The recent data breach at Marquis Software Solutions, impacting over 400,000 customers across dozens of financial institutions, is a sobering moment for the cybersecurity industry and requires (yet again) that we look at the incident with a critical eye toward understanding the structural failures at play.
Simply stated, the breach is yet another stark reminder of an uncomfortable truth: In the modern threat landscape, legacy, on-premise, and network-centric IT systems are fighting a losing battle.
According to regulatory filings, the Marquis breach was caused by a known, but unpatched, vulnerability in a SonicWall firewall appliance. This highlights the brutal reality faced by organizations maintaining traditional, on-premise infrastructure.
Bad actors operate with a dual strategy. They relentlessly hunt for zero-day vulnerabilities (unknown flaws) to launch surprise attacks. But just as frequently, they scan for known vulnerabilities in systems that IT teams simply haven’t had the time or resources to patch yet.
For organizations like Marquis, keeping pace is a Herculean task. Managing on-premise appliances requires a constant cycle of downtime, testing, and deployment. When you rely on network-centric security, a single missed patch on a perimeter firewall turns your trusted infrastructure into an open door for groups like the Akira ransomware gang.
While the Marquis incident involved a network firewall, the underlying narrative is strikingly similar to the wave of breaches we’ve seen targeting legacy Managed File Transfer (MFT) systems over the last three years.
We have watched high-profile zero-day exploits wreak havoc on on-premise MFT solutions like Progress MOVEit, Fortra GoAnywhere, and Accellion (Kiteworks).
Whether it is a firewall appliance or a file transfer server, these systems represent concentrated points of failure. They sit on a network, often holding or guarding massive troves of sensitive data. If the defender misses a patch (as with Marquis) or if the attacker exploits a previously unknown zero-day (as with MOVEit), the "castle and moat" defense collapses, and the data is lost.
Recommended Reading: Challenging the Castle Mentality
This incident serves as a critical reminder to traditional IT shops: It is time to eliminate the burden of on-premise infrastructure.
Modern, cloud-native software services shift the paradigm. In a true SaaS model, security patches are deployed instantly and globally by the vendor. There is no "patch Tuesday" for the customer; there is only continuous security. By moving away from hardware appliances and legacy servers, organizations reduce their attack surface and eliminate the lag time between vulnerability discovery and remediation.
Recommended Reading: Why Not Both? A Data-Centric View of Cloud Privacy vs. AI Productivity
At Virtru, we don't build firewalls, so we cannot replace the SonicWall device that was exploited at Marquis. However, we do solve the problem of securing the data that flows through these organizations.
Just as the Marquis breach highlights the risks of legacy firewalls – the struggles of Progress MOVEit and GoAnywhere highlight the risks of legacy file transfer.
Virtru Secure Share represents the modern alternative to these vulnerable, on-premise MFT systems. It is a cloud-native SaaS platform designed for the reality of today's threats.
The era of trusting a firewall to protect a server full of sensitive data is over. The Marquis breach is a massive failure, but it is also a signal. It is time to retire the legacy infrastructure that keeps failing us and embrace a data-centric, cloud-native future.