Call us now:
On Friday 16th February the Securities and Exchange Commission submitted a 112 page amended complaint, for the case against SolarWinds. Highlighting, as far as the SEC is concerned, that SolarWinds and its then-Vice President of Security and Architecture, Brown, defrauded SolarWinds’ investors and customers through misstatements, omissions, and schemes that concealed both the Company’s poor cybersecurity practices and its heightened and increasing cybersecurity risks.
The amended complaint is worth reading, it further clarifies the attack vector used by the threat actor, statements made by employees over the security of the product, the companies SDLC and the security of its infrastructure. That may clarify some of the concerns raised over the past months, over the charges against SolarWinds and its CISO.
The case will be watched by many as one that defines further case law for the SEC and cyber. The case raises many questions over what SolarWinds knew about its cybersecurity practices, policies and maturity when making market communications; whether statements made by the company and Brown were materially misleading and if SolarWinds products were insecure, how long did the company and CISO know?
Even if remotely correct one feels the charges raise difficult questions for SolarWinds and its CISO, as a public company providing security solutions to companies globally. Including many government agencies. The trial will provide both sides an opportunity to evaluate SolarWinds cybersecurity risk management, cyber maturity, responses and communications prior to and following Sunburst.
Ted Dziekanowski Brian D. McCarthy Rich Waite, M.Ed. George Sawyer
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberlaw
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7165284420130713600