It is really funny when they call it one of the most sophisticated hacks in history and stuff like that, because it is actually one of the most stupid hacks of all time.
Nothing about SolarWinds or whatever they want to call it is really surprising to me. Except for one thing: how those companies that have forever been lecturing us on how to monitor and secure networks were not able to identify the breach for more than a year. Almost fourteen months.
So the only surprising thing is how they are still able to sell products. How companies are still buying those services. And how the security community is able to easily fool itself again and again, always believing that what has been done is right.
The Result Speaks for Itself
Look at the result. How are they able to protect you if they are not able to protect themselves?
SolarWinds is the result of ignoring the basics of security. The very simple rules that have been around for at least six decades. Nothing about the hack is new. Using insecure gates of the supply chain has been known by the hacker community for decades.
But rather than paying attention to basics, we ignore them. We go after fancy ideas and complex tools. The way we are trying to secure cyberspace is like fertilizing a plant with super strong chemicals when the only thing it needs is watering and moving to shade to protect from harsh 102-degree direct sunlight.
Just Blame Russia!
When are we going to stop blaming Russia?
It is all about us not being able to secure ourselves. It is not really about them being “sophisticated” in hacking. This becomes more obvious when you look at the SolarWinds and FireEye hacks.
Admit the issue and fix it. Rather than showing that Russia is committed to hiring all the hackers in the world to hack you—which is what they imply with SolarWinds and FireEye—it is actually about lack of supply chain security. That is all.
Nothing sophisticated has happened. It is not rocket science. It is pure lack of knowledge of security engineering and lack of fundamental governance. Even though if you go to those targets, they show you pages of credentials and shiny stuff.
Like I always say, the best indication is to see the results, not the fluffy claims.
The Supply Chain Blind Spot
Here is the thing: supply chain security is not new. It is not complicated. It is not something that requires sophisticated tools or any of the other buzzwords that vendors like to throw around.
Supply chain security is about knowing who you trust, what you are getting from them, and how you verify it. It is about understanding that the code you deploy comes from somewhere. It is about checking the integrity of what you bring into your environment.
Giving a vendor a contract does not mean they are secure. Giving a certification does not mean they are secure. The only thing that matters is the actual controls they have implemented and actually practiced.
The Six-Decade Problem
Let me be clear: the security principles that would have prevented SolarWinds have been known since the 1960s.
Least privilege. Separation of duties. Defense in depth. Change management. Secure software development. These are not new concepts. They are not secrets. They are the foundation of security engineering.
But we have decided they are boring. We have decided they are not exciting enough. So we chase the shiny object—the next tool, the next framework, the next “revolutionary” approach.
Meanwhile, the hackers keep using the same old techniques. And they keep winning.
The Credential Theatre
You know what really gets me? The vendors who got hacked had pages of credentials. They had all the certifications. They had all the compliance checkboxes checked. They had all the fancy security products. But none of that mattered.
Because security is not about what you claim. It is about what you actually do. It is about whether you follow through on the basics. It is about whether you have real controls that you have actually tested and practiced.
Buying security products does not mean you are secure. Having certifications does not mean you are secure. Being a big company does not mean you are secure. Once, one of the “seniors” in our company reacted when I said we needed to check something with Microsoft. She said, “Wait! But that’s Microsoft!” 🙂
The Real Lesson
The real lesson from SolarWinds is uncomfortable. It is that we have been fooling ourselves. We have been believing that if we buy enough products, hire enough consultants, and get enough certifications, we are secure. We have been believing that the fancy solutions are better than the boring ones. We have been believing that big vendors with big names must be doing security right.
But SolarWinds showed us the truth. The big vendors with all the certifications and all the fancy products still got hacked. And they did not even notice for over a year.
The problem is not Russia. The problem is us. It is our failure to focus on the basics. It is our willingness to believe marketing over evidence. It is our refusal to admit that we have been doing it wrong.
What We Should Actually Do
If we want to stop this cycle, we need to do a few simple things:
First, stop blaming the attacker. Yes, Russia did the attack. But focusing on them distracts from the real problem. The real problem is that our defenses were weak. We left the door open. We made it easy.
Second, focus on the basics. Supply chain security. Least privilege. Defense in depth. Secure development. These are not exciting. They are not new. But they work.
Third, demand evidence. Not claims. Not certifications. Not marketing. Evidence. Show me your tabletop exercises. Show me your incident response drills. Show me the artifacts from when you actually tested your controls.
Fourth, admit when you are wrong. The security community needs to stop defending the indefensible. When a vendor gets hacked after a year of undetected compromise, that is not sophisticated. That is failure. We need to call it what it is.
The Bottom Line
SolarWinds is not a story about Russian sophistication. It is a story about our own negligence.
We have been ignoring the basics for decades. We have been trusting marketing over evidence. We have been blaming others for our own failures. And until we stop doing that, we will keep having SolarWinds over and over again.
The next time someone tells you about a “sophisticated” hack, ask them one question: What basic security control was missing? Because I promise you, there was one. And it was probably something we have known about for many many years.