CISA has released Emergency Directive (ED) 21-01 Supplemental Guidance version 3: Mitigate SolarWinds Orion Code Compromise, providing guidance that supersedes Required Action 4 of ED 21-01 and Supplemental Guidance versions 1 and 2.
Federal agencies without evidence of adversary follow-on activity on their networks that accept the risk of running SolarWinds Orion in their enterprises should rebuild or upgrade, in compliance with hardening steps outlined in the Supplemental Guidance, to at least SolarWinds Orion Platform version 2020.2.1 HF2.
The National Security Agency (NSA) examined this version and verified it eliminates the previously identified malicious code. This version also includes updates to fix un-related vulnerabilities, including vulnerabilities that SolarWinds has publicly disclosed.
Federal agencies with evidence of follow-on threat actor activity on their networks should keep their affected versions disconnected, conduct forensic analysis, and consult with CISA before rebuilding or reimaging affected platforms and host operating systems.
The updated supplemental guidance also includes forensic analysis and reporting requirements.
CISA has also updated AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations, originally released December 17, 2020. This update includes new information on initial access vectors, updated mitigation recommendations, and new indicators of compromise (IOCs).
Although the Emergency Directive only applies to Federal Civilian Executive Branch agencies, CISA encourages state and local governments, critical infrastructure entities, and other private sector organizations to review CISA Emergency Directive 21-01 – Supplemental Guidance v.3 for recommendations on operating the SolarWinds Orion Platform. Review the following resources for additional information on the SolarWinds Orion compromise.
- CISA Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise
- CISA Activity Alert AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
- CISA webpage on the SolarWinds Orion Supply Chain Compromise
What are you searching for?
About Nelsonecom
By helping clients understand digital communications and media we work together to effectively use and leverage the power of the Internet for their business objectives. This could be for sales, transactions, lead prospecting, building awareness, and more. We do both search engine optimization (SEO) and search engine marketing (SEM). Visual design, strategic digital communications and marketing, usability engineering, podcasting, and video are some of the services we offer. Others include eBusiness solutions, transactional processes, and digital media. We also monitor our clients’ sites analytics and make content, navigation, and other visual design recommendations. Our clients include small and medium successful offline businesses for whom we develop and use the online world as a part of their future success. Their industries include health, medical, politics, manufacturing, retail, financial, legal, restaurants, gaming, sports, water filtration, real estate, non-profit, and newly financed start-up ventures. In addition, we form partnerships with particular businesses to sell their products and or services online and via digital media.