Transcription
United States Government Accountability OfficeReport to Congressional AddresseesJanuary 2022CYBERSECURITYFederal Response toSolarWinds andMicrosoft ExchangeIncidentsAccessible VersionGAO-22-104746
GAO HighlightsJanuary 2022CYBERSECURITYHighlights of GAO-22-104746, a report tocongressional addresseesFederal Response to SolarWinds and MicrosoftExchange IncidentsWhy GAO Did This StudyWhat GAO FoundThe risks to information technologysystems supporting the federalgovernment and the nation’s criticalinfrastructure are increasing, includingescalating and emerging threats fromaround the globe, the emergence ofnew and more destructive attacks, andinsider threats from witting or unwittingemployees. Information security hasbeen on GAO’s High Risk List since1997.Beginning as early as January 2019, a threat actor breached the computingnetworks at SolarWinds—a Texas-based network management softwarecompany, according to the company’s Chief Executive Officer. The federalgovernment later confirmed the threat actor to be the Russian ForeignIntelligence Service. Since the company’s software, SolarWinds Orion, waswidely used in the federal government to monitor network activity and managenetwork devices on federal systems, this incident allowed the threat actor tobreach several federal agencies’ networks that used the software (see figure 1).Figure 1: Analysis of How a Threat Actor Exploited SolarWinds Orion SoftwareRecent incidents highlight thesignificant cyber threats facing thenation and the range of consequencesthat these attacks pose. A recent suchincident, involving SolarWinds, resultedin one of the most widespread andsophisticated hacking campaigns everconducted against the federalgovernment and private sector.Another incident included zero-dayMicrosoft Exchange Servervulnerabilities that had the potential toaffect email servers across the federalgovernment and provide maliciousthreat actors with unauthorized remoteaccess. According to CISA, thepotential exploitation from bothincidents posed an unacceptable riskto federal civilian executive branchagencies because of the likelihood ofvulnerabilities being exploited and theprevalence of affected software.GAO performed its work under theauthority of the Comptroller General toconduct an examination of thesecybersecurity incidents in light ofwidespread congressional interest inthis area. Specifically, GAO’sobjectives were to (1) summarize theSolarWinds and Microsoft Exchangecybersecurity incidents, (2) determinethe steps federal agencies have takento coordinate and respond to theView GAO-22-104746. For more information,contact Nick Marinos (202) 512-9342 ormarinosn@gao.gov or Jennifer Franks (404)679-1831 or franksj@gao.gov.While the response and investigation into the SolarWinds breach were stillongoing, Microsoft reported in March 2021 the exploitation or misuse ofvulnerabilities used to gain access to several versions of Microsoft ExchangeServer. This included versions that federal agencies hosted and used on theirpremises. According to a White House statement, based on a high degree ofconfidence, malicious cyber actors affiliated with the People’s Republic ofChina’s Ministry of State Security conducted operations utilizing these MicrosoftExchange vulnerabilities. The vulnerabilities initially allowed threat actors tomake authenticated connections to Microsoft Exchange Servers fromunauthorized external sources. Once the threat actor made a connection, theactor then could leverage other vulnerabilities to escalate account privileges andinstall web shells that enabled the actor to remotely access a Microsoft ExchangeServer. This in turn allowed for persistent malicious operations even after thevulnerabilities were patched (see figure 2).United States Government Accountability Office
incidents, and (3) identify lessonsfederal agencies have learned fromthe incidents.Figure 2: Analysis of How Threat Actors Exploited Microsoft Exchange Server VulnerabilitiesTo do so, GAO revieweddocumentation such as descriptions ofthe incidents, federal agency pressreleases, response plans, jointstatements, and guidance issued bythe agencies responsible forresponding to the incidents: DHS(CISA), the Department of Justice(FBI), and ODNI with support fromNSA. In addition, GAO analyzedincident reporting documentation fromaffected agencies and after-actionreports to identify lessons learned. Forall objectives, GAO interviewedagency officials to obtain additionalinformation about the incidents,coordination and response activities,and lessons learned.What GAO RecommendsSince 2010, GAO has made about3,700 recommendations to agenciesaimed at remedying cybersecurityshortcomings. As of November 2021,about 900 of those recommendationshad not yet been fully implemented.GAO will continue to monitor federalagencies’ progress in fullyimplementing these recommendations,including those related to softwaresupply chain management and cyberincident management and response.Five of six agencies