March 8, 2021

What Businesses, Employees, & Interns Can Learn From the SolarWinds Hack

March 2, 2021
By Dashlane

Even government-trusted companies aren’t immune to bad password habits. Here’s what your organization can do to avoid a similar incident.

What happened?

U.S. IT firm SolarWinds experienced a software hack in 2020 that is only now being fully uncovered. After gaining access to the SolarWinds software, hackers added malicious code, which was then sent to SolarWinds customers during routine software updates. At this point, hackers could gain access to the customers’ IT systems, deploying more malware to spy on these organizations and their sensitive data. Among these customers? The U.S. Treasury.

The hack was first reported by Reuters in December of 2020 after going undetected for months. According to Reuters, the suspected culprits are Russian hackers.

New reports peg the catalyst of the incident on a weak password created by an intern: solarwinds123.

Find out why passwords can be the weakest link in your company security and what you can do about it in our latest white paper.

What info might have been compromised?

According to SolarWinds’s report to the SEC, around 18,000 customers installed software with the malicious code—including high profile customers, such as Fortune 500 companies and branches of the U.S. government.

The data that may have been compromised in the hack is still under investigation, however the U.S. Treasury has reported that emails and internal networks were hacked into.

Why is this such a big deal?

There are multiple implications with the SolarWinds hack. The researcher who initially discovered the leaked password told CNN that it had been available online since at least June 2018, until it was fixed in November 2019. For a company providing IT services, this oversight is enough to cause serious reputational damage. And because the malware went undetected for so long, it’s possible that companies may never know if they were affected by this hack or not. In fact, the full extent of the damage caused by this hack may never be known.

According to Dashlane’s own CTO, Frederic Rivain, “As we’ve seen in the SolarWinds incident, securing a company’s perimeter is not enough. With the explosion of SaaS services and APIs that we all use, there’s a domino effect. As a company, you need to have oversight into the security practices of your providers and partners, as they could result in an indirect incident and still hurt your own reputation.”

What businesses should do

A bad password should never be the cause of a hack or a breach—but unfortunately, weak, reused, or stolen employee passwords still cause the majority of business hacks and breaches. The good news is that a simple, cost-effective solution exists: a password manager.

Try Dashlane for your business and start improving your company’s passwords for free. Get started by finding the plan that’s right for you.

What employees and interns should do

If your organization does not use a password management solution, the change can start with you. A password manager makes life online simpler—not just at work but at home, too.

Read our full guide on building a case for a password manager to find out more about setting your company up with total password protection.

www.dashlane.com

March 8, 2021

Nothing New Here

U.S. retailers see millions in sales delays amid shipping logjam

By Kim Bhasin, Jordyn Holman and Henry Ren Bloomberg Feb. 26, 2021 2:16 PM PT

Overwhelmed U.S. ports, elevated freight costs and accidents that sent goods plunging to the bottom of the ocean are causing headaches for U.S. retailers already reeling from the pandemic.

Corporations of all sizes are reporting logistics struggles, especially on trans-Pacific trade routes. Although they haven’t yet translated into widespread sticker shock for consumers, the ongoing shipping issues threaten to disrupt inventories of appliances, shoes, fitness equipment and more if they persist much longer.

“I don’t think we’re meeting everybody’s expectations today — and, frankly, we’re unlikely to. I doubt if anybody else is either, [if] importing products from Asia,” Crocs Inc. Chief Executive Andrew Rees said on an earnings call this week. “Getting it through Long Beach and other ports, getting shipped to customers, is really challenging right now. And that’s not an issue with production capacity; that’s just logistics.”

The supply strains, compounded by shortages of shipping containers, are starting to hit companies’ operations. Nautilus Inc., whose products include Bowflex fitness machines, said on a call this week that logistics issues delayed the launch of some of its new connected treadmills. Shoemaker Wolverine World Wide Inc. said $20 million in sales would shift from the first to the second quarter because of the backlogs. Steven Madden Ltd. said supply chain disruptions cut the footwear company’s first-quarter sales expectation by $30 million.

Retailers expect the problems to spill into the next quarter, though some say they think the worst is behind them.

Nautilus Chief Financial Officer Aina Konold said the company no longer needs to send purchase orders two or three quarters into the future. “We have gone back to issuing them closer to normal lead times of several weeks,” she said.

Lowe’s Cos. CEO Marvin Ellison said in an interview that appliances, in particular, are still having some challenges, but “we’ll have corrected it” over the next couple of months.

Outside of the usual shipping headaches, Tapestry Inc. brand Kate Spade had the misfortune of being involved in two separate cargo ship incidents in which containers full of goods went overboard in rough seas. CEO Joanne Crevoiserat said earlier this month that the losses will affect the brand’s spring deliveries. Mike George, CEO of QVC and HSN owner Qurate Retail Inc., said he has lost at least one big batch of vacuum cleaners to the ocean.

The logjams come as demand from American companies and consumers has remained strong enough to propel U.S. merchandise imports to a record high in January, even as exports remained sluggish. That divergence led the gap between the two — the goods trade deficit — to increase again and stay close to a record set in November.

All those inbound products are clogging the nation’s biggest ports, from Savannah, Ga., on the East Coast to Los Angeles — the biggest gateway for trade with Asia. The number of container ships waiting to enter the neighboring ports of L.A. and Long Beach stood at 27 late Thursday, with an average wait of more than a week. Parked in San Francisco Bay were about a dozen container vessels waiting to berth at the Port of Oakland, according to satellite tracking.

Economists at the nation’s central bank have taken note of the difficulties, and at least one doesn’t predict an end to them anytime soon. According to a paper published Friday by Julianne Dunn, an economic analyst at the Federal Reserve Bank of Cleveland, “it is likely that supply chain disruptions will continue to evolve for the foreseeable future.”

In the meantime, some companies are paying premiums to send goods by air, substituting products on shelves and trying to renegotiate arrangements with shippers. Steven Madden is shipping some goods by air but is “judicious” about the move, CEO Edward Rosenfeld said, because the cost of air freight is also up more than 100% compared with a year ago.

There’s been little relief recently on ocean freight. The Drewry Hong Kong-Los Angeles container-rate benchmark of spot rates has held steady over the last six weeks, averaging slightly more than $5,900 per 40-foot container — more than quadruple the level of a year earlier.

“The planning ability is absolutely key,” Under Armour Inc. CEO Patrik Frisk said in an interview earlier this month. “Anything you try to do on the fly, so to speak, is going to cost you dearly as it relates to transportation.”

https://www-latimes-com.cdn.ampproject.org/c/s/www.latimes.com/business/story/2021-02-26/shipping-logjam-ports-logistics?_amp=true