The SolarWinds compromise combined a malicious, correctly signed software update with later abuse of identity systems. Your organization would catch it sooner by controlling what software may reach the network, watching authentication for impossible tokens and travel, restricting management tools' outbound traffic, and keeping logs long enough to look back.
This checklist draws on CISA advisory AA20-352A. It describes controls, not blame. Victims were targeted by a capable actor.
What does CISA say happened?
CISA reports the earliest known compromises in at least March 2020. The initial access path was a supply chain compromise of SolarWinds Orion: a malicious DLL, signed with SolarWinds' legitimate certificate, in versions 2019.4 HF5 through 2020.2 HF1. CISA also names other routes, including password guessing and spraying, poorly secured administrative credentials on external remote services, and abuse of SAML tokens.
After getting in, the actor targeted email accounts of key staff, including IT and incident response staff. CISA lists persistence through tokens or certificates added to cloud application service principals, and new federation trusts added to identity infrastructure. On 13 December 2020 CISA issued Emergency Directive 21-01 ordering federal civilian agencies to disconnect affected Orion devices.
The checklist
1. Could you list every Orion-class tool and its version in an hour? Management software holds broad privilege. Inventory it first.
2. Do you restrict management tools to a management network? CISA's remediation advice limits Orion's network access to its management enclave and removes inbound trust relationships.
3. Can management servers talk to the internet? The backdoor beaconed to an external domain and used DNS responses to receive more instructions. Deny outbound traffic by default from tools like this, and log DNS from them.
4. Do you look for impossible tokens? CISA's detection advice includes SAML tokens with lifetimes far above the usual hour, identical issued and last-used times, tokens with no matching login, and missing multi-factor claims. These need identity provider logs correlated with application logs.
5. Do you look for impossible travel? Logins from places too far apart to be plausible. CISA warns that VPNs cause false positives.
6. Do you audit changes to federation and service principals? New credentials on cloud applications and new trust relationships are quiet persistence. Alert on them.
7. Do you keep logs long enough? CISA's rebuild guidance retains logs for at least 180 days in a centralized system. A breach found in month eight needs more than six weeks of history.
8. Can you update fast and verify? CISA advises installing Orion updates within 48 hours of release for rebuilt systems. A fast patch path helps only if the update is trustworthy, so pair it with vendor attestations and staged rollout.
What if a signed update is malicious?
A valid signature proves who signed, not that the build was clean. Controls that help include running new vendor updates first on an isolated segment, monitoring that segment's behavior, asking vendors for build provenance, and keeping an SBOM so you can search for affected versions quickly.
What to do
- Inventory privileged management software, with versions and network position.
- Segment it, deny default egress and log its DNS.
- Alert on long-lived or inconsistent SAML tokens and on new federation trusts.
- Retain identity and network logs for 180 days or more.
- Stage vendor updates through an isolated ring before broad rollout.
- Prepare an out-of-band communication plan, as CISA recommends.
- Rehearse a rebuild of one management tool from trusted media.
Quick check
Was the SolarWinds update unsigned?
No. CISA says the malicious DLL was signed with SolarWinds' legitimate certificate, so signature checks alone would not catch it.
Was Orion the only way in?
No. CISA lists other vectors, including credential attacks and SAML token abuse, that did not involve Orion.
Sources
Last reviewed: 18 October 2026.
