Monday Keynote: Perseverance, Growth and Success. The Sunburst Story from the CISO perspective.
summary
Timeline starts with a Dec 12 notification that tainted Orion builds shipped in three releases, 18,000 downloads but under 100 fully compromised; attackers corrupt the internal build pipeline by swapping a VM template during compile (build-system compromise). Response uses CrowdStrike, KPMG, CISA, DA Piper and FBI, an 8‑K and an RCA published May 2021, long remediation through 2025, SEC charges later dropped, and rebuilt systems with peer‑reviewed pipelines, U2F/UB keys, multiple EDRs and a permanent red team restoring renewals to 98%.
AI-written summary · about
chapters (17)
- 0:00SolarWinds introduction
- 1:05Sunburst incident begins
- 3:36Day one response
- 6:48Partners and agencies
- 9:18Legal and FBI coordination
- 11:45War room setup
- 13:52Leadership during crisis
- 16:23Media scrutiny
- 19:12Attack vector details
- 22:26Recovery focus areas
- 25:14Lessons learned
- 28:01Transparency strategies
- 31:56Stress and recovery
- 37:12Secure by Design
- 42:55SEC investigation
- 53:00Outcome and resolution
- 54:29Q&A
related talks
23mSolarWinds: What Really Happened?
58mWhy Winning In Cybersecurity Means Winning More Everyday
37mKeynote: Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supp...
40mBuilding a CISO Response Strategy to Advanced Threats
12mAs Strong As the Weakest Link: Securing the Software Supply Chain
58mKeynote: What Got Us Here Wont Get Us There
40mInside the Mind of the SUNBURST Adversary
57mInsights and Predictions: What's Next in InfoSec