Three out of five organisations have fielded Log4j attacks

The recently identified vulnerability in the Log4j Java logging package has created headaches for security professionals around the world. Three-fifths (61 percent) of organisations responding to the latest Neustar International Security Council (NISC) survey, conducted in January 2022, said they had fielded attacks targeting this vulnerability. An even greater share (75 percent) reported having been impacted by Log4j, with one in five (21 percent) stating that impact had been significant.

The most commonly experienced impact of Log4j was the need for IT and security teams to work over the holidays to assess risk and make critical changes to protect infrastructure and data (52 percent), followed by a reevaluation of software supply chain security practices (45 percent) and software purchasing decisions (44 percent). A significant share of respondents had also moved to reevaluate existing vendor relationships (35 percent) or said the vulnerability reduced their trust in open-source tools (34 percent).

A large majority (87 percent) of respondents said that given the level of cyber risk posed by Log4j, government regulatory agencies (such as the U.S. Federal Trade Commission) should take legal action against organisations that fail to patch the flaw. In the words of one security professional, these organisations “may fail to secure and protect important customer data.” Another agreed: “It puts everyone at risk. We should have control over where our clients’ data ends up.” Another responded that companies large enough to address the problem should do so, and the federal government should enforce this mitigation, because “if they don’t, who will?”

“News of the Log4j threat sent security and applications teams around the globe into a frenzy of activity – taking inventory of their internet-facing systems, checking for Log4j, checking revision levels, and putting into effect emergency patching – and while many organisations took the appropriate proactive step of reaching out to business partners and vendors to assess the potential exposure, the timing made efforts to remediate that much more of a challenge,” said Carlos Morales, senior vice president of solutions at Neustar Security Services.

For companies that have deployed Web Application Firewall (WAF) technology or contract WAF functions from their cloud security providers, there may be a simple solution for handling Zero-Day threats like Log4j: virtual patching.

“Virtual patching can trick any potential attackers into thinking that your applications are not vulnerable to a threat,” added Morales. “WAF solutions are deployed in-line with web application traffic and act as reverse proxies between the clients of the application and the origin servers. The WAF terminates the connection with the client, ensures that the client is not performing any malicious actions, and then creates a separate connection to the server, bridging data between the two. Since it is terminating the client traffic, the WAF can act on behalf of the origin server and cover up for any vulnerabilities that exist on the server. Virtual patching is one of the ways that this is done.”

In addition to Log4j, the surveyed security professionals were asked about their other top concerns during the reporting period of November and December 2021. Distributed denial-of-service (DDoS) was ranked as the greatest concern by 21 percent of respondents, followed by ransomware and system compromise (both 18 percent). Ransomware, DDoS attacks and targeted hacking were the threats most likely to be perceived as increasing during the reporting period. The threats organisations focused their ability to respond to most during this period were vendor or customer impersonation, targeted hacking, and ransomware.

Delving into more detail on the survey participants’ top concern — DDoS attacks — revealed that 84 percent of enterprises had been on the receiving end of a DDoS attack at some point. A majority (57 percent) of responding organisations reported outsourcing their DDoS mitigation, and most (60 percent) said it typically took between 60 seconds and 5 minutes to initiate mitigation.