Back
Outfaze Security Team

Outfaze Security Team

SolarWinds: Enduring Supply Chain Security Lessons

SolarWinds: Enduring Supply Chain Security Lessons

In December 2020, CISA directed federal agencies to respond to compromise of SolarWinds Orion software. The malicious update path created a difficult problem: organizations had to identify affected versions, determine whether follow-on activity occurred, and rebuild trust across identity and monitoring systems.

The response was not a simple product removal. In higher-impact cases, attackers could use credentials and cloud access that outlived the original Orion server.

Trusted software opened a long investigation

A signed vendor update could pass through normal software controls. Once inside, selective follow-on activity meant two organizations running the same affected version could have very different incident scope.

Investigators needed historical network, identity, endpoint, DNS, and cloud logs. Short retention or logs stored only in the compromised environment limited confidence about what happened months earlier.

Rebuild trust beyond the first affected server

Inventory vendor software and privileged integrations, limit service-account rights, segment management systems, and monitor unusual authentication and cloud administration. Protect logging infrastructure from the systems it observes.

During response, distinguish exposure, confirmed compromise, and follow-on access. Rotate credentials and rebuild systems based on evidence and current authoritative guidance rather than treating every asset identically.

  • Signed updates reduce risk but cannot eliminate supplier compromise.
  • Service accounts can extend the blast radius.
  • Long log retention supports delayed discovery.
  • Incident scope may reach cloud identity after on-premises access.

Put the lesson into practice

  1. Map high-trust software and integration identities.
  2. Reduce privileges and network reach.
  3. Retain independent identity and network logs.
  4. Exercise a supplier compromise with delayed discovery.
  5. Define evidence thresholds for credential rotation and rebuild.

Related Outfaze guidance

Authoritative sources