SolarWinds, Log4Shell and zero trust

On 13 December 2020 the security company FireEye, whose researchers worked under the Mandiant name, published an alert: SolarWinds Orion, a network-monitoring product used by governments and companies worldwide, had shipped updates containing a backdoor it called SUNBURST. The malicious file was digitally signed by SolarWinds and arrived through its official update site. SolarWinds told US regulators that the code had been inserted through a compromise of its build system, not its source code, and that fewer than 18,000 customers might have installed the affected updates, released between March and June 2020.

A year later, in December 2021, a different kind of supply-chain problem surfaced. Log4j, a free Java logging library built into an enormous range of software, had a flaw that let an unauthenticated attacker run code on a server simply by getting it to log a crafted piece of text. It became known as Log4Shell, and CISA ordered US federal agencies to find and fix it within days.