Four firms charged, fined over handling of SolarWinds hack disclosures – Source: www.csoonline.com

The US Securities and Exchange Commission (SEC) on Tuesday charged four companies over their handling of the 2020 SolarWinds Orion software supply chain attack, stating they each made “materially misleading disclosures regarding cybersecurity risks and intrusions.”

To settle, the four — Avaya Holdings, Check Point Software, Mimecast and Unisys — agreed to pay civil penalties: Avaya ($1 million), Check Point ($995,000), Mimecast ($990,000) and Unisys ($4 million); the latter had also been charged with disclosure controls and procedure violations.

According to an SEC release, the charges “result from an investigation involving public companies potentially impacted by the compromise of SolarWinds’ Orion software and by other related activity.”

In the release, Sanjay Wadhwa, acting director of the SEC’s division of enforcement, stated, “as today’s enforcement actions reflect, while public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures about the cybersecurity incidents they have encountered.”

The SEC’s orders, he said, “find that these companies provided misleading disclosures about the incidents at issue, leaving investors in the dark about the true scope of the incidents.”

All four organizations, the release stated, learned in either 2020 or 2021 that “the threat actor likely behind the SolarWinds Orion hack had accessed their systems without authorization, but each negligently minimized its cybersecurity incident in its public disclosures.”

Jorge G. Tenreiro, acting chief of the SEC’s crypto assets and cyber unit, said, “downplaying the extent of a material cybersecurity breach is a bad strategy. In two of these cases, the relevant cybersecurity risk factors were framed hypothetically or generically when the companies knew the warned of risks had already materialized.  The federal securities laws prohibit half-truths, and there is no exception for statements in risk-factor disclosures.”

Supporting documents on the case from the SEC or contained in the release revealed that:

• In early 2021, “Mimecast publicly disclosed certain aspects of the Compromise through a number of Forms 8-K filed with the Commission. However, [it] negligently omitted a number of material aspects … including information regarding the large number of impacted customers and percentage of code exfiltrated by the threat actor.”
• The SEC’s order against Unisys “finds that the company described its risks from cybersecurity events as hypothetical despite knowing that it had experienced two SolarWinds-related intrusions involving exfiltration of gigabytes of data.”
• The SEC’s order against Avaya “finds that it stated that the threat actor had accessed ‘a limited number of the company’s email messages,’ when Avaya knew the threat actor had also accessed at least 145 files in its cloud file sharing environment.” It was only able to recover and review 44 files, some of which “contained confidential and /or proprietary information, including third-party application passwords, internal security procedures and information, instructions regarding remote access, and product configuration for at least one customer.”
• The SEC’s order against Check Point found that it “knew of the intrusion, but described cyber intrusions and risks from them in generic terms.”

Asked what lessons can be learned by CSOs from the SEC investigation, Jeff Pollard, vice president and principal analyst at Forrester Research, said “in this case, the enforcement action is specific to investors of these companies. But customers can take some things away from this as well.”

When it comes to dealing with an existing or prospective software supplier, he said, “I would want to understand what their incident disclosure notification procedures are. The thresholds for notifying customers (and investors), the format of the notification, how frequently they plan to update customers (and investors), and any timetables for resolution.”

Pollard added that he would also want “my third party risk management program to take those factors into our assessment of this vendor to ensure that, as a customer, I’d be getting the information I need to properly evaluate whether I should be concerned about any compromise or breach.”

All four vendors submitted statements to CSO about the SEC’s findings and an abridged version of each is as follows:

• Avaya: “We are pleased to have resolved with the SEC this disclosure matter related to historical cybersecurity issues dating back to late 2020, and that the agency recognized Avaya’s voluntary cooperation and that we took certain steps to enhance the company’s cybersecurity controls. Avaya continues to focus on strengthening its cybersecurity program, both in designing and providing our products and services to our valued customers, as well as in our internal operations.”
• Check Point: “As mentioned in the SEC’s order,  Check Point investigated the SolarWinds incident and did not find evidence that any customer data, code, or other sensitive information was accessed. Nevertheless, Check Point decided that cooperating and settling the dispute with the SEC was in its best interest and allows the company to maintain its focus on helping its customers defend against cyberattacks throughout the world.”
• Mimecast: “Mimecast has resolved a matter with the Securities and Exchange Commission (SEC) involving statements about a security incident that Mimecast became aware of in January 2021. In responding to the incident in 2021, Mimecast made extensive disclosures and engaged with our customers and partners proactively and transparently, even those who were not affected. We believed that we complied with our disclosure obligations based on the regulatory requirements at that time. As we responded to the incident, Mimecast took the opportunity to enhance our resilience. While Mimecast is no longer a publicly traded company, we have cooperated fully and extensively with the SEC.”
• Unisys: “We direct you to the 8K the company filed this morning, found here — Unisys has no further comment outside of this filing.”