The NYT just reported the next revelation regarding the SolarWinds hack. The Russian FSB may have piggybacked on a tool developed by JetBrains, which is based in the Czech Republic.
The NYT said: "Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies."
The exact software that investigators are examining is a JetBrains product called TeamCity, used by SolarWinds, which allows developers to test and exchange software code before its release. JetBrains is considered a predominant tool for developing software. Google, Hewlett-Packard and Citibank are among its customers, and the company is widely used by developers of Android mobile software. JetBrains themselves blogged about this and said they have not been notified and not aware of this investigation.
KnowBe4 is not using the TeamCity product, but this whole affair does bring to light the enormous third party vendor risk. Remember how antivirus company Kaspersky was penetrated and "owned" by Russian state-sponsored hackers? Trusting your source code to three Russians seems to be an unacceptable risk in these days.
You need to truly start managing that risk. KnowBe4's KCM’s Vendor Risk Management module helps you manage your third-party vendor risk requirements. KCM enables you to centralize your third-party risk management processes and helps you prequalify risk, assess your vendors, and conduct remediation efforts in your KCM platform. You can even set a frequency for how often your vendors are assessed, to continually monitor the associated risk. Get your live demo now.