Log4j: A CISO's Practical Advice

You've probably already read a ton of solid technical analysis about the Log4j vulnerability.

But that's not this post. Instead, this post is meant to provide some perspective from decades spent in CISO roles, and from many days now of peer conversations with other CISOs and CIOs — the same types of conversations that happen anytime something happens like Log4j or SolarWinds, or take your pick of security incidents with significant blast radius, impact, and longer-term concern.

That's not to minimize the concern; the Log4j vulnerability — also called Log4Shell — is one of the biggest security issues we've all seen this year and one, two weeks into its discovery, that we're only starting to understand. But it's easy to get weighed down in hype, marketing, and speculation and forget that there are important things we need to do, right now, to improve our posture, strengthen our team, and put us in a better position for the next Log4j.

Here's some CISO advice:

1. Lead with empathy and reach out to your security circles.
I've said it before and I'll say it again: Security professionals, CISOs or otherwise, tend to have each other's backs. Use that to make progress. Have empathy for each other and for your teams. It's the holiday season, we're still in a pandemic, and we're all working hard to limit exposure from products our organizations consume and develop.

I've spent a lot of time since this problem began reaching out to my CISO circles, and I've been heartened, but not surprised, to find that we're already working through this together, sharing success, failures, and opportunities. Remember: Your simple mitigation may be someone else's lifeline idea because they may lack a solution to a complicated security problem.

2. Get the clearest possible understanding of what's happening in your environment.
Log4j, in both what it can do and what we as technology leaders need to do to solve it, is fundamentally a cyber-hygiene and visibility-and-control issue. The technology is available to reveal everything to us about what apps we've running in the cloud — we're just not always building our security infrastructure in the most effective manner to take advantage of that.

As Netskope Threat Labs researcher Gustavo Palazolo noted to Dark Reading last week, "One of the main challenges that organizations face is identifying all compromised assets. The Log4j Apache Java-based logging library is very popular and can be used by many applications, as well as by IoT devices and legacy systems that are maintained for backwards compatibility. Even if an application is found to be vulnerable, updating it might be difficult because an organization may not be able to afford the downtime or lack proper patch management controls. Therefore, the time between identifying all compromised systems and fixing the problem can take a long time in some scenarios."

This is solvable with the right infrastructure that can provide you with the most granular visibility, context, and latitude to take action on what you're seeing.

3. Identify your true partners and make changes to those you do business with.
Day-by-day, and minute-by-minute, we often fail to document great ideas, points of insight, or things that will help us make better strategic decisions. That's natural: We're busy, and in times like these, we're grasping for quiet moments. But here's a piece of advice I adopted a long time ago and which has served me and my teams well ever since.

Take note of who your true partners are and from where (which sources, which people, which teams) you have received good, useful information, quick and informed response, and credible assurances. Your true partners are the ones that have been there for you over time and proven not to have a transactional relationship but a value-based relationship that looks out for your best interest. Security incidents have a way of bringing those value-based true partners into sharp relief.

Document that information and use it to reassess your partnerships and what partners are adding value, including what that value is and how you qualify it. Trust me on this.

Much has been written about how the pandemic forced all CISOs to get more creative and flexible, and that if you're simply going back to the same mix of vendor partners in your security stack that you had before the pandemic, you're missing huge opportunities to evolve your strategy. I recommend that you ask yourself these questions:

This advice applies to your team and to hiring as well. Be aggressive and deliberate in whom you source for your team and the roles you need. I've said before I don't believe there is a true cyber-skills gap — we're just not looking for cyber talent in all the places we can find it.

4. Share threat intelligence data without marketing in mind.
None of us is as smart as all of us. There are many great sources of threat intelligence, and all of the best ones make that intelligence available to the community to strengthen us all.

Connect with me on LinkedIn and let me know what you think. We're all in this together, and we can still come together — and do! — to strengthen security for everyone.