-
Featured services
Think beyond the robots
The successful integration of AI and IoT in manufacturing will depend on effective change management, upskilling and rethinking business models.
Read the blog -
Services
Leverage our capabilities to accelerate your business transformation.
-
Services
Network Services
Popular Products
-
Private 5G
Our turnkey private 5G network enables custom-built solutions that are designed around unique use cases and strategies, and deployed, run and optimized through a full network-as-a-service model.
-
Managed Campus Networks
Our Managed Campus Networks services transform campus networks, corporate area networks and interconnected local area networks, and connect smart places and industries.
-
-
Services
Cloud and IT Infrastructure
Popular Products
-
Cloud Architecture and Modernization
Discover how to achieve your business goals through cloud modernization practices, that deliver improved agility, reusability and scalability.
-
Cloud Optimization
Discover how to maximize operational excellence, business continuity and financial sustainability through our cloud-advanced optimization services.
-
-
Services
Consulting
-
Client stories
-
Penske Entertainment and the NTT INDYCAR SERIES
Together with Penske Entertainment, we’re delivering digital innovations for their businesses – including INDYCAR, the sanctioning body of the NTT INDYCAR SERIES – and venues such as the iconic Indianapolis Motor Speedway, home to the Indianapolis 500.
-
Using private wireless networks to power IoT environments with Schneider Electric
Our combined capabilities enable a secure, end-to-end digital on-premises platform that supports different industries with the benefits of private 5G.
-
-
Services
Data and Artificial intelligence
-
Services
Technology Solutions
Client stories
-
Services
Global Data Centers
-
Services
Digital Collaboration and CX
Master your GenAI destiny
We’ll help you navigate the complexities and opportunities of GenAI.
Explore GenAI -
-
-
Insights
Recent Insights
-
The Future of Networking in 2025 and Beyond
-
Using the cloud to cut costs needs the right approach
When organizations focus on transformation, a move to the cloud can deliver cost savings – but they often need expert advice to help them along their journey
-
Make zero trust security work for your organization
Make zero trust security work for your organization across hybrid work environments.
-
-
Master your GenAI destiny
We’ll help you navigate the complexities and opportunities of GenAI.
Explore GenAI -
-
Master your GenAI destiny
We’ll help you navigate the complexities and opportunities of GenAI.
Explore GenAI -
Discover how we accelerate your business transformation
-
About us
CLIENT STORIES
-
Liantis
Over time, Liantis – an established HR company in Belgium – had built up data islands and isolated solutions as part of their legacy system.
-
Randstad
We ensured that Randstad’s migration to Genesys Cloud CX had no impact on availability, ensuring an exceptional user experience for clients and talent.
-
-
CLIENT STORIES
-
Liantis
Over time, Liantis – an established HR company in Belgium – had built up data islands and isolated solutions as part of their legacy system.
-
Randstad
We ensured that Randstad’s migration to Genesys Cloud CX had no impact on availability, ensuring an exceptional user experience for clients and talent.
-
-
CLIENT STORIES
-
Liantis
Over time, Liantis – an established HR company in Belgium – had built up data islands and isolated solutions as part of their legacy system.
-
Randstad
We ensured that Randstad’s migration to Genesys Cloud CX had no impact on availability, ensuring an exceptional user experience for clients and talent.
-
Everest Group PEAK Matrix® Assessment
NTT DATA is a Leader and Star Performer in the Everest Group Sustainability Enablement Technology Services PEAK Matrix® Assessment 2024.
Get the Everest report -
- Careers
The Solar ‘Winds’ continue to shift
25 February 2021
Topics in this article
Investigations into the SolarWinds cyberattack are ongoing
Following the announcement of the SolarWinds supply-chain compromise last December, and since our last blog update in mid-January, details continue to stream in; both the scale and ramifications of the breach are yet to be determined.
