go to sections menu

Did you know Solar Winds may be on the grid? Check this out and let us discuss from blog The Technology blog and podcast

This is for the technology blog and podcast Commentary, articles, and podcasts

header picture for Ingegno theme

You are here: article commentary > Did you know Solar Winds may be on the grid? Check this out and let us discuss

Go to Homepage, contents or to navigation menu

Did you know Solar Winds may be on the grid? Check this out and let us discuss

The deadline for regulators to get answers is tomorrow, and I saw this article today although it was written during the end of the year stuff that Cyberscoop published.

The beginning of the article and several paragraphs are as follows.

The North American electric grid regulator has asked utilities to report how exposed they are to SolarWinds software that is at the center of a suspected
Russian hacking operation, and the regulator advised utilities that the vulnerability “poses a potential threat” to parts of the power sector.

The North American Electric Reliability Corp. (NERC), a not-for-profit regulatory authority backed by the U.S. and Canadian governments, said in a Dec.
22 advisory to electric utilities that there was no evidence indicating that the malicious tampering of SolarWinds software had impacted power systems.
But the fact that software made by Texas-based firm SolarWinds is used in the electric sector has made vigilance important, according to NERC.

“At this time, NERC is not aware of any known impacts to bulk power system (BPS) reliability or system outages related to the SolarWinds compromise,” reads
the advisory, which CyberScoop obtained. “However, the presence of SolarWinds Orion Products in the enterprise networks of registered entities exposes
them to the vulnerability and exploitation by the [advanced persistent threat] actor and poses a potential threat to BPS reliability.”

The article goes on to indicate that Cozy Bear or APT 29 are at the center of what is an ongoing investigation. I still don’t want to say for certain that they are to blame, and I don’t want to say for certain that China is to blame. I have a feeling that we are still too early to determine whether or not either party is to blame, although indicators in articles that I’ve published and linked to in the reissue of the show notes from podcast 24 state that Russia is to blame.

What you’ll hear in the upcoming episode of the Security Box, are two segments that talk about Solar Winds, one from the December 15th episode when we found out that Crowd Strike was targeted way back on December 8, 2020. The second, which was part of the last podcast of 2020 in their series, catches up on some of the other stuff that was talked about and speculated. In the reissue of podcast 24, I link to all of the articles that I had read from that time.

Continuing: we take this paragraph which I think is important. It says:

“Supply chain compromises, like SolarWinds, provide illicit and malicious access to OT environments facilitating possible disruption,” said Sergio Caltagirone,
vice president of threat intelligence at Dragos, a Maryland-based firm.

I believe that the supply chain attack is going to be taking on new heights after Solar Winds is done, but how much, we just don’t know.

NERC regularly collects information from utilities in response to cyberthreats. But this particular questionnaire exemplifies how the hunt for information
related to the suspected Russian hacking operation is very much ongoing in the private sector as it is in government.

This is very important information to swallow. We still have a lot to learn, and it is involved in both public and private sectors. Some companies are not coming out yet, while others have.

In a statement to CyberScoop, NERC said it, along with the E-ISAC, the electricity industry’s threat-sharing hub, “continue to monitor the recent supply
chain compromises by advanced persistent threat actors” and their potential impact on the industry.

Did you think you should have started this process when it was only hacks of credit card and other personal data before it came to this? Is this the first supply chain attack of this scale or the first supply chain attack ever? That … I’m not sure.

Finally, the last paragraph says:

“We are working closely with the Electricity Subsector Coordinating Council, the Department of Energy, the Department of Homeland Security, the Federal
Energy Regulatory Commission, our Canadian partners and others, and will continue to collaborate and stay on the forefront of this event,” NERC said. “The
quick response and level of engagement highlights the strong public-private partnerships, which are vital to safeguard the North American bulk power system.”

I hope that you would work with the appropriate people to see how you don’t get targeted and protect yourself and the people you serve in a timely manner.

What to read:

The article has links to other stuff, and you can read further than what I’ve quoted and commented on for this blog.

Informazioni sull'articolo

Did you know Solar Winds may be on the grid? Check this out and let us discuss was released on January 4, 2021 at 2:00 pm by tech in article commentary.
Last modified: January 4, 2021.

Comments (0)

No comments yet.

Leave a comment

You must be logged in to post a comment.

go to sections menu

navigation menu

go to sections menu