{"id":25426,"date":"2021-02-11T17:03:01","date_gmt":"2021-02-11T17:03:01","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2021\/02\/11\/how-the-biden-administration-can-avoid-another-solarwinds-attack\/"},"modified":"2026-08-08T18:13:17","modified_gmt":"2026-08-08T18:13:17","slug":"how-the-biden-administration-can-avoid-another-solarwinds-attack","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/opinion\/2021\/02\/11\/how-the-biden-administration-can-avoid-another-solarwinds-attack\/","title":{"rendered":"How the Biden administration can avoid another SolarWinds attack"},"content":{"rendered":"\n

Like many disasters, 2020\u2032s federal government data breach<\/a> wasn\u2019t the result of any single failure, but the accumulation of compounding failures.<\/p>\n\n\n\n

Top of the list is a failure of communication. Information about the breach, its scope, its damage, and which agencies and organizations were affected has dripped out over the course of weeks. Had companies been required to report cyberattacks in a timely manner, the impacted agencies and other private companies<\/a> might have been able to act more quickly, triggering a whole-of-government federal response to the attack.<\/p>\n\n\n\n

But that didn\u2019t happen, in part because of the failure of government agencies to set out reasonable cybersecurity guidelines for their contractors and suppliers, like SolarWinds<\/a>. Developing appropriate cybersecurity standards that all agencies and corporations should be held to is obviously not an easy task, and one that requires public-private collaboration. But that should be all the more urgent following this attack.<\/p>\n\n\n\n

Even when new rules are in place, the government will have to do a much better job of enforcing them. We\u2019ve seen in some of the Defense Department\u2019s existing cybersecurity standards for the defense industrial base that requirements aren\u2019t always enforced, leaving many, if not most, companies far short of the standards.<\/p>\n\n\n\n

There\u2019s a lot to be done<\/a> and a lot that will be done following this attack. But the need for urgency should be clear: The Biden administration must accelerate these efforts, ensure existing standards are enforced and establish stronger ones.<\/p>\n\n\n\n

News of the breach moved fast, but not fast enough. FireEye was the first company to announce its systems had been breached on Dec. 8, 2020. While investigating that incident, it discovered the SolarWinds supply chain attack<\/a> and notified the National Security Agency. On Dec. 13, the breaches of the Treasury and Commerce departments became public. On Dec. 15, FireEye confirmed that the agencies were victims of the same attack it had experienced, pointing to a SolarWinds Orion software update as the culprit.<\/p>\n\n\n\n

Nearly a week after the issue was first discovered, the floodgates opened as thousands of businesses and dozens of government agencies began to investigate their own systems for signs of intrusion and theft, and remediate the vulnerabilities.<\/p>\n\n\n\t