eacs is aware that there will be many clients who are concerned following the recent reports of a security flaw in the Solarwinds Orion Platform. Since news of this broke, we have been liaising closely with Solarwinds to ensure that we are made aware of any specific risks to our clients. We would like to re-emphasise that eacs does not NOT use the Orion Platform to monitor our clients. eacs’ tool of choice is Solarwinds N-Central, which is a separate product delivered by Solarwinds MSP. Solarwinds’ MSP division is run as a separate organisation and we have received confirmation that there is no evidence that the security incident has affected ANY of the Solarwinds MSP products (of which N-Central is one).
Below you will find the latest update from Solarwinds regarding what happened and the actions which have been taken:
SolarWinds has been made aware of a cyberattack that inserted a vulnerability within a select number of SolarWinds® Orion® Platform software. This relates only to versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1.
SolarWinds has been advised that this incident was likely the result of a highly sophisticated, targeted, and manual supply chain attack by an outside nation state.
How are we addressing the problem?
Based on our investigation to date, we are not aware that this inserted vulnerability affects other versions—including future versions—of Orion Platform products. Other non-Orion products are also not known to be impacted by this security vulnerability. As such, we are not aware that other versions of Orion Platform products or non-Orion Platform products have been impacted by this security vulnerability.
What kind of practices does SolarWinds use to build safe code?
We build all products utilizing a secure development lifecycle, including architectural reviews, static and dynamic code analysis, and open-source analysis.
What are we doing to prevent future incidents moving forward?
Since the vulnerability was discovered, we have reviewed our environment, giving an initial focus on ensuring the security of our build environment, including our source code repositories. We have reviewed the architecture of the build environment, the privileged and non-privileged users that have access to the build environment, and the network surrounding the build environment.
eacs continues to work closely with SolarWinds and Solarwinds MSP and will keep you updated with any further information.