By Gregory Hale
Ten months after first discovering Log4j, 72 percent of organizations still remain susceptible to the “pervasive” vulnerability, new research found.
In the end, the research showed legacy vulnerability remediation challenges, which are the root cause of the majority of data breaches, according to a telemetry analysis from security provider, Tenable. And, like a vampire, once remediated, the Log4j, or Log4Shell, vulnerability can reoccur.
When Log4Shell first ended up discovered in December 2021, organizations around the world scrambled to determine their risk. In the weeks following its disclosure, organizations significantly reallocated resources and invested tens of thousands of hours to identification and remediation efforts. One federal cabinet department reported its security team devoted 33,000 hours to Log4j vulnerability response alone, the Tenable researchers said.
To that end, Tenable telemetry found one in 10 assets (10 percent) was vulnerable to Log4Shell as of December 2021, including a wide range of servers, web applications, containers and IoT devices. October 2022 data showed improvements, with 2.5 percent of assets vulnerable. Yet nearly one third (29 percent) of these assets had recurrences of Log4Shell after full remediation was achieved.
“Full remediation is very difficult to achieve for a vulnerability that is so pervasive and it’s important to keep in mind that vulnerability remediation is not a one and done process,” said Bob Huber, chief security officer at Tenable. “While an organization may have been fully remediated at some point, as they’ve added new assets to their environments, they are likely to encounter Log4Shell again and again. Eradicating Log4Shell is an ongoing battle that calls for organizations to continually assess their environments for the flaw, as well as other known vulnerabilities.”
“Tenable’s finding that 29 percent of IT assets had recurrences of Log4Shell after full remediation doesn’t surprise me,” said Eric Byres, chief technology officer at software bill of material (SBOM) provider, aDolus. “In fact, I’d expect the situation to be worse in the OT space. Even a year after the Log4j announcement, we are still finding instances of the vulnerability in OT software being shipped to end users. In several cases the ‘patch’ appeared to be nothing more than renaming or wrapping the offending JAR files to make them harder to detect. Yet, detection is critical because the CVE is in CISA’s Known Exploited Vulnerabilities Catalog. The bad guys are actively taking advantage of unpatched systems.
“For OT, determining if a new software product or upgrade has reintroduced a vulnerable Log4j component is challenging — network scanning (the traditional IT detection method) is typically prohibited on OT networks. That is why the current focus on Software Bill of Materials (SBOMs) is so important for OT. By analyzing all software before it is installed on the plant floor, vulnerable Log4j components can be detected and dealt with in advance, before deployment.
“Much of the SBOM focus has been on new software, but that doesn’t work for OT. As Tenable notes, OT is rife with legacy equipment. In many cases, vendors can’t provide SBOMs because they no longer have (or never had) source code. Plus the vulnerable versions go back almost a decade. As a result, SBOM generation from the software binaries is important. Also important is continuous monitoring of SBOMs. Log4j is definitely not the last vulnerability OT will have to deal with. When the next issue is discovered, industrial operators need immediate intelligence telling them where vulnerable software is hiding in their operation,” Byres said.
Click here to view a resource from aDolus can help organizations respond to Log4j.
Other key findings from the data include:
- 28 percent of organizations across the globe have fully remediated Log4Shell as of October 1, a 14-point improvement from this past May.
- 53 percent of organizations were vulnerable to Log4j during the time period of the study, which underscores the pervasive nature of Log4j and the necessary ongoing efforts to remediate even if full remediation was previously achieved.
- As of this October, 29 percent of vulnerable assets saw the reintroduction of Log4Shell after full remediation was achieved.
- Some industries are in better shape than others, with engineering (45 percent), legal services (38 percent), financial services (35 percent), non-profit (33 percent) and government (30 percent) leading the pack with the most organizations fully remediated. Approximately 28 percent of CISA-defined critical infrastructure organizations have been fully remediated.
- Nearly one third of North American organizations have fully remediated Log4j (28 percent), followed by Europe, Middle East and Africa (27 percent), Asia-Pacific (25 percent) and Latin America (21 percent).
- North America is the top region with the percentage of organizations that have partially remediated (90 percent), Europe, Middle East and Africa (85 percent), Asia-Pacific (85 percent), and Latin America (81 percent).
Click here for more Log4Shell information from Tenable.