You know, reading this NYT, I have a theory... & oddly it’s maybe traced back to the #CDM program. This was the first government-wide effort to enumerate agency infrastructure, down to core components & architecture. Which could explain why #SolarWinds was an effective vector 1/
So they say they got into Treasury D.O. accounts (Departmental Offices). But thinking, if this went back always for 2019 and prior, I think about how casually docs for CDM were shared between the agency leads and the contractors doing CDM. nytimes.com/2020/12/21/us/… 2/
To that end, if you got a dump of those, either from DHS, an agency, or contractor (which were also limited in number), you literally have a map with road signs as to what was installed where, who managed it, and what was enabled. This is easy targeting info. 3/
The reports out denote precision targeting and stealth, and given that the only program that had that level of infrastructure detail from across government was that - and it was compulsory to provide. Probably looking at that, they saw large swaths of SolarWinds as a common floor
Also, I say this as somebody who ran Phase 1 and part of Phase 2 for all of Treasury and knew the info gathered. Internally, we secured the data, but still had to provide it to contractors, so it left agencies, and no accounting where it went after that. I’d be ...
Curious if we see HPE, DXC and BAH wrapped up in the investigation... if this was a vector - which scares the shit out of me. We went through so much to clear folks into areas, IRS being the hardest, TBH... and then maybe this being the key? Hypothesis, yes, confirmed, nope.
Just could be the tools and programs designed to prevent or save us from having this happen - actually be the things that caused the downfall. (Also, those docs had listed what stuff wasn’t being monitored or brought into centralized logging and auth)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