provided technicalcomments, which we incorporated asappropriate.Federal agencies took several steps to coordinate and respond to theSolarWinds and Microsoft Exchange incidents including forming two CyberUnified Coordination Groups (UCG), one for the SolarWinds incident and one forthe Microsoft Exchange incident. Both UCGs consisted of the Cybersecurity andInfrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), andthe Office of the Director of National Intelligence (ODNI), with support from theNational Security Agency (NSA). According to UCG agencies, the MicrosoftExchange UCG also integrated several private sector partners in a more robustmanner than their involvement in past UCGs.CISA issued emergency directives to inform federal agencies of thevulnerabilities and describe what actions to take in response to the incidents. Toaid agencies in conducting their own investigations and securing their networks,UCG agencies also provided guidance through advisories, alerts, and tools. Forexample, the Department of Homeland Security (DHS), including CISA, the FBI,and NSA released advisories for each incident providing information on the threatactor’s cyber tools, targets, techniques, and capabilities. CISA and certainagencies affected by the incidents have taken steps and continue to worktogether to respond to the SolarWinds incident. Agencies have completed stepsto respond to the Microsoft Exchange incident.Agencies also identified multiple lessons from these incidents. For instance,coordinating with the private sector led to greater efficiencies in agencyincident response efforts;· providing a centralized forum for interagency and private sector discussionsled to improved coordination among agencies and with the private sector;· sharing of information among agencies was often slow, difficult, and timeconsuming and;· collecting evidence was limited due to varying levels of data preservation atagencies.Effective implementation of a recent executive order could assist with effortsaimed at improving information sharing and evidence collection, among others.·
ContentsGAO Highlights2Why GAO Did This StudyWhat GAO FoundWhat GAO Recommends2231LetterBackground4Threat Actors Exploited Vulnerabilities in SolarWinds Orion andMicrosoft Exchange13Federal Agencies Have Been Taking Action in Response toSignificant Cyber Incidents19Federal Agencies Learned Lessons from Efforts Coordinating andResponding to the SolarWinds and Microsoft ExchangeIncidents32Agency Comments36Appendix I: Detailed Timelines of Steps Taken by Cyber Unified Coordination Group Agencies in Response tothe SolarWinds and Microsoft Exchange Incidents40Appendix II: GAO Contacts and Staff Acknowledgments44GAO ContactsStaff Acknowledgments4444TablesTable 1: Detailed Timeline of Steps Taken by Cyber UnifiedCoordination Group Agencies in Response to theSolarWinds IncidentTable 2: Detailed Timeline of Steps Taken by Cyber UnifiedCoordination Group Agencies in Response to theMicrosoft Exchange Incident4143FiguresFigure 1: Ten Critical Actions Needed to Address Four MajorCybersecurity ChallengesFigure 2: Analysis of How a Threat Actor Exploited SolarWindsOrion SoftwareFigure 3: Analysis of How Threat Actors Exploited MicrosoftExchange Server VulnerabilitiesPage i81518GAO-22-104746 Cybersecurity
Figure 4: Key Entities of the Cyber Unified Coordination Groupsfor the SolarWinds and Microsoft Exchange IncidentsAbbreviationsAPTCFO PDUCG22advanced persistent threatChief Financial Officers ActCybersecurity and Infrastructure Security AgencyDepartment of Homeland SecurityDepartment of DefenseDepartment JusticeFederal Bureau of InvestigationFederal Information Security Modernization Actinformation and communications technologyinformation technologyNational Institute of Standards and TechnologyNational Security AgencyNational Security CouncilOffice of the Director of National IntelligenceOffice of Management and Budgetpersonally identifiable informationPresidential Policy DirectiveCyber Unified Coordination GroupThis is a work of the U.S. government and is not subject to copyright protection in theUnited States. The published product may be reproduced and distributed in its entiretywithout further permission from GAO. However, because this work may containcopyrighted images or other material, permission from the copyright holder may benecessary if you wish to reproduce this material separately.Page iiGAO-22-104746 Cybersecurity
