CISA updates guidance on SolarWinds hack remediation, calls for upgrades and increased reporting

The Cybersecurity and Infrastructure Security Agency has updated guidance on responding to the hack of SolarWinds Orion software management tools on federal networks, including forensic analysis and reporting requirements for agencies still struggling to understand the scope of an attack that affected government as well as private-sector critical infrastructure systems.

“Federal agencies without evidence of adversary follow-on activity on their networks that accept the risk of running SolarWinds Orion in their enterprises should rebuild or upgrade, in compliance with hardening...