As has been widely reported, the Solorigate supply chain cybersecurity attack has had a major impact to government entities, hundreds (if not thousands) of private sector companies, and the cybersecurity industry as a whole. This incident highlights the threats, risks and challenges that we in the technology community are constantly striving to combat. 

First, AspenTech is not a SolarWinds customer and does not use SolarWinds Orion. Although the company is not directly impacted by the SolarWinds compromise, it is important that we step back and learn from this incident.

Despite not using SolarWinds Orion, we are assessing our environment to ensure there are no indicators of compromise or unusual behavior. We are also working with our security vendors to implement countermeasures for Solorigate and the FireEye breach and theft of their red team tools. 

This incident reinforces the importance of a strong vendor management program. We will continue to proactively manage our suppliers and assess the security of the tools and systems on which we rely.

Which leads to our customers. We take our role as a key supplier and partner to our customers seriously and are constantly striving to reduce risks, improve our processes and strengthen our security posture. We periodically review our build processes, code reviews, code signing, and release processes to help reduce risks to our products and by extension risks to our customers. 

AspenTech’s R&D team has published additional details in knowledge base article 98064 which is accessible via the AspenTech Support Center.   For questions or additional information, please submit a request through the AspenTech Support Center.

Finally, we want to share a Microsoft blog post “A moment of reckoning” which indicates that “44% of targets were in the information technology sector.” Attackers are clearly widening their operations to target the supply chain and leveraging “a new generation of private companies” to execute attacks. 

With these increasing threats, it is important that security professionals continue to collaborate with each other to share threat intelligence so that we collectively can better respond to incidents, secure our critical infrastructure, and guard against these threats. To that end, we will look for opportunities to share more cybersecurity-related information and strengthen our partnerships with customers, vendors, and the cybersecurity industry.