![]() While that’s good news, sensitive information routinely flows through non-classified systems. Wednesday’s statement said that investigators have no indication that the department’s classified network has been breached. On Tuesday, officials with the National Security Agency, FBI, Cybersecurity and Infrastructure Security Agency, and Office of the Director of National Intelligence issued a joint statement saying that the Kremlin was ”likely” behind the hack, which began no later than October 2019. Private companies including Microsoft and security firm FireEye have also said they were part of this group. Advertisementįurther Reading Bucking Trump, NSA and FBI say Russia was “likely” behind SolarWinds hackSo far, about a half-dozen federal agencies have said they were among those singled out. Only a fraction of the 18,000 customers received a follow-on attack that used the backdoored SolarWinds software to view, delete, or alter data stored on those networks. The attackers then pushed out a malicious update that was installed by about 18,000 of those customers. Investigators believe the campaign started when the hackers took control of the software distribution platform of SolarWinds, an Austin, Texas-based maker of network management software that’s used by hundreds of thousands of organizations. The department has more than 100,000 employees. The hackers, Raimondi said, took control of the department’s Office 365 system and accessed email sent or received from about 3 percent of accounts. Read her full rc.com bio here.Further Reading Russian hackers hit US government using widespread supply chain attackIn a terse statement issued Wednesday, Justice Department spokesman Marc Raimondi said that the breach wasn’t discovered until December 24, which is nine days after the hack campaign came to light. She is admitted to practice law in Massachusetts and Rhode Island. from Loyola University School of Law and her B.A., with honors, in American Studies from Newcomb College of Tulane University. Prior to joining the firm, Linn served as assistant attorney general and deputy chief of the Civil Division of the Attorney General’s Office for the State of Rhode Island. Linn is an Adjunct Professor of the Practice of Cybersecurity at Brown University and an Adjunct Professor of Law at Roger Williams University School of Law. She counsels a range of public and private clients from industries such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine and charitable organizations, on state and federal data privacy and security investigations, as well as emergency data breach response and mitigation. Linn focuses her practice on compliance with all state and federal privacy and security laws and regulations. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chair’s the firm’s Data Privacy and Security Team. Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. If no due diligence is being done, this is a perfect time to start. If your DevOps team is using TeamCity, it may present another risk associated with the SolarWinds incident that has much broader impact on other software development.Ĭheck with your DevOps team to see what kind of security due diligence they are completing on the vendors that are providing the component parts of the software they are developing, including JetBrains. JetBrains is a Czech-based company that developed a product called TeamCity, which Reuters reports is “used by tens of thousands of customers to construct other software.” According to other news reports, the FBI is investigating whether the Russians hacked into JetBrains’ TeamCity DevOps tool in order to infect SolarWinds’ Orion software. The SolarWinds hack is a crucial reminder to DevOps teams to build security into software products, and to complete due diligence on the security protocols regarding the DevOps teams of vendors that make components used by software manufacturers, such as JetBrains. Often, security is not the highest priority for DevOps, as adding security features may affect the performance of the software or add time to the deployment schedule. Development and Operations (DevOps) teams are often pressured by executives and sales teams to get software products completed and out the door and into the market as quickly as possible so the products can generate income.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |