You’ve probably already read a ton of solid technical analysis about the Log4j vulnerability.
But that’s not this post. Instead, this post is meant to provide some perspective from decades spent in CISO roles, and from many days now of peer conversations with other CISOs and CIOs — the same types of conversations that happen anytime something happens like Log4j or SolarWinds, or take your pick of security incidents with significant blast radius, impact, and longer-term concern.
That’s not to minimize the concern; the Log4j vulnerability — also called Log4Shell — is one of the biggest security issues we’ve all seen this year and one, two weeks into its discovery, that we’re only starting to understand. But it’s easy to get weighed down in hype, marketing, and speculation and forget that there are important things we need to do, right now, to improve our posture, strengthen our team, and put us in a better position for the next Log4j.
Here’s some CISO advice:
1. Lead with empathy and reach out to your security circles.
I’ve said it before and I’ll say it again: Security professionals, CISOs or otherwise, tend to have each other’s backs. Use that to make progress. Have empathy for each other and for your teams. It’s the holiday season, we’re still in a pandemic, and we’re all working hard to limit exposure from products our organizations consume and develop.
I’ve spent a lot of time since this problem began reaching out to my CISO circles, and I’ve been heartened, but not surprised, to find that we’re already working through this together, sharing success, failures, and opportunities. Remember: Your simple mitigation may be someone else’s lifeline idea because they may lack a solution to a complicated security problem.
2. Get the clearest possible understanding of what’s happening in your environment.
Log4j, in both what it can do and what we as technology leaders need to do to solve it, is fundamentally a cyber-hygiene and visibility-and-control issue. The technology is available to reveal everything to us about what apps we’ve running in the