We are still failing to learn the most important lesson in cybersecurity. That needs to change, fast
One year ago, a newly discovered zero-day vulnerability rocked the world of cybersecurity, but 12 months on, there are clear signs that vital lessons haven't been learned.
The catchily-titled CVE-2021-44228 was and still is an easy to exploit vulnerability in the widely used Java logging library Apache Log4j, which enables attackers to remotely gain access to and take control of machines and servers.
Upon discovery, it was a massive concern, because the ubiquitous nature of Log4j meant it was (and is) embedded in a vast array of applications, services and enterprise software tools that are written in Java and used by organizations and individuals around the world.
Security
Such was the danger posed by Log4j that the National Institute of Standards and Technology (NIST) gave the vulnerability a Common Vulnerability Scoring System (CVSS) score of 10 – classing it as a highly severe, critical vulnerability – and within hours of disclosure, it was being exploited by cyber criminals.
Also: Cybersecurity: These are the new things to worry about in 2023
No wonder CISA chief Jen Easterly described the Log4j vulnerability as "one of the most serious that I've seen in my entire career, if not the most serious" – and it affected hundreds of millions of devices.
Security updates and mitigations were swiftly rolled out, yet a year on from the initial disclosure, Log4j still remains a threat because many organizations and and their suppliers are still yet to apply the updates.
Many might still not even be aware that the logging library is part of their software ecosystem.
But repeated warnings made it clear that the critical vulnerabilities posed a threat – and hacking groups ranging from cyber-criminal gangs and ransomware groups to nation-state backed cyber-espionage operations have all actively targeted Log4j vulnerabilities and continue to do so.
Just last month – almost a year on from the initial disclosure – CISA and the FBI put out a security alert, warning that if organizations hadn't yet patched or mitigated Log4j vulnerabilities, they should assume their network is compromised and act accordingly.
The alert came after an investigation into a cyberattack against what CISA and the FBI describe as a 'federal civilian executive branch' organization. If a government body can't plug the security holes correctly, then what chances do other organizations have?
Also: Software development is still ignoring security. That needs to change fast
Cybersecurity moves quickly – it's tough work and information security teams regularly face burnout because there's always another new security vulnerability, or a new security update that needs applying. But cyber criminals don't forget about old security flaws and vulnerabilities – and as long as Log4j instances remain unmitigated, they'll be targeting them.
That means organizations can't just ignore vulnerabilities and issues and hope they just go away. Fixing these issues is a challenge, but taking notice of security alerts and warnings to ensure your network is protected is an absolute must.
It's just one of the reasons why the responsible thing for organizations of any size to do is to provide the budget for a suitably sized information security team, which can help detect and mitigate threats before they affect your business and its customers.
ZDNET'S MONDAY OPENER
ZDNET's Monday Opener is our opening take on the week in tech, written by members of our editorial team.
PREVIOUSLY ON ZDNET'S MONDAY OPENER:
- Remote work is here to stay. So why is everyone still getting it so wrong?
- Three tech trends on the verge of a breakthrough in 2023
- Bosses say they're serious about cybersecurity. It's time for them to prove it
- Remote work has changed everything. And now it's still getting weirder
- Raising cybersecurity awareness is good for everyone - but it needs to be done better
- Want to work fewer hours but get more done? This could be the answer
- iPhone vs Echo: How Apple and Amazon are building different visions of your future
- Hybrid workers don't want to return to the office. But soon, they might have to