian Election investigations.  The WMD was the best of the lot for its forward leaning viewpoint and suggestions and unbiased description of the underlying problems.  

As we embark on one of the first major cyber incident investigations - looking at the Solar Wind debacle -  let me tell you what a hardened observer thinks works and doesn’t work when it comes to these Washington events.

A Systemic Failure, Not Stupid People

First, spare us the public hangings. Yes, Solar Winds was a debacle on the order of the Snowden Affair.  Yes, there were people at Solar Winds, DHS, FBI, and NSA, that were supposed to be monitoring for such attacks.

But, I think you’ll find that they were either overwhelmed with their current responsibilities or dealing with a system not built to handle a new type of attack – not stupid or lazy people, but a systemic failure.  The system was simply not built to deal with the “new, new” and had not adjusted/reviewed its underlying assumptions about the fast-moving cyber world in which we now live.

Second, please do not haul out some sci-fi author, movie writer, or futurist who guessed it right.  Well done them – but their identification of “black swans” is more dumb luck than anything else and a source of distraction from dealing with the problem and fixing the system. DC loves its “stars.”  But they add nothing to the process.

Third, this is the time for quiet, expert forensics and expert reviews - not too many public hearings.  With my 40 years of DC experience, let me tell you that the open hearing, for the most part, are scripted Broadway shows designed to “show off” individuals and occasionally the progress and insights of the committee.  They add little to the process and distract the committee members and staff from doing their job – solving the problem.

Fourth, and this is crucial, figure out fast triage and recommend in tranches best practices to do what needs to be done to stop another Solar Winds – now!  Don’t wait for some big rollout of the practices.  It doesn’t fix the future. It leaves us unnecessarily vulnerable. The triage needs to be done now as you would a wounded person from ambulance to hospital. 

And like all wicked problems - which cyber security surely is - it can only be addressed and solved by people who are not part of the problems. You, investigators, are those people.

Name Names and Act Decisively

And, finally, name and recommend punishment for the perpetrators publicly.  We have a natural tendency to want to be quiet about our capabilities.  A sensible approach. 

But, this incident is beyond the norm - in my opinion close to cyber war - and needs major, directed action.  Not swift action necessarily, but well thought out actions.  Actions that hurt and remind future perpetrators that we will search you out and we will punish you.

I sincerely hope the new investigation works.  We need it to protect our country and show the world we are not cyber suckers.  But forensics, focus, and understanding of the players is what will work if we truly want change.

Ronald Marks is Term Visiting Professor, George Mason University, Schar School of Policy and Government. He is President of ZPN Cyber & National Security Strategies

Image: Unsplash

You Might Also Read:

Solving Mr. Biden’s Wicked Cyber Problem:

 

« Spotless Data
New British Cyber Security Council »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

8MAN

8MAN

8MAN is a leading Access Rights Management (ARM) solution in Microsoft and virtual server environments.

Tukan IT

Tukan IT

Tukan IT provides a data classification and protection solution.

Ability

Ability

Ability specializes in the interception of cellular and satellite communication networks. Use is restricted to authorized government agencies only.

K2 Integrity

K2 Integrity

K2 Integrity is a preeminent risk, compliance, investigations, and monitoring firm - built by industry leaders to safeguard our clients’ operations, reputations, and economic security.

ClearDATA

ClearDATA

The ClearDATA Managed Cloud protects sensitive healthcare data using purpose-built DevOps automation, compliance and security safeguards, and healthcare expertise.

Decision Group

Decision Group

Decision Group are a Total Solution Supplier offering Network Forensics and Lawful Interception tools.

GreatHorn

GreatHorn

GreatHorn offers the only cloud-native security platform that stops targeted social engineering and phishing attacks on communication tools like O365, G Suite, and Slack.

Polish Centre for Accreditation (PCA)

Polish Centre for Accreditation (PCA)

PCA is the national accreditation body for Poland. The directory of members provides details of organisations offering certification services for ISO 27001.

Fairfirst Insurance

Fairfirst Insurance

Fairfirst Cyber Insurance protects your business assets against the complexity of cyber threats.

Pixm

Pixm

Pixm’s computer vision based approach offers a truly unique and effective means to protect organizations from web-based phishing attacks.

eMazzanti Technologies

eMazzanti Technologies

eMazzanti Technologies provides IT consulting services for businesses ranging from home offices to multinational corporations throughout the USA and internationally.

ShieldApps

ShieldApps

ShieldApps comprehensive suite of products is designed to protect your personal devices from privacy threats, including hacking attempts, online tracking, fingerprinting, phishing, malware, and more.

MTI

MTI

MTI is a solutions and service provider, specialising in data & cyber security, datacentre modernisation, modern workplace, IT managed services and IT transformation services.

Nomios

Nomios

Nomios develops innovative solutions for your security and network challenges. We design, secure and manage your digital infrastructure.

Creative ITC

Creative ITC

Creative ITC is a leading infrastructure and cloud enablement company. We design and deliver exceptional managed services and cloud solutions.

PagerDuty

PagerDuty

PagerDuty is the central nervous system for a company’s digital operations. We identify issues in real-time and bring together the right people to respond to problems faster.