Home »
Last month, the Canadian Centre for Cyber Security published an alert on a severe security hole in a piece of software called Log4j, which is widely used for debugging, auditing, and data trafficking by e-commerce, enterprise applications, and cloud services. This issue, which mostly affects commercial clients, has resulted in a widespread and critical system vulnerability that necessitates prompt action.
What is Log4j?
According to one team tracking the impact, cybercriminals have made millions of exploit attempts of the Log4j 2 Java library since December 10, days after industry experts found a severe vulnerability known as Log4Shell in servers supporting the game Minecraft. The flaw might affect millions of more applications and devices throughout the world.
According to Dynatrace, Log4Shell is a software vulnerability in Apache Log4j 2, a popular Java library for logging error messages in applications. The vulnerability, published as CVE-2021-44228, enables a remote attacker to take control of a device on the internet if the device is running certain versions of Log4j 2.
What’s at risk?
The vulnerability leaves systems open to remote code execution, such as ransomware. Log4j is widely used in many applications and is present in services, including gaming platforms, e-commerce, and cloud applications. The software logs information about users’ IP addresses, browsers, requests made, and pages accessed. It also helps system administrators monitor software and identify bugs when things go wrong.
Who’s at risk?
Security experts expect that companies in the enterprise space will be most at risk for a cyberattack, as many of their online services and applications use the compromised web server software Log4j. Non-enterprise users could also be at secondary risk of attack, due to the use of Log4j by third-party online applications.
What should you do now?
Businesses should ensure user passwords have been changed and that they are using the most up-to-date versions of their online services and applications, including web browsers.
Businesses are strongly recommended to:
- Have their IT team determine if the vulnerability resides on their system
- If they find that any of their systems are running Java, prioritize those that can be accessed from the internet
- If they cannot immediately patch, disable Log4j features until they can
The Canadian Centre for Cyber Security also has some thorough information and recommendations on how to resolve this issue, as well as additional assistance on how to protect your customer’s business from cybercrime.
Expert Advice from The Magnes Group
At the Magnes Group, we do things differently. With effort and care, we deliver the very best personalized insurance coverage and risk management advice. We serve businesses and individuals who appreciate quality, precision, and value in a way that many other insurance brokerages can’t or won’t.
As an independent insurance broker, we pride ourselves on providing straightforward, uncomplicated, and honest advice. We treat others as we would like to be treated ourselves. Not to increase market share but because it’s the right thing to do. You can rely on the expert advice from the Magnes Group.
Contact
"*" indicates required fields
