Hitesh Sheth

Hitesh Sheth is the president and CEO of Vectra. Previously, he was chief operating officer at Aruba Networks and before that,  he was EVP/GM at Juniper Networks.

PRIVATE SECTOR — The March 3 notice from the Department of Homeland Security’s cybersecurity command was crisp and urgent. The headline: “Mitigate Microsoft Exchange On-Premises Product Vulnerabilities”. It reported the discovery that Microsoft Exchange software at work on government agency property had been compromised by hackers. The emergency directive ordered all federal agencies to scan metadata for anomalous activity, unplug affected hardware, download patches, and report the job done by March 5.

On one hand, the reaction time mandated by CISA (the Cybersecurity and Infrastructure Security Agency) is admirable and gratifying. Getting anything done across the federal agency landscape in 48 hours is no small feat. On the other hand, an experienced observer’s heart sinks. Here’s yet another case in the cybersecurity world of rearguard action: damage control in the wake of a big breach. Good for CISA for bolting the barn door – but who knows how many horses have already left.

In aviation terms, we want CISA to perform like the FAA, implementing preventive measures that save lives. But too often it’s like the NTSB, sifting accident wreckage, trying to determine what cost lives.

The SolarWinds breach of critical infrastructure at Homeland Security, Defense, State, and Commerce, discovered in 2020, just highlighted our cyber vulnerabilities. Before detection, the malware slumbered within target systems for months – a known attack strategy that again outwitted endpoint defense systems.

Prevention technologies like firewalls aren’t much help when the fire’s smoldering on the inside.

When the scope of the SolarWinds attack came to light, the response options were mostly reactive; it was too late to be preventive. We haven’t yet catalogued all the damage. The after-action cleanup continues today, and probably will for years.