Back 
It’s been more than a month since the SolarWinds breach first started dominating security headlines, and we’re still learning new details about the attacks and the organizations affected. Even as the discussion quiets down, it’s easy to imagine we’ll still be looking back and analyzing the full effects of these incidents in much the same way we talk about other seminal breaches and security events from the past 20 years.
You might be thinking: another “what-we-learned” piece on the SolarWinds stuff? Well, I wear the CMO hat at Netskope, so I’m of course always interested in how we position and discuss these things. But my longer history is as a CISO and Chief Strategy Officer. I want to look at how to manage risk, sure, but also how to cut through all the hype and chatter and speculation and get to real advice that we can apply—today—based on what we have learned.
Based on many conversations with leaders in the security community over the last few weeks, here are what I think are three of the most practical lessons.
Lesson: There is more empathy and support among security pros than we realized. Let’s use that.
Security professionals, CISO or otherwise, tend to have each other’s backs. No one wants to be in the position that professionals at FireEye, SolarWinds, or anyone else involved found themselves. And with notable exceptions–come on, folks, your barely-disguised exploitative marketing is obvious!—security vendors and influencers did not pile on, instead expressing solidarity and wanting to see how we, as a community, can do better as a result of what we’ve learned from the mess.
These past few years have been a divisive time, all over the world. We talk about unity, we talk about wanting to do better as far as public-private industry cooperation in security, we talk about threat intelligence sharing, we talk about being good citizens…we talk. If there’s to be any silver lining in what happened with SolarWinds, perhaps it will be that it inspired us to actually collaborate on the things that have to get done, not just forming more threat info sharing committees or pushing a technology agenda. SolarWinds is a wake-up call that we are not anywhere close to “there