It’s all the rage today and it's not just a current trend. If you work in information technology, anywhere in the world, forget about holiday cheer and put a hold on the online shopping. It’s time to patch your servers. CISA issued a warning about a critical and potentially very dangerous zero-day vulnerability affecting everything from firewalls to IoT devices, both hardware and software...and that's a lot of things. Some are calling it the worst computer vulnerability seen in many years. The even worse news is that it’s being actively exploited and could allow the attackers to take control of any device it infiltrates. It was first noticed in the game Minecraft, owned by Microsoft and played by millions of people, many of them children. It’s time to scramble to patch those systems. And that’s the good news. There is a patch.
The vulnerability, being called “Log4Shell,” was reported to the Apache Software Foundation, which oversees the development of the software (Log4j) that is affected, by the Chinese firm Alibaba. The Apache group immediately started working on a fix for it, so now it’s available to all…and there is a long list that includes Amazon, Apple, and Twitter.
While end users will need to rely on their vendors to take care of this issue, vendors should also be letting users know what they are doing to resolve this. CISA provides other suggestions for organizations, while they are working on applying the patch to their systems.
- Determine any external facing devices that have Log4j installed.
- Make sure that the security operations center is noting every single alert on the devices that fall into the category above.
- Install a web application firewall (WAF) with rules that automatically update so that your security personnel are able to concentrate on fewer alerts.
The updated version of log4j should be installed with the utmost priority. This is not to be taken lightly, but should be bumped to the top of the IT or cybersecurity department’s priority list. Proof of concept code has been published and is being used as you read this. More information can be found by referring to CVE-2021-44228 which is one of many CVE's regarding the vulnerability or you can read the Apache advisory.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
