It was an unwelcome early Christmas gift shared with the entire world on December 9th, 2021. Log4Shell rocked the industry when we realized just how dangerous and far-reaching its effects could be. The mad scramble to find and patch the flaw left many organizations wondering why they weren’t better prepared in the first place and what they need to do next.
Some are still scratching their heads, prompting the FTC to issue words of warning about remediating this dangerous flaw. With good reason – the Log4Shell vulnerability remains a prime target for bad guys. Without a patch, thousands of organizations relying on the affected Log4j library are still under severe risk of an attack.
Fortunately, we can learn a lot from the Log4Shell shock waves we’re feeling. Invicti’s Chief Product Officer Sonali Shah recently sat down with the founder of NOC and CleanBrowsing Tony Perez to peel back the layers and better understand how we can all stay agile in incident response.
Watch the full webinar here: Log4j Lessons Learned: How to Prepare Your Company to Respond to the Next Zero-Day Vulnerability.
Turning the tide on surprise security flaws
Log4Shell might be the worst vulnerability we’ve ever seen. It impacts Apache Log4j, a popular Java logging library, and it’s incredibly easy to exploit. If the attacker is able to escalate the situation, it gives them the window to take full control remotely where they can steal data, hop from server to server, and even install ransomware.
There’s a strong possibility for bad actors to avoid detection by staying inside, staying hidden, and waiting for the right moment to strike like we saw with SolarWinds. Couple that lingering threat with how pervasive the library is and how integral it can be for so many apps, and we’ve got a problem.
Log4Shell is an example of why it’s so important to have a handle on your threat landscape. As Sonali pointed out, mitigation becomes an issue when organizations aren’t aware of what’s in their asset inventory or don’t even have an inventory to begin with. Identifying external applications and components, then defining the asset inventory, will give you a full picture of the potential threat landscape.
After getting a handle on what you know about the incident, an important next step is to scan your environment and identify the total scope of the problem. Then, work backward leveraging critical elements of AppSec like incident response, prioritization, frameworks, policies, and governance programs.
As in the case of Log4Shell, Tony noted that major security incidents tend to happen around holidays or in the middle of the night when it’s least convenient, spelling frustration for everyone from customers to the legal team. Ultimately, the key to success is having patience amidst the mayhem, going through these processes unemotionally and very pragmatically with a step-by-step approach that leaves little room for panic.
The integration of people, process, and technology
Effective incident response is all about having the right people covering the right processes, with the right technology at their fingertips. Sonali noted that in the case of Log4Shell, Invicti customers with these three boxes checked tend to have faster and more effective responses to new incidents. It’s often a matter of changing company culture, though, with top-down direction around security coming from the board, management teams, and executive leadership.
But it’s also important to dedicate some of your program to ensure that you have defense in depth. Both the defense in-depth and defensive controls are important as the landscape continues to evolve at such a rapid pace, with new threats emerging daily. Organizations need to look at which defensive controls they have in place if they want to up their security game and be prepared for the next global vulnerability.
The key takeaway according to Sonali and Tony? Go back to the basics. That includes defense-in-depth along with having the right people and procedures in place with technology that is scalable and automated to expedite tedious processes. But most importantly, it includes knowing your attack surface and making sure that security is always top of mind for the entire organization.
Get all the details on lessons learned from Log4Shell by watching the full webinar recording here.
Get the latest content on web security
in your inbox each week.
THE AUTHOR
Marketing Content Team Lead
