What should a board investigate? A board should investigate all of the facts surrounding an incident, including at least what happened, how it happened, and how it was discovered and addressed. Some of the answers will be technical: data produced by software, and actions software took. Other answers will be decisions and actions taken by people. Both are relevant to understanding the incident.
FINDING: Product, Tool, and Control Failure Are All Important, and Rarely Investigated or Reported The CSRB or any other board should not be shy about identifying when tools failed to detect the kind of behavior that they were designed to detect, or prevent the things they were marketed as protecting against. Some of those failures will be that products were designed to resist or detect this kind of malicious activity, and did not. Another failure may be that security was not considered in product development. Those failures may include poor design, difficulty in deployment, configuration, use or response. We know from aviation that each of these can be a contributing factor for real world incidents. There may also have been issues in integration between tools. Analysis by one cybersecurity vendor shows that many common endpoint detection and response tools were circumvented by the adversary in the SolarWinds case.59 We can also assume that many network tools and deception tools also failed to pick up signs of the activity. Discovering and stating the facts around these tool-centered contributing factors should be a component of the final report. Similarly, it is likely that investigations will find that standardized security controls were not properly implemented or that guidance was insufficient. Thus, investigators should pay particular attention to how the implementation of controls failed and make recommendations for clarifying or expanding controls. 59
34
James Haughom, “SolarWinds SUNBURST Backdoor: Inside the APT Campaign,” Sentinel Labs, last modified December 18, 2020, https://labs. sentinelone.com/solarwinds-sunburst-backdoor-inside-the-stealthy-aptcampaign/
Learning from Cyber Incidents: Adapting Aviation Safety Models to Cybersecurity
