In this podcast from the Carnegie Mellon University Software Engineering Institute (SEI), Gregory J. Touhill, director of the SEI CERT Division, talks with principal researcher Suzanne Miller about the 2020 attack on Solar Winds software and how to prevent a recurrence of another major attack on key systems that are in widespread use. Solar Winds is the name of a company that provided software to the U.S. federal government. In late 2020, news surfaced about a cyberattack that had already been underway for several months and that had reportedly compromised 250 government agencies, including the Treasury Department, the State Department, and nuclear research labs. In addition to compromising data, the attack resulted in financial losses of more than $90 million and was probably one of the most dangerous modern attacks on software and software-based businesses and government agencies in the recent past. The SolarWinds incident demonstrated the challenges of securing systems when they are the product of complex supply chains.
In this podcast, Touhill discusses topics including the need for systems to be secure by design and secure by default, the importance of transparency in the reporting of vulnerabilities and anomalous system behavior, the CERT Acquisition Security Framework, the need to secure data across a wide range of disparate devices and systems, and tactics and strategies for individuals and organizations to safeguard their data and the systems they rely on daily.
The Power of Fuzz Testing to Reduce Security Vulnerabilities
Protect Your Business from Money Mules
Train for the Unexpected
The Role of the CISO in Developing More Secure Software
Computer and Network Forensics: A Master's Level Curriculum
Introducing the Smart Grid Maturity Model (SGMM)
Leveraging Security Policies and Procedures for Electronic Evidence Discovery
Integrating Privacy Practices into the Software Development Life Cycle
Using the Facts to Protect Enterprise Networks: CERT's NetSA Team
Ensuring Continuity of Operations When Business Is Disrupted
Managing Relationships with Business Partners to Achieve Operational Resiliency
The Smart Grid: Managing Electrical Power Distribution and Use
Electronic Health Records: Challenges for Patient Privacy and Security
Mitigating Insider Threat: New and Improved Practices
Rethinking Risk Management
The Upside and Downside of Security in the Cloud
More Targeted, Sophisticated Attacks: Where to Pay Attention
Is There Value in Identifying Software Security "Never Events?"
Cyber Security, Safety, and Ethics for the Net Generation
An Experience-Based Maturity Model for Software Security
Create your
podcast in
minutes
It is Free