Let’s talk about the well-publicized security breaches that have been widespread the past couple months. This story in particular, has been moving so fast. The difference between what we knew in December versus what we know now is a big difference. It's important to watch the information that is coming out on this story and others to understand the entire story and the context.
If we track the story, when we initially found out about the Solar Winds act, everyone was looking and saying they got in through Orion? Well, no, come to find out that they actually got in through four steps in their breach. As the story has continued to unravel, we have found more vectors, that they also compromised two FA products separately, and 30% of the breaches that are now being investigated as part of this Solar Winds wasn't even installed. This story continues to evolve, and we have to remember to not jump to conclusions immediately , but continue to research and learn about what is being found. We are all getting smarter about technology and security so make sure you are getting the whole story as it is always more complicated than we think. Learn more as Dave Sobel and Harry chat about the current breach.
Video Transcription
Harry Brelsford & Dave Sobel 0:03
Hey, Nation Nation back with Dave Sobel in Washington, DC, Dave, we are talking let's let's set the table properly. We are talking in early in early February, and I realized this topic may not publish till March. So I want to be folks, I want to be completely transparent with that. Because I just shared that little secret. How much snow Dave. We're recovering from three to four inches. So it's been good and cold here. Okay. Okay. Well, we're really here to talk about context, right? And a little higher level evergreen conversation about understanding the context of topics. And in this case, I want to talk about well publicized security breaches that were quite widespread the past couple months. And I'll let you get it from there, because you're the context guy. Sure. I mean, this is this is something I mean, I track a ton of this on the show, and I've been tracking a number of stories and look, let's call out the big one, right? Like, there's what they're calling the solar winds hack, right. And, by the way, by the time this, if you're viewing this, you'll want to look at the current state of play on the investigation. That's, that's what I would say you should follow my daily podcast for that. Yeah. But let's talk context, because that story in particular, has been moving so fast. The difference between what we knew in December versus what we know now I'm expecting, again, another month, where we're going to know even more about this. And it's important to watch this stuff to understand the entire bit and understand that I set the context because I'm looking at this and saying like this for me, is this one more step of escalation of this war going on between the good guys and the bad guys? You know, if we track the story, when we initially found out about the solar winds act, right, everyone was looking and saying, Oh, wait, they got in through Orion? Well, no, we come to find out. They actually got in through four steps in their breach of a riot like that potential Riot is that's a seller wins product. It's a product, right? It's their core product. And let's be very clear, right? During the investigation, we learned the MSP product lines completely separate and unaffected, yes or no, initially, we thought they did an investigation they came out that's unaffected. As they as the hackers came in and around, we discovered Not only did they get in, they were very, very sophisticated and they moved strategically, and they use that. But as the story unravels, we find more vectors, they found that they also compromised two FA products separately, come to find out as we're recording right around this timeframe, discover 30% of the breaches that are now being investigated as part of this solar winds wasn't even installed. Yeah. As as we're talking about this we've got another threat actor the the there is suspicion that Russian funded hackers were involved with this turns out looks like also independently, Chinese backpackers, right, this story continues to evolve. And so what I what I've been telling everybody in this space is, look, look, first off, you've got to not jump to conclusions immediately and think you've heard this whole story, you've got to track it. And we're all getting way smarter about technology and security really fast here and that's the bit that I feel like we're the reason we have to be so careful about this and track the whole bit is the stories always more complicated than we think it's way more to learn. And we've got to take a lot of lessons. That's the rant I keep going on is I keep watching solution providers go Oh, like you know, who's doing business with SolarWinds now Aren't you glad now I know.
Dave Sobel 3:53
And I'm looking guy I could swap them for any vendor just any vendor, because somebody might have gone down for another reason it happened to be them and that's unfortunate and you know what, they probably made some mistakes but did any everybody make mistakes? I'm confident of that. And so like we've got got to understand the context so that we can be better about our defense.
Harry Brelsford 4:15
Yeah, and I appreciate you being one of our contributors because I I feel for 21 years with SMB Nation I've been I've really had to work with and not all SMB Nation members right there's there's thinking people inside SMB nation. Yeah, but but but Dave, quite frankly, there's there's non thinkers and it frustrates the heck out of me because it's easy to you know, throw a dart at MS DOS 6.2 it's easy to throw you can always throw a dart right but guys, we're better than that. Right? just slow down. Read READ read. Okay. And be more professional.
Harry Brelsford & Dave Sobel 4:57
If you like. My father gave me a piece of advice early in both my life and in my career, and he liked to do some woodworking and he always said, measure twice, cut once. Yeah, and it's stuck with me like for my entire life is that you know, I take the moment and I measure twice, and then I can execute, right? And then I can cut. So that's why anybody listens to me and knows my stuff. I'm so data driven. And it comes from that, that methodology is the fact that I want to just make sure I've measured it. I've thought about it from two angles. But by the way, the reason I preach this methodology and I talk about context and being thoughtful is I think people that do that overperform, right, those of us that we're talking about, like, take a moment and read. Yeah, that's what how you get your expertise and how you differentiate yourself to your customer, and how you really do stand out because you're careful, thoughtful and deliberate. I think that makes a huge difference.
Harry Brelsford 5:48
Well, we'll make that the final word, let you get back out there and shovel some snow. So thanks, Dave. And we'll we'll talk to you next time.
Harry Brelsford & Dave Sobel 5:55
Thanks for having me. All right.