In Other Words – instead of assuming a risk profile, and assess risks – assume it will happen to you (it is just a matter of time). Now what? In fact it may be a good exercise to think about the ramifications of a failure in cybersecurity. The idea is to create a scenario … Read more
Let us not make the same mistakes as we may have done in the past when it was time to move to a new year. We should review the current year(2021) So what happened in 21 that may be different with 22? What should we focus on planning for new year? Of course Jocko Willink … Read more
Affected Software A significant number of Java-based applications are using log4j as their logging utility and are vulnerable to this CVE. To the best of our knowledge, at least the following software may be impacted: Apache Struts Apache Solr Apache Druid Apache Flink ElasticSearch Flume Apache Dubbo Logstash Kafka Spring-Boot-starter-log4j2 So you can see that … Read more
Due to an actively exploited zero-day vulnerability: https://thehackernews.com/2021/12/extremely-critical-log4j-vulnerability.html This bug is a 10 of 10 on the CVSS rating from the article a snippet: Tracked as CVE-2021-44228 and by the monikers Log4Shell or LogJam, the issue concerns a case of unauthenticated, remote code execution (RCE) on any application that uses the open-source utility and affects … Read more
2 stories from the Hacker News: Solar Winds Hackers Targeting Government and Why everyone needs to take the latest CISA directive seriously The Solarwinds hack from last year (the one I discussed in several stories including this one: SolarWinds hackers Hacked Multi-factor Authentication. It is sometimes instructive to review past hacks to see what … Read more
