Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

What it is

A conference interview with Tim Brown, former SolarWinds CISO, on how SolarWinds rebuilt the Orion build process after Sunburst. The useful parts are the specific controls and the operating lessons. The incident narrative is already in the summary.

What to do

The page describes these as what SolarWinds changed, and the same moves can be applied to another build pipeline:

• Take the build off the shared environment. SolarWinds "externalized the build system completely" and moved it to AWS. It is now defined in code, which it was not before. The page does not say how the environment is secured beyond that.
• Split the build into three tiers with no overlap in people. Orion now runs development, staging and production builds before shipping. About 400 people can reach development, 36 staging, and 2 production. Brown says no single person has access to all three, so one compromised account cannot carry a change from commit to release.
• Assume breach and design out single points of failure. Brown does not trust people just because they are employees. They found no insider, but he says an insider is how he would run this attack himself.
• Bring in counsel first during an incident. At SolarWinds, outside counsel (DLA Piper) was one of the first calls. Counsel then retained CrowdStrike, KPMG and Krebs Stamos, so the investigation ran through the legal channel.
• Put build-pipeline risk on the risk register. Brown's advice to developers is to tell security leadership where the real build risks are and make sure they are recorded, and to explain the software architecture to CISOs who came up through governance or tooling.
• Treat non-human and agentic identities as in scope. Brown says AI agents need guardrails and sandboxing. He gives no specific controls.

flowchart LR
    D["Dev build<br/>~400 people"] --> S["Staging build<br/>36 people"] --> P["Production build<br/>2 people"]
    X["Rule: no one person<br/>in all three tiers"] -.-> D
    X -.-> S
    X -.-> P

Caveats

• The tier sizes are from SolarWinds' Orion pipeline. The page does not say how the tiers are enforced or how the two production people are chosen.
• Brown reports that the original tainted code was never in source control and appeared in three product versions built between February and June. The page does not say how it got into the build, so it gives no root cause to model your own controls on.
• The company's recovery figures are self-reported: renewal rate 92% before, the 80s after, 99% post-sale to private equity.
• Brown's comments on agentic AI and faster exploitation are general and give no tooling or configuration.
• On personal liability, the page says SolarWinds covered his legal fees, which exceeded $1M. It also says the SEC case was dismissed with prejudice. That is useful context for the question of whether a company will back its CISO, but it is not a procedure.