DHS Orders Federal Agencies To Update SolarWinds Orion Platform

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered all US federal agencies to update the SolarWinds Orion platform to the latest version by the end of business hours on December 31, 2020.

CISA’s Supplemental Guidance to Emergency Directive 21-01 demands this from all agencies using Orion versions unaffected in the SolarWinds supply chain attack.

“We issued V2 supplemental guidance to Emergency Directive 21-01,” CISA tweeted. “Agencies using non-affected versions must update to the new version.”

“The National Security Agency (NSA) has examined this version and verified that it eliminates the previously identified malicious code,” the agency said.

“Given the number and nature of disclosed and undisclosed vulnerabilities in SolarWinds Orion, all instances that remain connected to federal networks must be updated to 2020.2.1 HF2 by COB December 31, 2020.”

Also Read: What Is A Governance Framework? The Importance And How It Works

Orion Platform Version	Continued use of SolarWinds Orion permitted at this time	Update required?
Affected versions: 2019.4 HF5, 2020.2 RC1, 2020.2 RC2, 2020.2, 2020.2 HF1 (should be powered down or removed from networks based on ED 21-01)	No	N/A
All other versions that are currently online (if the instance did not previously use an affected version)	Yes	Yes (2020.2.1HF2)

Agencies using non-affected versions must update to the new version since Orion Platform versions 2019.4 HF6 and 2020.2.1 HF2 are designed to protect from both SUNBURST and SUPERNOVA malware.

The latest Orion updates designed to protect against both SUNBURST and SUPERNOVA are:

• 2019.4 HF 6 (released December 14, 2020)
• 2020.2.1 HF 2 (released December 15, 2020)
• 2019.2 SUPERNOVA Patch (released December 23, 2020)
• 2018.4 SUPERNOVA Patch (released December 23, 2020)
• 2018.2 SUPERNOVA Patch (released December 23, 2020)

Organizations that cannot immediately upgrade to these patched versions, can use a script provided by SolarWinds in their advisory to temporarily protect their environments against the SUPERNOVA malware.

“CISA will follow up with additional supplemental guidance, to include further clarifications and hardening requirements,” the federal agency added.

The FBI also shared a TLP:WHITE private industry notification [PDF] with info on how system admins and security professionals can check if APT actors have exploited SolarWinds vulnerabilities in their environments.

CISA and cybersecurity firm Crowdstrike also released free malicious activity detection tools to help search for SAML token usage anomalies in audit logs easier and to enumerate Azure tenant assigned privileges.

Also Read: Best Privacy Certification: 3 Simple Steps On How To Achieve