We continue our Log4j blog series with the second installment: a deep dive into the subject of vulnerability management. What does it involve? What tools to use? And how to operationalize it into a long-term strategic cybersecurity approach.
A blog series with the title The Log4J lessons might suggest that the fallout of the Log4j vulnerability is mostly behind us. Indeed, since the end of 2021 there has been tremendous effort from technology vendors, SOC’s and IT-departments to mitigate this threat. But given the widespread usage of this open-source logging library and the well-publicized ease of the attack, it’s highly unlikely that we’ve heard the last of Log4j in 2022.
On Thursday, December 9th a serious vulnerability was discovered in the much-used Apache Log4j Java logging library (Log4j). Through this vulnerability, an unauthenticated, unauthorized RCE (Remote Code Execution) is made possible, which can be used to take over a server. A patch was quickly made available, but executing said patch is proving to be a more complex activity.