SolarWinds Under SEC Investigation: What This Means for CISOs and the Cybersecurity Landscape

And the other news rocking the security world.  

The Securities and Exchange Commission (SEC) has charged SolarWinds with failing to disclose cybersecurity problems before a breach by suspected Russian hackers. The SEC alleges that SolarWinds violated federal securities law by not disclosing vulnerabilities that could lead to a hack. It accused SolarWinds and its Chief Information Security Officer (CISO), Tim Brown, of defrauding investors and customers through misleading statements and schemes. The SEC claims that SolarWinds concealed poor cybersecurity practices and increased cybersecurity risks. The agency is suing SolarWinds and Brown for violating securities laws and seeks to hold them responsible for fraud and strip them of any ill-gotten gains. The complaint also accuses Brown of failing to raise or resolve security risks.  SolarWinds has strongly opposed the lawsuit, stating that it maintained appropriate cybersecurity controls and will vigorously defend against the SEC’s action.

VentureBeat got a sense of the industry response.   Experts emphasize the importance of honesty and transparency in disclosing relevant expertise, cybersecurity processes, and history of security incidents. They highlight the need to inform affected parties during a breach and stress the potential legal and regulatory consequences. CISOs are advised to analyze the specific allegations, assess their vulnerabilities, and learn from SolarWinds’ incident response actions to strengthen their cybersecurity posture.

Unrelated and reported just before, SolarWinds is reportedly exploring options to go private again, including a potential sale of the company. This would not be the first time SolarWinds has gone private, as it was previously acquired by Silver Lake Partners and Thoma Bravo in 2016. The company is said to be working with financial advisers to prepare for a sale process expected to start in early 2024.

Let’s start with disclosures.  I worked at SolarWinds from the acquisition of LogicNow in June 2016 until September 2019, and I am still a SolarWinds shareholder. I also worked with Tim Brown during that time.  

This has a lot of CISOs frightened.. and frankly, they should be.  Let’s make an observation.  Solarwinds had a massive breach, and it certainly seems there was a lot done wrong in the organization, and yet no leadership there has been held to account.  

I think two key questions should be asked of CISOs.  First, how much budget do they have, and second, where do they fit in the organization.       If the answers to those questions do not indicate the ability to affect change, then the responsibility is above them in leadership.    A powerless CISO is a red flag, and MSPs should be ready to provide strategic counsel on restructuring for effective cybersecurity governance or note this deficiency in their vendors.