441 G St. N.W.Washington, DC 20548LetterJanuary 13, 2022Congressional AddresseesThe risks to information technology (IT) systems supporting the federalgovernment and the nation’s critical infrastructure are increasing,including escalating and emerging threats from around the globe, theemergence of new and more destructive attacks, and insider threats fromwitting or unwitting employees. Information security has been on our HighRisk List since 1997.1 Recent incidents highlight the significant cyberthreats facing the nation and the range of consequences that theseattacks pose.2A recent such event resulted in one of the most widespread andsophisticated hacking campaigns ever conducted against the federalgovernment and private sector. The attack involved an advancedpersistent threat actor that compromised the network managementsoftware suite SolarWinds Orion as part of a software supply chaincyberattack campaign.3 The threat actor inserted a “backdoor”—amalicious program that can potentially give an intruder remote access toan infected computer—into a genuine version of that software product.41SeeGAO, High Risk Series: An Overview, GAO-HR-97-1 (Washington, D.C.: February1997). GAO maintains a high-risk program to focus attention on government operationsthat it identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, andmismanagement or the need for transformation to address economy, efficiency, oreffectiveness challenges.2GAO,SolarWinds Cyberattack Demands Significant Federal and Private-SectorResponse (infographic), (Washington, D.C.: Apr. 22, response-infographic (accessed May 5, 2021) and Colonial Pipeline CyberattackHighlights Need for Better Federal and Private-Sector Preparedness (infographic),(Washington, D.C.: May 18, 2021). tor-preparedness-infographic(accessed May 18, 2021).3Asoftware supply chain attack occurs when a cyber threat actor infiltrates a softwarevendor’s network and employs malicious code to compromise the software before thevendor sends it to their customers. The compromised software then compromises thecustomer’s data or system.4Threatactors include foreign intelligence services and militaries, corporate spies, corruptgovernment officials, cyber vandals, disgruntled employees, radical activists, purveyors ofcounterfeit goods, or criminals.Page 1GAO-22-104746 Cybersecurity
LetterBeginning in early 2020 the threat actor then used this backdoor, amongother techniques, to initiate a cyberattack campaign against U.S.government agencies, critical infrastructure entities, and private sectororganizations. The Department of Homeland Security’s (DHS)Cybersecurity and Infrastructure Security Agency (CISA) initially alertedfederal agencies to the SolarWinds attack in December 2020.Shortly following the announcement of the SolarWinds attack, in aseparate incident, Microsoft reported in March 2021 that other threatactors were exploiting zero-day vulnerabilities in Microsoft’s ExchangeServer products used to provide on-premises5 IT services such as email,address books, and calendars.6 According to Microsoft, approximately400,000 customers of these products, including federal governmentagencies, were at risk globally.The threat actors exploiting the Microsoft Exchange Server productswould have been able to leverage the vulnerabilities to gain access tofederal government email accounts and data, as well as install malwareon systems and harvest user credentials, which could have been used togain persistent unauthorized access to other networks at an impactedagency. According to CISA, this potential exploitation posed anunacceptable risk to federal civilian executive branch agencies becauseof the likelihood of vulnerabilities being exploited and the prevalence ofaffected software in the federal enterprise. Thus, CISA determined thatfederal agencies must take emergency action to address the threat.We performed our work under the authority of the Comptroller General toconduct an examination of these cybersecurity incidents in light ofwidespread congressional interest in this area. Specifically, our objectiveswere to (1) provide a summary of the SolarWinds and MicrosoftExchange cybersecurity incidents, (2) determine the steps federal5CISAEmergency Directive 21-02 states that any operational Microsoft Exchange Servershosted by or on behalf of federal agencies that had been connected to the Internet, eitherdirectly or indirectly, are considered on-premises instances. Hosted servers denote anyinstance of Microsoft Exchange Servers hosted by or on behalf of federal agencies onagency or third-party premises, excluding Microsoft Office 365. CISA, Mitigate MicrosoftExchange On-Premises Product Vulnerabilities, Emergency Directive 21-02 (March 3,2021).6Azero-day vulnerability can lead to a threat actor exploiting a previously unknownhardware, firmware, or software vulnerability, which has no existing official fix or patch.Page 2GAO-22-104746 Cybersecurity
