Why should I keep Orion

I've been a fan of Orion since I was first exposed to it in 2005. My experience with it has helped me get many jobs and this, in turn, has only reinforced my loyalty to the product.

My current employer uses Orion but after the recent Sunburst incident they are asking me if SolarWinds products are still right for us. I've shared my thoughts and opinions but I would like to see an official response from SolarWinds with their answer to the question: Why should I continue to use SolarWinds?

Others' opinions will be interesting to see, but the one that my employer will take most seriously is the response from the horse's mouth, as it were.

Find more posts tagged with

replace

orion

virus

solarwinds

Sunburst

Accepted answers

All comments

bobmarley

Our management asked the same question.

My 2cents, our Orion had several years of customizations that had been built into it. We used the API to tie the product to all of our other tools and even wrote our own console for our Network Operations Console because no vendor had a decent solution for that. For what it did it was working great. We looked at many other solutions over the past several weeks and found several we liked. The downside was that all the customization we have done will need to be recreated on a new platform.

If your monitoring is fairly simple out of the box you will probably find it an easy task to move to another platform. If you have a lot of customizations you may want to stick with what you are currently using.

The trade off on security -vs- functionality and rework is something your team will need to decide.

happyfunnorm

IMO, you should immediately discount nation-state attacks. There's literally no defense from well-funded, highly specialized focused attacks. As an example, the NSA was intercepting Cisco devices in shipping and updating the OS to a custom version that included backdoors, etc. It's literally the same attack, just physical in nature. Should you stop using Cisco because it's been show to be vulnerable to the same kind of attack? I would say no.

sturdyerde

My short answer to that question, given the context, is simply: no company in this industry is immune from a determined and well-funded nation state hacking operation. Now that SolarWinds has been forced to deal with the effects of such an attack, they have unique motivation to secure their processes and environment. You'll be hard pressed to find another monitoring software vendor who puts the same amount of rigor into their security going forward.

tsadler

I've honestly been thinking this same question recently, so I'm glad to see someone ask the community and I'm interested to see the other responses.

So far I'm seeing multiple (accurate) affirmations that nation-state attacks are almost impossible to fully mitigate against. This is true, but to be honest it's not my primary concern regarding post-Sunburst Orion.

My biggest issue at the moment is what lead to this kind of attack not only being possible, but being easy for the attackers to accomplish. I've read article after article about how internal Solarwinds security professionals have been voicing concerns for years, only to be shut down due to concerns about the cost of properly implementing security, especially after coming under management by Thoma Bravo. The password the attackers used to access the Orion update server was solarwinds123 for Pete's sake!

So yeah, Solarwinds is in a unique position to bolster their security in the wake of Sunburst, moreso than perhaps any other monitoring platform vendor. But that doesn't ease my discomfort about Solarwinds upper management, and it makes me wonder about what other corners are being cut internally that just haven't come to light yet. Do they only care now because of the enormous cost implications that Sunburst has created? Are bottom-line managers the kind of people I want to trust my infrastructure to?

I don't know if I have the answer yet.

ChrystalT

We encourage everyone to continue to read the information as we learn new things as the investigations are ongoing. We also encourage you to join the webinar tomorrow with SolarWinds CEO, Sudhakar Ramakrishna, and Alex Stamos. Some links to the latest information including tomorrow's webinar are listed below.

Webinar: SECURE BY DESIGN: Our Plan for a Safer SolarWinds and Customer Community

CONTINUING OUR JOURNEY TO BECOMING SECURE BY DESIGN

FINDINGS FROM OUR ONGOING INVESTIGATIONS

Security Advisory FAQ

hpstech

Impossible to defend against? A simple check of the file properties using an SCCM remediation rule, GPO or just pure vigilance is all that was needed.

If I was a company dumping install executable or MSP files on hundreds of fortune 500 companies and the government I would do all possible to confirm the integrity of those files 24/7.

tsadler

That's definitely true; I didn't say impossible to defend against, I said impossible to completely mitigate. Nation-state APTs have countless resources at their disposal for trying to get into target systems, and I agree that simple vigilance would have prevented at least this method of attack. I'm just acknowledging that it's incredibly difficult to plug every hole when your attackers have the military-backed resources at their disposal.

I think we actually agree, but I just wanted to clarify.