EP1: SolarWinds and the state of supply chain risk Zero Hour Security

I dive into an overview of what we know about the SolarWInds breach. I also discuss my opinions regarding supply chain risk management and were we go from here. Finally I close with some details on what my thought process was in determining if my organization could have detected this.

Sources:

https://rwstgermain.medium.com

https://twitter.com/vinodsparrow/status/1338431183588188160?s=20

https://techcommunity.microsoft.com/t5/azure-sentinel/solarwinds-post-compromise-hunting-with-azure-sentinel/ba-p/1995095

https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/understanding-quot-solorigate-quot-s-identity-iocs-for-identity/ba-p/2007610

https://pastebin.com/KD4f4w5V

https://duo.com/blog/the-beer-drinkers-guide-to-saml