Letteragencies have taken to coordinate and respond to the incidents, and (3)identify lessons federal agencies have learned from the incidents.To address the first objective, we interviewed officials from the agenciescomprising the Cyber Unified Coordination Groups (UCG) for theseincidents: CISA, Department of Justice’s (DOJ) Federal Bureau ofInvestigation (FBI), the Office of the Director of National Intelligence(ODNI), and the National Security Agency (NSA).7 We collected andreviewed descriptions of the incidents, including timelines and entitiesinvolved, and researched blogs from cybersecurity research firms andvendors to better understand the technical aspects of the incidents.Based on the information collected from agencies and our research, wedeveloped graphics to depict the key activities that occurred during thetwo incidents. We shared the graphics with the agencies to verify that wewere accurately describing the incidents.To address the second objective, we reviewed documentation such asfederal agency press releases, response plans, and joint statements fromthe UCG agencies. In addition, we collected and analyzed emergencydirectives, mitigation guidance, advisories, alerts, timelines anddescriptions of coordination and response activities, and malwareanalysis reports from UCG agencies. We reviewed transcripts andtestimony statements from several hearings held on the incidents. Wealso interviewed officials from the UCG agencies to identify steps taken incoordinating and responding to the incidents, and work that remained tobe completed.Further, we collected and reviewed required reporting documentationsubmitted by the 24 major federal agencies8 in accordance with CISA’s7ACyber Unified Coordination Group can be formed to coordinate the federal response toa significant cyber incident.8Majorfederal agencies include those for which the Chief Financial Officers (CFO) Act of1990 established a CFO position, referred to as CFO Act agencies. The CFO Actagencies are the Departments of Agriculture, Commerce, Defense, Education, Energy,Health and Human Services, Homeland Security, Housing and Urban Development, theInterior, Justice, Labor, State, Transportation, Treasury, and Veterans Affairs; theEnvironmental Protection Agency, General Services Administration, National Aeronauticsand Space Administration, National Science Foundation, Nuclear Regulatory Commission,Office of Personnel Management, Small Business Administration, Social SecurityAdministration, and the U.S. Agency for International Development.Page 3GAO-22-104746 Cybersecurity
LetterEmergency Directives associated with these incidents.9 We also collectedand reviewed any incident reporting documentation submitted by the 24major federal agencies associated with the Office of Management andBudget (OMB) incident reporting guidance.10 After reviewing the incidentreporting documentation, we identified what steps the 24 major federalagencies took to coordinate and resolve the incidents, and what workremained to be completed.To address the third objective, we collected information throughinterviews with CISA, FBI, ODNI, NSA, and the National Security Council(NSC).11 We requested information on lessons learned from the 24 majorfederal agencies if they had identified any through after action reports foreither incident. Through our interviews and collection, we categorized andgrouped lessons federal agencies have learned from the incidents,including positive practices that resulted in improved coordination andnegative practices that resulted in undesirable outcomes in thecoordination and response to the incidents.We conducted this performance audit from January 2021 to January 2022in accordance with generally accepted government auditing standards.Those standards require that we plan and perform the audit to obtainsufficient, appropriate evidence to provide a reasonable basis for ourfindings and conclusions based on our audit objectives. We believe thatthe evidence obtained provides a reasonable basis for our findings andconclusions based on our audit objectives.BackgroundThe exploitation of information and communications technology (ICT)products and services through the supply chain is an emerging threat.ICT supply chain-related threats can be introduced in the manufacturing,9CISA,Mitigate SolarWinds Orion Code Compromise, Emergency Directive 21-01 (Dec.13, 2020) and CISA, Mitigate Microsoft Exchange On-Premises Product Vulnerabilities,Emergency Directive 21-02 (March 3, 2021).10OMB,Fiscal Year 2020-2021 Guidance on Federal Information Security and PrivacyManagement Requirements, OMB Memorandum M-21-02 (Washington, D.C.: Nov. 9,2020).11Theofficials from the UCG agencies referred us to the NSC who had the responsibilityto conduct the post-incident review and document the lessons learned. A 60-day reviewwas conducted on the SolarWinds incident by the NSC. According to multiple officials, noformal review would be conducted on the Microsoft Exchange Server incident.Page 4GAO-22-104746 Cybersecurity
