SolarWinds and the three assumptions behind every update policy
The Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are low-risk plumbing, and that federal sensors would catch a national-scale intrusion. Only the second was quick to fix.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On December 8, 2020, the security firm FireEye disclosed that a highly sophisticated attacker had breached it. On Sunday, December 13, the wider scope emerged. Attackers had inserted malicious code into updates of SolarWinds’ Orion network monitoring software. That evening CISA issued Emergency Directive 21-01, ordering federal civilian agencies to disconnect or power down affected Orion products.
On December 14, SolarWinds told the Securities and Exchange Commission that fewer than 18,000 customers may have installed the affected versions, released between March and June 2020. During the week, news reports and official statements confirmed that several federal departments had been affected. On December 16 the FBI, CISA and the Office of the Director of National Intelligence formed a unified coordination group to lead the federal response.
Large intrusions into government networks were not new in 2020. The route was. The attackers did not break into each target. They compromised one vendor’s build process and let thousands of customers install the result through normal, approved update procedures. Most customers who installed the tainted update were never pursued further. The attackers chose a much smaller set of targets for follow-on activity. That pattern broke three assumptions on which agency security programs rested. One was that signed updates from a trusted vendor are safe to install. Another was that monitoring tools are low-risk infrastructure. The third was that the government’s own sensors would detect an intrusion of this scale.
Signed updates are safe
Patching quickly is among the most consistent pieces of security advice. Agencies were measured on how fast they applied vendor updates. The Orion compromise turned that discipline against them. The malicious code arrived in updates that were digitally signed and delivered through official channels, so the controls designed to confirm authenticity confirmed it.
A signature proves which organization produced a file. It says nothing about whether that organization’s build environment was clean. Stopping or slowing patching would have been the wrong response, because known vulnerabilities in unpatched software remained a far more common route in. The useful responses sat on either side of the update.
- Upstream, at the supplier. Buyers began asking how software is built. Are build systems isolated, and signing keys separated from developers? What third-party components go into a product, and does the supplier follow a recognized secure development framework?
- Downstream, after installation. Trusted software can be watched for behavior its function does not need. A monitoring tool that starts contacting unfamiliar internet domains is a signal, whatever its signature says.
The upstream questions were hard for most agencies to verify in 2020. Few contracts gave them the right to ask, and few suppliers had answers ready. That gap shaped much of the federal policy that followed.
Monitoring tools are low risk
Network monitoring software is useful because it can see and reach a great deal of an environment. It often runs with broad credentials and wide network access. In many agencies it sat with network operations teams, outside the scrutiny applied to identity systems or financial applications. It was treated as plumbing.
Orion showed that management tools are among the most valuable footholds an attacker can get. The same is true of remote management agents, backup systems, configuration management, endpoint management and directory synchronization services. Any tool that can see or change many systems at once is a concentration of privilege. In several victims, the attackers also moved from on-premises systems into cloud email and identity services by abusing the trust between them.
This was the assumption most open to quick action, and the steps were inexpensive:
- Inventory the tools. List every product that holds broad credentials or can push changes to many systems, with its owner.
- Restrict outbound traffic. Most management servers need to reach a short, known list of destinations. Blocking or alerting on everything else, including unusual DNS lookups, makes a backdoor’s call home harder to complete and easier to spot.
- Treat service accounts as privileged. Put their credentials in privileged access management, scope them to what each tool needs, and alert on use outside expected patterns.
- Segment the management plane. Place these servers where a compromise cannot reach everything else directly.
The trade-off is operational friction. Egress restrictions break vendor features that phone home for updates or licensing, and network teams resist changes to tools they rely on daily. Agencies that made the changes stick usually gave the tools an explicit security owner alongside the operational one.
Government sensors would see it
The federal government had invested for years in perimeter sensing for civilian agencies. The SolarWinds intrusion was found by a private company investigating its own breach. The attackers used legitimate update channels, kept their traffic close to normal patterns, and moved slowly and selectively. Signature-based inspection at the network boundary was a poor fit for that behavior.
The detection gap pointed toward visibility inside networks and on endpoints, longer log retention, and the authority for a central team to hunt across agencies rather than only inspect boundary traffic. It also showed how much national cyber defense depended on private-sector visibility and on victims’ willingness to disclose quickly.
For state and local agencies and regulated institutions that ran Orion, the week brought an immediate task. They had to establish whether they had installed the affected versions, whether the code had called out, and whether there was follow-on activity. Many lacked the logs to answer with confidence. That gap, more than the software itself, decided how long their uncertainty lasted. Teams with an accurate software inventory, months of retained DNS and proxy logs, and a working security contact at the vendor answered within days. Others spent weeks rebuilding basic facts.
With hindsight
In April 2021 the U.S. government formally attributed the campaign to Russia’s foreign intelligence service and announced sanctions. Executive Order 14028, signed in May 2021, launched federal work on software supply chain security, endpoint detection, logging standards and zero trust. That work led to software bills of materials, secure development attestations from software suppliers and expanded CISA authority to hunt on agency networks. A Cyber Safety Review Board was created to study major incidents, though its members were dismissed in January 2025.
The SEC’s 2023 enforcement case against SolarWinds and its chief information security officer was largely dismissed by a federal judge in 2024, and the SEC dropped the remaining claims in November 2025. Of the three assumptions, the second has changed most: management tools are now widely treated as privileged infrastructure. Verifying a supplier’s build process and seeing inside every network remain incomplete.