CISA Issues Emergency Directive to Mitigate SolarWinds Orion Code Compromise

The goal of an attacker attempting to capitalise on this code compromise is to gain initial access to an organisation’s systems and maintain that unauthorized access despite typical interruptions to that initial foothold, like changes to access credentials and system restarts.

As more information is released, including patch fixes by SolarWinds, organisations with the SolarWinds Orion platform should consider proactive steps to reduce their exposure to this event:

• Patch – SolarWinds has released a Hotfix for this code compromise, with another expected on 12/15/2020. organisations should continue to monitor guidance from SolarWinds as it releases more information.
• Detection Opportunity – Indicators of Compromise (IOC) have been released, as there are reports of active campaigns targeting private and public organisations. organisations should use these IOCs to update their antivirus and endpoint detection and response (EDR) and scan their assets for anomalies that match the behavior of this exploit. In addition, with the known IP addresses being used for this attack, organisations can block assets from communicating with domains behind these IP addresses.
• Tabletop Analysis – For organisations seeking additional guidance, the MITRE ATT&CK knowledge base lays out a good approach to examine the lifecycle, tools and techniques associated with these types of exploit. Incident management teams should use the MITRE ATT&CK framework to understand the level of protection their organisation has at the various stages of this attack. This is a useful exercise to uncover blind spots that may need to be addressed. For example, the organisation may not have a system or tool to detect lateral movement, which is a technique an attacker would use to move through an organisation’s environment after initial access via this code compromise.
• Identity and Access Management Review – An attacker exploiting this vulnerability is trying to gain initial access, evade detection and move laterally to identify a target or payload of interest. An attacker’s ability to accomplish this goal or to dwell in an environment undetected is critically impacted by the strength of the organisation’s identity and access management (IAM). Elements like privileged access management (PAM), identity federation, session management, services account management, and other core disciplines within an IAM programme all play a crucial role in defending the organisation against these events. This is a good time to evaluate the organisation’s IAM programme and ensure adequate defense in depth against this and similar attack vectors.