Letterassembly, and distribution of hardware, software, and services. Moreover,these threats can appear at each phase of the system development lifecycle, when an agency initiates, develops, implements, maintains, anddisposes of an information system. As a result, the compromise of anagency’s ICT supply chain can degrade the confidentiality, integrity, andavailability of its critical and sensitive networks, IT-enabled equipment,and data. Such was the case as a threat actor maliciously accessed thenetworks of several federal agencies by compromising a networkmanagement suite of products developed and sold by SolarWinds—aTexas-based network management software company.A zero-day exploit, the type used in the Microsoft Exchange incident, isan exploit that takes advantage of a security vulnerability previouslyunknown to the general public. By writing an exploit for the previouslyunknown vulnerability, an attacker creates a potent threat since thecompressed time frame between public discoveries of both makes itdifficult to defend against. Microsoft discovered that several versions of itsenterprise email and calendar server software, Microsoft ExchangeServer, were vulnerable to a number of zero-day exploits which had thepotential of exposing federal agencies that had the software installed tocompromise.The emergence of increasingly sophisticated threats and the continuousreporting of cyber incidents underscores the continuing and urgent needfor effective information security. Threats come from a variety of sourcesand vary in terms of the types and capabilities of the actors, theirwillingness to act, and their motives. For example, advanced persistentthreats (APT) pose increasing risks.12 The SolarWinds and MicrosoftExchange cybersecurity incidents are examples of far-reaching andcomplex threats against the federal government that warrant furtheranalysis and review. These incidents reinforce the need for a fast andeffective federal response.12NISTSpecial Publication 800-53 revision 5 defines an advanced persistent threat as anadversary that possesses sophisticated levels of expertise and significant resources whichallow it to create opportunities to achieve its objectives by using multiple attack vectors,including cyber, physical, and deception. These objectives typically include establishingand extending footholds within the IT infrastructure of the targeted organizations forpurposes of exfiltrating information, undermining or impeding critical aspects of a mission,program, or organization; or positioning itself to carry out these objectives in the future.Page 5GAO-22-104746 Cybersecurity
LetterGAO Has Previously Reported on Federal CybersecurityWeaknessesWe have previously reported that the federal government continues toface numerous cybersecurity weaknesses due, in large part, to ineffectiveinformation security programs. In addition, the cyber threat to criticalinfrastructure continues to grow and represents a national securitychallenge.13We have also reported that federal agencies had not effectively managedsupply chain risks, yet the growing dependence on a globally distributedsupply chain—and the lack of control over and visibility into how ICTproducts and services are developed, integrated, and deployed—presented an increasing amount of risk to federal agencies.14 SuccessfulICT supply chain attacks by threat actors can have a range of impacts.For example, threat actors could take control of federal informationsystems; decrease the availability of materials or services needed todevelop systems; destroy systems, causing injury and loss of life,15 and13GAO,High-Risk Series: Federal Government Needs to Urgently Pursue Critical Actionsto Address Major Cybersecurity Challenges, GAO-21-288 (Washington, D.C.: Mar. 24,2021) and Critical Infrastructure Protection: Additional Actions Needed to IdentifyFramework Adoption and Resulting Improvements, GAO-20-299 (Washington, D.C.: Feb.25, 2020).14GAO,Cybersecurity: Federal Agencies Need to Implement Recommendations toManage Supply Chain Risks, GAO-21-594T (Washington, D.C.: May 25, 2021);Information Security: Supply Chain Risks Affecting Federal Agencies, GAO-18-667T(Washington, D.C.: July 12, 2018); High-Risk Series: Urgent Actions Are Needed toAddress Cybersecurity Challenges Facing the Nation, GAO-18-622 (Washington, D.C.:Sept. 6, 2018); State Department Telecommunications: Information on Vendors andCyber-Threat Nations, GAO-17-688R (Washington, D.C.: July 27, 2017);Telecommunications Networks: Addressing Potential Security Risks of ForeignManufactured Equipment, GAO-13-652T (Washington, D.C.: May 21, 2013); and ITSupply Chain: National Security-Related Agencies Need to Better Address Risks,GAO-12-361 (Washington, D.C.: Mar. 23, 2012).15Forexample, counterfeit batteries can contain volatile chemicals which may explode,counterfeit cabling and other components may lack insulation and melt during use andcatch fire, and basic safety components may send dangerous electrical currents from afaulty charger directly into cell phones.Page 6GAO-22-104746 Cybersecurity
