Leiden University Student Repository

Tsamados, Aristote (2023)

Exploring Unique Vulnerabilities in Software Supply Chains: The SolarWinds Hack and Implications for Critical Infrastructure Protection

Bachelor thesis | Security Studies (BSc)

This dissertation investigates the unique vulnerabilities in software supply chains as revealed by the 2021 SolarWinds and Kaseya cyberattacks. The central research question guiding this study is: "How do the Kaseya and SolarWinds attacks exemplify the ‘hard problem’ of securing critical software supply chains from cyber threats?". The study employs the sociotechnical systems theory (STS), a framework that recognizes the interplay between social and technical elements in shaping outcomes, to examine cyber operations against critical information infrastructure (CII). The analysis reveals the sophistication of modern cyber threats, with Advanced Persistent Threats (APTs) capable of camouflaging malicious activities as routine system processes, making detection extremely difficult. These attacks involved compromising legitimate software development and update processes, thereby distributing malicious software without raising suspicion. On the social side, the study emphasizes the...Show moreThis dissertation investigates the unique vulnerabilities in software supply chains as revealed by the 2021 SolarWinds and Kaseya cyberattacks. The central research question guiding this study is: "How do the Kaseya and SolarWinds attacks exemplify the ‘hard problem’ of securing critical software supply chains from cyber threats?". The study employs the sociotechnical systems theory (STS), a framework that recognizes the interplay between social and technical elements in shaping outcomes, to examine cyber operations against critical information infrastructure (CII). The analysis reveals the sophistication of modern cyber threats, with Advanced Persistent Threats (APTs) capable of camouflaging malicious activities as routine system processes, making detection extremely difficult. These attacks involved compromising legitimate software development and update processes, thereby distributing malicious software without raising suspicion. On the social side, the study emphasizes the importance of addressing both social and technical aspects. Improving organizational culture, communication, and collaboration among stakeholders can facilitate more effective cybersecurity. Cybersecurity incidents are not just technical issues but also involve human factors, organizational structures, and institutional arrangements. The findings underline the urgent need for robust cybersecurity measures and the development of comprehensive strategies to mitigate such risks. The "hard problem" faced by states in protecting critical infrastructure is not merely a technical issue, but a complex challenge that requires a holistic approach, integrating both technical and societal aspects. The study contributes to the ongoing discourse on software supply chain security and critical infrastructure protection, and calls for further research in this critical area of study.Show less

Author

Tsamados, Aristote

Faculty

Faculty of Governance and Global Affairs

Supervisors

Sukumar, A.M.

ECTS Credits

15

Language

en