THE SOLAR WINDS CYBER-ATTACK, THE FEDERAL AND PRIVATE SECTOR RESPONSE, AND THE RECOMMENDATIONS AND LESSONS LEARNED

The purpose of this paper is to analyze the Solar Winds breach. The article provides a timeline that lists when the hack was discovered, what organizations found the breach, and what was the federal government and private sector’s response. The article briefly outlines the federal laws and policies that address cyber-attacks, including the Economic Espionage Act of 1996, the Health Insurance Portability and Accountability Act of 1996, the Gramm-Leach-Bliley Act of 1999, the Federal Information Security Management Acts of 2002 and 2014, the Modernizing Government Technology Act of 2018, the Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act of 2019, and Executive Order 14017. Supply chain security issues are explained along with a technical outline of the Solar Windshack, arguing that it was a logic bomb and man-in-the-middle attack. Finally, the recommendations and lessons learned are discussed from the federal government’s perspective, the private sector’s vantage point, and a legal view. The paper concludes by observing that the American government and private sector industries must be eternally vigilant against future cyber-attacks. These days, it is the price to be paid for becoming and remaining effective and profitable.