The campaign, which appears to have affected over 18,000 entities worldwide, is still being investigated. And, despite the massive number of entities potentially having been affected, it appears that only a handful of organizations – primarily government and private sector – were actual targets. This is a highly used tactic, likely designed to obfuscate the intended targets of an attack.
Mimecast confirmed the breach compromised a software certificate used to secure connections to Microsoft cloud services
To give a better understanding of how massive this attack campaign is, recent evidence from Microsoft suggests that the operation may have included over 1,000 Russian state-backed operatives, and that about 4,000 lines of Orion update code were rewritten to help the attackers achieve their end goal.
Security firm Mimecast confirmed that the attackers were able to compromise a software certificate that the firm used to secure connections to Microsoft cloud services. This underscores just how deeply embedded the suspected Russian Advanced Persistent Threat (APT) group was in major technology companies.
As the analysis continues, it also appears that the group – or groups – behind the attack used multiple attack vectors to gain entry to its victims, including having access to emails at SolarWinds for at least nine months before the discovery. A statement from the acting director of the US Cybersecurity and Infrastructure Security Agency (CISA) suggests that ‘significant numbers of both the private-sector and government victims linked to this campaign had no direct connection to SolarWinds’, further broadening the investigation
Further attacks at U.S. organizations
It has come to light that the same suspected Russian APT group, tracked as Dark Halo by one security firm, breached a U.S. think tank earlier in 2020. Although it is unknown whether the two breaches were for related operations, one of the attack waves exploited the compromised SolarWinds supply chain.
Chinese attackers took advantage of yet another SolarWinds software vulnerability to compromise computers at the National Finance Center, New Orleans, USA.
In addition, three new vulnerabilities have been patched by SolarWinds. Tracked as CVE-2021-25274, CVE-2021-25275, and CVE-2021-25276, two of these vulnerabilities affect SolarWinds Orion User Device Tracker, while the third affects SolarWinds Serv-U FTP for Windows. Successful exploitation of these vulnerabilities could allow an attacker functionality including adding new accounts, access to sensitive data, systems, or servers, and complete control of the underlying operating system.
In the latest twist to this investigation, however, it appears that suspected Chinese attackers took advantage of yet another SolarWinds software vulnerability to compromise computers at the National Finance Center, and potentially other U.S. government agencies, although earliest evidence does not show ties between the two campaigns.
Frighteningly, despite each new detail that emerges from this investigation, it’s been evident that many SolarWinds clients and victims have neglected to secure their networks following disclosure of this attack. According to RiskRecon, a risk assessment firm, many companies exposed to this espionage campaign have not yet followed protocol or taken steps toward mitigation of threats to their vulnerable environment.
The aftermath of the SolarWinds compromise
As mentioned in our previous SolarWinds blog, we should still expect to see copycat campaigns or follow-on attacks reusing the malware, particularly as these vulnerabilities are not being defended or patched in vulnerable environments.
According to RiskRecon many organizations have still not taken steps toward mitigation of threats to their vulnerable environment.
It is difficult to defend against legitimate files from trusted sources. As such, a layered approach is best. It’s no longer enough to say ‘vet all of your vendors and third-party resources.’
To that end, and as we continue to learn of new victims, techniques, and implications, perhaps building in a zero-trust model (i.e.: time-limited access and just-enough access), along with implementing the principle of least privilege, would add to the efficacy of a layered defense against these types of attacks, both in the design and implementation of your networks. Keep in mind that this breach is well beyond incident response, as its intent seems to point to espionage and theft of information rather than attempting to destroy data or property. That places this breach into the counterintelligence space. Affected organizations, and their clients, would be served well in keeping this aspect in mind: keep abreast of the geopolitical climate, as well as understand why your organization may be a target.
References
CISA Says Many Victims of SolarWinds Hackers Had No Direct Link to SolarWinds
FSB warns of US cyberattacks after Biden administration comments
EXCLUSIVE-Suspected Chinese hackers used SolarWinds bug to spy on U.S. payroll agency –sources