Many more Log4j will be there, how to deal with it?
By now everyone knows about Log4j. Thanks to widespread coverage in the cyber and subsequent main stream media, everyone has heard the word either from techie or from their kid playing minecraft.
What is so much fuss?
A flaw in commonly used internet software known as Log4j has left companies and government officials scrambling to respond to a glaring cybersecurity threat to global computer networks.
The bug revealed last week could enable potentially devastating cyberattacks that span economic sectors and international borders, according to security experts.
U.S. officials say that hundreds of millions of devices are at risk, while researchers & major technology companies warn that hackers linked to foreign governments and criminal ransomware groups are already probing how to exploit the vulnerability within targets’ computer systems.
Why is Log4j bad now?
Its not bad, the vulnerability discovered if left unhandled, unpatched is bad. Software developers use the Log4j framework to record user activity and the behavior of applications for subsequent review. Distributed free by the nonprofit Apache Software Foundation, Log4j has been downloaded millions of times and is among the most widely used tools to collect information across corporate computer networks, websites and applications.
What can I do now with Log4j and many more such threats?
- Listen to your vendor bulletins and make it a priority to download, test and deploy the patches.
- Review, Adjust your firewall settings to minimalize the outgoing traffic from your network.
- Contact Rainbow Secure team to get extra help with patching and go discuss options to replace Log4j with your own Risk analytics and Threat monitoring system that understands your infrastructure, application architecture and work to full proof your environment against such attacks.
- Discuss with us options to mitigate cyber risks, reduce such panicking in future with other exploits. #opensource has been bedrock of many commercial systems today but is time to evaluate it in view of #supplychain attacks that are unfolding in various forms. Its time to collaborate with the security community to continue to have reliable and secure digital systems. Its not just about your business, its about your clients, your customers who depend on your business.
Let us help you enhance your application security, devsecops and mitigate risks related to account take over attacks, bruteforce attacks, credential stuffing attacks, ransomware and much more.
Don’t wait act now. Schedule a complimentary cyber risk assessment today.
https://outlook.office365.com/owa/calendar/SecurityConsultation@rainbowsecure.com/bookings/
