The SolarWinds hack is a fundamental challenge, but I went into work yesterday focused on the same basics.

This may be a game-changer for policy and industry, but the essentials are what make the difference here. It revalidates basic visibility and monitoring. Same as before.

I do not see complex networks as they exist today as bastions where you can close your eyes anywhere assuming you're fine.

What if an attacker just compromised Orion with an exploit like a normal attacker? Or pivoted into its memory space from elsewhere?

What's the difference?

You've got to have pretty incredible network segmentation and administrative tiering and insider threat program before this kind of attack is the biggest risk to worry about.

That doesn't mean it's not incredibly serious. But we're failing way worse than this every single day.

This is a hard dichotomy to talk about without sounding dismissive, but I think it's worth bringing up. Be ever more mindful, but keep our foot on the gas on our fundamentals without letting up.

I'm putting some thoughts together, but I can't get over the fact _they didn't even try to infect your network if it looked like you were watching the machine_.

Like, we should be screaming about this. They know this shit works against them.