Last year ended with what many in the security world consider to be the worst cyberattack in history, the zero-day exploit known as ‘Log4j’ or ‘Log4Shell’. This incident was the perfect storm of severity, pervasiveness, and ease of exploitability, as it was widely used inside commercial and open-source software applications.
Federal agencies have worked diligently to patch the remote code execution (RCE) vulnerability – which would allow hackers to easily take complete control of affected endpoints and execute arbitrary code. Despite the remediation effort, agencies must prepare for future hacks exploiting this and similar vulnerabilities.
“We do expect Log4j to be used in intrusions well into the future,” said Cybersecurity and Infrastructure Security Agency director Jen Easterly in a virtual press conference. “We are concerned that threat actors are going to take advantage of this vulnerability,” especially against critical infrastructure targets.
And to add to these concerns, the Apache Software Foundation recently disclosed it will likely take years for IT teams to fully remediate because of the wide use of the error-logging software.
To minimize threats – and act quickly against future vulnerabilities – agencies need solutions that enable them to look inside every file within an enterprise in minutes.
You Cannot Protect What You Cannot See
The Log4j incident is a critical reminder of the importance of comprehensive endpoint visibility and control. We cannot predict where the next vulnerability will present itself so we must empower agencies to perform ad-hoc searches in addition to maintaining effective cyber hygiene. Agencies that have these basics in place before an incident occurs are in a better position to prevent damage or minimize the impact.
Agencies can’t rely too heavily on vulnerability management tools for finding vulnerabilities of this nature. Traditional vulnerability management tools scan installed applications, services, and configuration settings, but if a framework like Log4j is renamed, modified, or installed in a non-default path then it’s likely that those tools will miss them.
A solution that can detect, investigate, and respond to threats in real-time allows defenders to get ahead of the adversary and minimizes disruption. Real-time visibility and control of endpoints enables IT teams to protect their estate from threats, and increases resilience, and allows for continued operations.
How to Remediate Future Vulnerabilities
An organization’s best defense against becoming a victim is ensuring basic cyber hygiene. That starts with having accurate hardware and software asset inventories. With accurate data on installed software and utilization metrics, agencies can make informed decisions about tools rationalization and eliminate or reduce legacy applications.
Multifactor authentication, data encryption, and secure backups are key to improving cyber hygiene. Applying the principle of least privilege and need-to-know policies are also necessary components of a successful zero trust approach. OMB Memorandum M-22-09 establishes a Federal Zero Trust Strategy and starts the clock for agencies to meet objectives by the end of FY24. Zero trust practices reduce the attack surface by treating all users, devices, and other non-person entities as potential threats.
Leveraging a single platform that integrates endpoint management and security unifies teams, effectively breaks down the data silos and closes the accountability, visibility, and resilience gaps that often exist between IT operations and security teams. Hackers can no longer hide in the long timelines that it takes for teams to coalesce and remove threats.
A holistic platform approach also gives agencies end-to-end visibility across divisions, end users, servers, and cloud endpoints – giving them the ability to identify assets, protect systems, detect threats, respond to attacks, and recover at scale.
As malicious actors find advanced ways to infiltrate systems, it’s important for agencies to prepare – even if they aren’t fully aware of the new threat tactics. With the right security solutions and approaches agencies will ensure the protection of their network and endpoint devices.