Lettercompromising national security; or steal intellectual property16 andsensitive information. As a result, the compromise of an agency’s ICTsupply chain can degrade the confidentiality, integrity, and availability ofits critical and sensitive networks, IT-enabled equipment, and data.17Since 2010, we have made more than 3,700 recommendations toagencies aimed at addressing cybersecurity challenges facing thegovernment. While agencies have implemented a majority of ourrecommendations, many face challenges in safeguarding theirinformation systems and information, in part, because many of theserecommendations have not been fully implemented.In 2018, we reported that the federal government needed to address fourmajor cybersecurity challenges: (1) establishing a comprehensivecybersecurity strategy and performing effective oversight, (2) securingfederal systems and information, (3) protecting cyber criticalinfrastructure, and (4) protecting privacy and sensitive data. We continueto report on these challenges and the need to address them. We reiteratethe importance of addressing the four major cybersecurity challenges andthe 10 associated critical actions in figure 1.16Infiscal year 2018, U.S. Customs and Border Protection and U.S. Immigration andCustoms Enforcement Homeland Security Investigations seized 213 shipments ofcomputer networking equipment affixed with counterfeit trademarks with a totalmanufacturer suggested retail price value of nearly 15.5 million. This is a 25 percentincrease in the number of seizures of computer networking equipment, and a 112 percentincrease in manufacturer suggested retail price value over the previous fiscal year. Thenetworking equipment seized allegedly violated a total of seven trademarks recorded withthe Customs and Border Protection and occurred at 21 ports around the country.17GAO-21-288.Page 7GAO-22-104746 Cybersecurity
LetterFigure 1: Ten Critical Actions Needed to Address Four Major Cybersecurity ChallengesPresidential Policy Directive and OMB Guidance Outlinethe Federal Response to Cybersecurity IncidentsThe Presidential Policy Directive (PPD)-41 sets forth principles to governthe federal government’s response to cyber incidents (such as thosePage 8GAO-22-104746 Cybersecurity
Letterdescribed earlier) to achieve unity of effort and coordination between thepublic and private sectors.18 PPD-41 states that federal agencies are toundertake three concurrent lines of effort when responding to any cyberincident:·Threat response activities include conducting appropriate lawenforcement and national security investigative activity at the affectedentity’s site, collecting evidence, and gathering intelligence. Theseactivities also include providing attribution, linking related incidents,identifying additional affected entities, identifying threat pursuit anddisruption opportunities, developing and executing courses of actionto mitigate the immediate threat, and facilitating information sharingand operational coordination with asset response.·Asset response activities include furnishing technical assistance toaffected entities to protect their assets, mitigate vulnerabilities, andreduce impacts of cyber incidents. These activities also includeidentifying other entities that may be at risk and assessing their risk ofthe same or similar vulnerabilities; assessing potential risks to thesector or region, including potential cascading effects, and developingcourses of action to mitigate these risks. In addition, asset responseincludes facilitating information sharing and operational coordinationwith threat response; and providing guidance on how best to utilizefederal resources and capabilities in a timely, effective manner tospeed recovery.·Intelligence support and related activities facilitate the building ofsituational threat awareness and sharing of related intelligence, theintegrated analysis of threat trends and events, the identification ofknowledge gaps, and the ability to degrade or mitigate adversarythreat capabilities.In addition, when a federal agency is an affected entity, the directivestates that the affected agency is to undertake a fourth concurrent line ofeffort to manage the effects of the cyber incident on its operations,customers, and workforce.Cyber Unified Coordination GroupsIn addition to the efforts that PPD-41 requires of federal agenciesindividually, it also provides for the formation of a UCG to coordinate afederal response to a significant cyber incident. According to PPD-41, a18TheWhite House, United States Cyber Incident Coordination, Presidential PolicyDirective/PPD-41 (Washington, D.C.: July 26, 2016).Page 9GAO-22-104746 Cybersecurity
LetterUCG may be formed and activated in the event of a significant cyberincident, will be incident specific, and will be formed:·At the direction of the NSC Principals Committee (Secretary level),Deputies Committee (Deputy Secretary level), or the Cyber ResponseGroup; 19·When two or more federal agencies that generally participate in theCyber Response Group, including relevant sector specific agencies,request its formation; or·When a significant cyber incident a
Responding to the SolarWinds and Microsoft Exchange Incidents 32 Agency Comments 36 Appendix I: Detailed Timelines of Steps Taken by Cyber Unified Coordination Group Agencies in Response to the SolarWinds and Microsoft Exchange Incidents 40 Appendix II: GAO Contacts and Staff Acknowledgments 44 GAO Contacts 44 Staff Acknowledgments 44 Tables
