D&O Duty to Defend vs. Reimbursement PoliciesApache Log4J is a popular logging utility used by many businesses to log online activity across a variety of different platforms including Windows, Linux, and MacOS. However, a recent security flaw discovered in the Log4J utility has software developers and federal agents scrambling to eliminate the flaw and mitigate damages. This event is another example of increasing cybersecurity exposures that have become the focal point for millions of companies doing business online. How can Log4J cyber exposures affect your business?
What Is Log4J?
Apache Log4J is a popular logging utility used commonly by commercial software developers. Maintained by the open-source Apache Software Foundation, the software is written in Java programming language and powers webcams, car navigation systems, medical devices, and other tools.
Gartner says that the Log4J vulnerability is extremely widespread, with the potential to impact enterprise applications, embedded systems, and sub-components. The GitHub community is compiling a list of impacted manufacturers and components, but it may not be verified or complete.
The Log4J Security Breach
Apache was notified of the security breach by an employee at the Chinese tech company Alibaba on November 24, according to Bloomberg. The volunteer programmers at Apache then raced to develop a fix. However, hackers began to exploit the flaw before all users could apply the patch. Head of CISA cybersecurity Eric Goldstein said that “We expect remediation will take some time.” According to the LA Times, Log4J software is usually embedded in third-party programs where only the operators of those programs can make updates and changes.
Outside of these patches, detection is the biggest concern. Security pros in the space are now expected to actively monitor the software to identify and effectively “shut” open doors to networks and devices. Goldstein fears that damage could be widespread, and that information leaked could be “utilized by adversaries to cause real harm.”
Some in the cybersecurity community are concerned that damage has already been done. According to an article from The Conversation, hacking objectives using the security breach include everything from access to information on geopolitical rivals, mining bitcoin, and installing ransomware on various internet gaming servers. The backlash from the breach is a harsh reminder of the delicate boundaries between information we keep and information we expose to others.
Log4J Cyber Exposures
Nearly all software logs activity for a variety of utilities, meaning that Log4J cyber exposures are potentially widespread. The U.K.’s National Cyber Security Centre warns that the recent breach will affect both individuals and organizations.
For individuals, Log4J is likely ingrained in the products and services we use every day. From web cameras to medical devices, Log4J is a critical component of logging in everyday lives. To protect yourself, the best thing to do is to consistently update all the devices and applications you use.
For businesses and organizations, Log4J cyber exposures can be more detrimental. The FTC says that remedial steps must be taken to ensure that a company’s practices do not violate the law. To avoid issues, the NCSC recommends the following actions:
- Install the latest updates where Log4J is known to be used as soon as possible.
- Identify where Log4J exists in your business functions.
- Execute effective network monitoring/controls.
It’s important to note that many businesses may not know which devices or networks utilize Log4J software. To mitigate your business risk to Log4J cyber exposures, communicate with customers and other stakeholders in your business so that they can also install mitigation measures and software updates.
How to Protect Your Company from Log4J Cyber Exposures
In an increasingly digitized world, the demand for efficient software has created a new wave of cyber exposures for organizations. The Log4J security breach is a strong reminder for businesses and individuals to adhere to recommendations from cybersecurity and software experts. It’s also a reminder that cyber exposures are relentless, affecting businesses of all sizes and types.
Have questions about cyber insurance? Contact Heffernan Insurance Brokers.
