In the Wake of the SolarWinds Hack, Here’s How Businesses Should Respond

Throughout 2020, businesses, in general, have had their hands
full with IT challenges. They had to rush to accommodate a sudden
shift to remote work. Then they had to navigate a rapid adoption of
automation technologies.

And as the year came to a close, more businesses began trying to
assemble the safety infrastructure required to return to some
semblance of normal in 2021.

But at the end of the year, news of a massive breach^[1] of IT monitoring
software vendor SolarWinds introduced a new complication – the
possibility of a wave of secondary data breaches and cyber-attacks.
And because SolarWinds’ products have a presence in so many
business networks, the size of the threat is massive.

So far, though, most of the attention is getting paid to large
enterprises like Microsoft and Cisco (and the US Government), who
were the primary target of the SolarWinds breach. What nobody’s
talking about is the rest of the 18,000 or so SolarWinds clients
who may have been affected. For them, the clock is ticking to try
and assess their risk of attack and to take steps to protect
themselves.

And because a number of the affected businesses don’t have the
resources of the big guys, that’s a tall order right now.

So, the best many companies can do to take action right now is
to make their networks a bit of a harder target – or at least to
minimize their chances of suffering a major breach. Here’s how:

Begin with Basic Security Steps

The first thing businesses should do is make certain that their
networks are as internally secure as possible. That means
reconfiguring network assets to be as isolated as possible.

A good place to start is to make sure that any major business
data lakes follow all security best practices and remain
operationally separate from one another. Doing so can limit data
exfiltration if unauthorized users gain access due to a security
breach.

But that’s just the beginning. The next step is to segment
network hardware into logical security VLANS and erect firewall
barriers to prevent communications between them (where possible).
Then, review the security settings of each group and make
adjustments where necessary. Even hardening VoIP systems^[2]
are worth doing, as you never know what part of a network will be
used as an entry point for a broader attack.

And last but not least, review employee security practices and
procedures. This is especially important after the rushed rollout
of work-from-home policies. Make it a point to see that every
employee is operating according to the established security
standards and hasn’t picked up any poor operational security
habits. For example, did anyone start using a VPN for free^[3], believing they were
improving their home network security?

If so, they need to stop and receive training to make better
security judgments while they’re still working remotely.

Conduct a Limited Security Audit

One of the problems that businesses confront when trying to
re-secure after a possible network breach is that there’s no easy
way to tell what – if anything – the attackers changed after
gaining access. To be certain, a lengthy and complex forensic
examination is the only real option. But that can take months and
can cost a fortune to conduct. For smaller businesses that aren’t
even certain that a breach even happened to them, though, there’s a
better approach.

It’s to take a limited sample of potentially affected systems
and conduct a simple risk-limiting audit. Begin with at least two
representative computers or devices from each business unit or
department. Then, examine each for signs of an issue.

In general, you would look for:

• Disabled or altered security and antivirus software
• Unusual system log events
• Unexplained outgoing network connections
• Missing security patches or problems with automatic software
  updates
• Unknown or unapproved software installations
• Altered filesystem permissions

Although an audit of this type won’t guarantee nothing’s wrong
with every device on your network, it will uncover signs of any
major penetration that’s already taken place. For most small to
medium-sized businesses, that should be enough in situations where
there’s no clear evidence of an active attack in the first
place.

Engage in Defensive Measures

After dealing with the network and its users, the next thing to
do is deploy some defensive measures to help with ongoing
monitoring and attack detection. An excellent place to start is to
set up a honeypot within the network to give potential attackers an
irresistible target. This not only keeps them busy going after a
system that’s not mission-critical but also serves as an early
warning system to administrators when a real attack does take
place.

There are a variety of ways to accomplish this, ranging from
pre-built system images^[4]
all the way up to more sophisticated custom deployments. There are
also cloud solutions available^[5] for situations where
on-premises hardware is either inappropriate or undesirable. What’s
important is to build a system that monitors for the exact kind of
behavior that would indicate a problem within its environment.

A word of caution, though. Although a honeypot is built to be a
target, that doesn’t mean it should be left completely vulnerable.
The idea is to make it an attractive target, not an easy one. And,
it’s crucial to make sure that it can’t be used as a stepping-stone
to a bigger attack on actual production systems.

For that reason, it’s worth it to engage the services of a
trained cybersecurity professional to help make sure the system
doesn’t turn into a security liability instead of a valuable
defensive measure.

Remain Vigilant

After taking the steps above, there’s nothing more to do but
wait and watch. Unfortunately, there’s no better way to maintain a
network’s security than by remaining ever-vigilant. And in a
situation like the one unleashed by the SolarWinds hack,
businesses, and IT organizations, in general, are at a significant
disadvantage.

That’s because they’re facing an enemy that may or may not
already be within the gates, meaning they can’t fall back on
typical walled-garden security approaches.

So, as 2021 gets underway, the best thing any business can do is
get their security house in order and try to limit the damage if
they’ve already been breached.

It’s more than worth the effort in any case because the current
threat environment is only going to get worse, not better. And the
SolarWinds hack, as serious and wide-ranging as it is, won’t be the
last major security crisis businesses have to face.

So, it’s time to buckle up because the new decade is going to be
one heck of a ride, network security-wise – and it will pay to be
ready for it.