Software supply chain compromises In the 2020–21 financial year, the ACSC observed software supply chain compromises where a malicious cyber actor accesses a vendor’s network and covertly modifies its software. Software exploitation can occur at any point in the software development lifecycle, from the design, distribution and support phases – including via the release of patches and updates – through to the decommissioning phase. After the modified software is released, the actor uses it to access the networks of the vendor’s customers and to conduct follow-on malicious activities. While software supply chain compromises can be difficult to detect and defend against, there are measures that can minimise their impact. These include assessing the risks a vendor introduces to networks and reviewing internal and external network security vulnerabilities to prevent third party access to systems. Once detected, mitigation can be particularly challenging, as the malicious actor has often been able to develop pervasive access to a range of victims over an extended period of time. The ACSC recommends organisations plan for incident response in the event of a software supply chain compromise. Supply chain compromises present a high-impact cyber threat that will only increase as networks continue to incorporate more third-party software. Supply chain compromises will largely remain within the purview of advanced state-sponsored actors and likely concentrate on high-value targets that are not as susceptible to simpler methods of compromise. However, skilled cybercriminals may also increasingly focus their efforts on supply chain exploitation as a means of compromising many victims at scale. Case Study: Multiple global victims following Russia’s SolarWinds Orion software compromise In December 2020, Mandiant publicly announced a ‘highly skilled actor’ was conducting a global intrusion campaign enabled by the compromise of the SolarWinds Orion platform software. SolarWinds is a US software firm which produces a wide range of IT infrastructure monitoring and management tools. The compromise meant that organisations running SolarWinds Orion platform software may have inadvertently installed malicious additions through normal update processes, and potentially provided actors with the ability to access users’ systems. The US Government issued a statement on 15 April 2021 attributing the SolarWinds Orion compromise to Russian state actors. The same day, the Australian Government released a joint statement by the Australian Foreign Minister, Minister for Defence and Minister for Home Affairs joining international partners in determining that Russian state actors were actively exploiting SolarWinds and its supply chains. Russia’s campaign has affected thousands of computer systems worldwide. Following detection of the compromise, SolarWinds acted quickly to release progressive advice from 14 December 2020 in order to assist organisations to remediate this vulnerability, including patches and guidance to support identification of vulnerable versions of the Orion platform. SolarWinds engagement with the ACSC through provision of international insights during this incident informed ACSC’s understanding of the potential impact to Australian organisations and its advice to Australians. The ACSC welcomes the positive collaboration with SolarWinds in order to share the lessons learned with other supply chain providers and organisations. This ensures the protection of their software and networks from similar occurrences and enhances Australia’s overall cyber security resilience. 42