IT Central Station is now PeerSpot: Here's why
2021-12-13T05:32:00Z

What does the Log4j/Log4Shell vulnerability mean for your company?


What does Log4j/Log4Shell mean?


Hi peers,

I believe many of you have already heard of the recent Log4j/Log4Shell vulnerability that allows attackers to perform remote code execution (RCE).

What does it mean for an organization? How can you check you're vulnerable and mitigate/patch it now, if at all?

Lastly, what impact do you see this can have in the near future?

Thanks

PeerSpot user
Guest
511 Answers

SimonClark - PeerSpot reviewer
Top 5LeaderboardReal User

This vulnerability is particularly critical because Log4j is widely used in open source and commercial software and remote exploitation of the vulnerability against any internet-facing server is trivial using a single HTTP post. Exploitation results in full system compromise. The vulnerability has a CVSS Score of 10 out of a possible 10 meaning it is as bad as it gets.


Our SOC has launched a new app that detects the presence of vulnerable versions of Log4j however, detecting it does not mean you have been exploited.


My advice: Scan your network to get a full visibility report i.e. find all your legacy and shadow IT that you didn't know existed which means you should find all potential instances of Log4j, patch all of the Log4J environments, monitor your systems 24/7 using your SOC and if you don't have a SOC invest in a Managed SOC provider. 

2021-12-14T09:39:07Z
Evgeny Belenky - PeerSpot reviewerEvgeny Belenky
Community Manager

@SimonClark thank you for your answer and for the advice!

ITSecuri7cfd - PeerSpot reviewer
Top 5LeaderboardReal User

Yet another chance to test our incident response procedures. 


So far I would say we're a B. Good on the process, and an A on team response and interactions and reducing threat risk were about a B. 


ID'g your external assets exposed to this vulnerability is your teams' #1 priority and mitigate or patch (if available) the threat. 


You also have to notify and communicate with any 3rd party to make sure they're aware so they can start the same process. You ALSO need to be fully aware of your vendors' weaknesses and defenses (mitigations, patches, knowledge and reaction time). 


Then be prepared to roll out patches or in this case shut systems down OR put mitigations in place immediately to mitigate risk to the entire environment.

2021-12-13T16:43:38Z
Jairo Willian Pereira - PeerSpot reviewer
Top 5LeaderboardReal User

One excellent opportunity for the company to test your CMDB/Inventory (at medium and big companies). 


Tenable, and I think, other Vulnerability Scanners offer a specific plugin used to check your infrastructure against Log4shell. 


If you don't have VS, you can try looking at your logging system for evidence or use:


https://buff.ly/3lYZRh0
https://gist.github.com/SwitHa...


In the future, Patch Mgmt pre-defined and applied schedules need to be first (proactive) from scanners/vulns. (reactive).

2021-12-13T11:53:51Z
Evgeny Belenky - PeerSpot reviewerEvgeny Belenky
Community Manager

@Jairo Willian Pereira thanks for the answer! Did you mean that Patch management should be pro-active (using pre-defined and manual patches) and one should use vulnerability scanners as reactive tools?
Thanks

Jairo Willian Pereira - PeerSpot reviewerJairo Willian Pereira
Top 5LeaderboardReal User

@Evgeny Belenky Yes, exactly with 1 point: not exactly "reactive" but a secondary tool to check environment. 
The main problem is that majority of companies are using VS as the primary tool (and using patch mgmt as a secondary one). In this case, you resolve the problem but not the root cause.

Evgeny Belenky - PeerSpot reviewerEvgeny Belenky
Community Manager
reviewer1572348 - PeerSpot reviewer
Top 5LeaderboardReal User

WhiteSource has released a utility to detect log4j vulnerability in the codebase. 


Take a look at this if it helps. In our case, a lot of projects use Elastic Search and Azure DevOps Server - both of them have log4j being used and that's where additional fixes have to be done.


https://github.com/whitesource/log4j-detect-distribution

2021-12-21T08:01:45Z
Evgeny Belenky - PeerSpot reviewerEvgeny Belenky
Community Manager

@reviewer1572348 thank you so much for the answer! And, I'm sure many of our community members will find it helpful.

Evgeny Belenky - PeerSpot reviewerEvgeny Belenky
Community Manager

@reviewer1572348 what have you been doing or what do you recommend to mitigate the issue? 

Evgeny Belenky - PeerSpot reviewer
Community Manager

Hello @Jangsun KIM, @Cuneyt KALPAKOGLU Phd. , @reviewer1572348, @Nachu Subramanian, @Letsogile-Baloi, @Nagaraj Sheshachalam, @Nadeem Syed, @reviewer1362132, @Chiheb Chebbi ​and @Abbasi Poonawala,


Can you please join this discussion and share your advice with the community?


Thank you!

2021-12-14T07:41:29Z
Buyer's Guide
Application Security
May 2022
Find out what your peers are saying about SonarSource, Veracode, Snyk and others in Application Security. Updated: May 2022.
599,220 professionals have used our research since 2012.