This website collects cookies to deliver better user experience. Cookie Policy
Accept
Sign In
The Wall Street Publication
  • Home
  • Trending
  • U.S
  • World
  • Politics
  • Business
    • Business
    • Economy
    • Real Estate
    • Markets
    • Personal Finance
  • Tech
  • Lifestyle
    • Lifestyle
    • Style
    • Arts
  • Health
  • Sports
  • Entertainment
Reading: Push to Explain What Software Contains Gains Steam After Log4j Flaw
Share
The Wall Street PublicationThe Wall Street Publication
Font ResizerAa
Search
  • Home
  • Trending
  • U.S
  • World
  • Politics
  • Business
    • Business
    • Economy
    • Real Estate
    • Markets
    • Personal Finance
  • Tech
  • Lifestyle
    • Lifestyle
    • Style
    • Arts
  • Health
  • Sports
  • Entertainment
Have an existing account? Sign In
Follow US
© 2024 The Wall Street Publication. All Rights Reserved.
The Wall Street Publication > Blog > Tech > Push to Explain What Software Contains Gains Steam After Log4j Flaw
Tech

Push to Explain What Software Contains Gains Steam After Log4j Flaw

Editorial Board Published January 24, 2022
Share
Push to Explain What Software Contains Gains Steam After Log4j Flaw
SHARE

Companies must know what is inside their technology to secure it against hackers and prevent the type of upheaval seen at the end of 2021 due to a flaw in the free, widely used Log4j software, officials and analysts say.

Contents
Newsletter Sign-upWSJ Pro CybersecurityCISA chief Jen Easterly.More From WSJ Pro Cybersecurity

Disclosure of the vulnerability, which allows hackers to breach systems with relative ease, in early December prompted companies to rush to update their systems and prevent cyberattacks. Many security teams first had to find out if their software included Log4j, an open-source tool used to keep records of users’ activities so they can be reviewed later. Some companies are still combing their software for the flaw.


Newsletter Sign-up

WSJ Pro Cybersecurity

Cybersecurity news, analysis and insights from WSJ’s global team of reporters and editors.


“It’s often hard to spot because it’s not as simple as just running a vulnerability scanner, or checking a product version number,” said Jeff Macko, a senior director in consulting firm Kroll Holdings Inc.’s cyber risk business. Special tools for analyzing software are often required to find out whether Log4j or other vulnerable open-source parts are present.

Mr. Macko said he expects to be dealing with Log4j vulnerabilities for the next three to five years.

This lack of visibility into the guts of corporate software has given new urgency to an old idea—a complete inventory of what is inside software packages, including which open-source components programmers used during development. While such components are commonly used, open-source projects are sometimes maintained only by a handful of volunteers and often aren’t vetted by security teams, opening a company’s systems to attack.

Making such an inventory, known as a software bill of materials, or SBOM, has been promoted by the U.S. Cybersecurity and Infrastructure Security Agency as a way to shorten the time it takes to respond to new vulnerabilities. The Commerce Department is also an advocate, developing guidance on how to construct such an inventory in line with President Biden’s May 2021 executive order on cybersecurity.

CISA chief Jen Easterly.

Photo: Michael Brochstein/Zuma Press

CISA Director Jen Easterly said in a statement last month that the Log4j vulnerability “underscores the urgency of building software securely from the start and more widespread use of Software Bill of Materials.”

Building an SBOM that covers all technology at a company could be difficult. Large organizations such as major banks might run thousands of legacy applications, meaning that going through every piece to find open-source components is a daunting task.

“Frankly, legacy software without an SBOM is like a can of food from the 1920s without an ingredient label. Consume at your own risk,” said Sounil Yu, chief information security officer at Morrisville, N.C.-based cybersecurity company JupiterOne Inc.

Companies that can provide SBOMs demonstrate a mature software-development process, said Mr. Yu, who was previously chief security scientist at Bank of America Corp.

Software providers, in particular, are likely to come under significant pressure to produce SBOMs, he said, as client security teams are unlikely to endure long waits for vulnerability notifications from their suppliers while they figure out what is inside their products. In the Log4j case, tech providers rushed to develop patches to fix the flaw in their own products and to notify customers.

More From WSJ Pro Cybersecurity

Companies have two basic options for discovering whether the software they use contains open-source components, said Tim Mackey, principal security strategist at Synopsys Inc., a Mountain View, Calif.-based software-testing company. If the source code is available, it can be compared with open-source libraries for common components. Alternatively, the program itself can be run through a binary analysis process, where it is dissected to determine its parts, although the results might not be as clear as using the source code.

Still, Mr. Mackey said, bespoke software projects developed by teams outside a company’s technology division can complicate efforts to build comprehensive SBOMs, as they might not go through the usual checks and balances or even be known to technology staff.

Kroll’s Mr. Macko warned that component inventories won’t counteract inherently weak security. Implementing network security that watches for odd behavior from applications and following basic cybersecurity hygiene will help to mitigate the impact of attacks.

“It’s painful that we have to learn our lessons by getting a bloody nose first,” he said.

Write to James Rundle at [email protected]

Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8

TAGGED:Tech NewsWall Street Publication
Share This Article
Twitter Email Copy Link Print
Previous Article Noncitizens shy to vote even when it’s legal Noncitizens shy to vote even when it’s legal
Next Article CBS retools streaming service to better resemble TV network CBS retools streaming service to better resemble TV network

Editor's Pick

Brooke Hogan Written Out of Hulk’s Will (At Her Personal Request)

Brooke Hogan Written Out of Hulk’s Will (At Her Personal Request)

Studying Time: 3 minutes Brooke Hogan isn’t in her dad’s will, a brand new report reveals. Regardless of years of…

By Editorial Board 4 Min Read
6 Greatest Underwear To Stop Chafing For Males in 2025 | Fashion
6 Greatest Underwear To Stop Chafing For Males in 2025 | Fashion

We independently consider all really helpful services. Any services or products put…

15 Min Read
9 Finest Males’s Shorts Manufacturers – Versatile Types For 2025 | Fashion
9 Finest Males’s Shorts Manufacturers – Versatile Types For 2025 | Fashion

We independently consider all advisable services. Any services or products put ahead…

13 Min Read

Oponion

Mortgage Rates Hit Highest Levels Since Spring 2020

Mortgage Rates Hit Highest Levels Since Spring 2020

U.S. mortgage rates this week rose to their highest levels…

January 7, 2022

Twilio Lays Off 11% of Workers

Listen to article(1 minute)Twilio said it…

September 15, 2022

CRA Selects Netmore Operator Platform-as-a-Service to Ship Subsequent-Era LoRaWAN® Connectivity Providers within the Czech Republic

CRA and Netmore to Collectively Develop…

December 5, 2024

Extra rain within the forecast Monday and Tuesday

Extra rain is within the forecast…

November 24, 2024

After 2020’s mail-ballot blip, many Individuals are embracing in-person voting once more

Seven in 10 voters confirmed up…

July 27, 2025

You Might Also Like

The Nintendo Change 2’s Largest Downside Is Already Storage
Tech

The Nintendo Change 2’s Largest Downside Is Already Storage

The Nintendo Change 2 is unbelievable—already a contender for the most important gaming {hardware} launch of 2025. I am nonetheless…

4 Min Read
Clear Your Mattress No Matter How Gross It Will get
Tech

Clear Your Mattress No Matter How Gross It Will get

It’s essential to know easy methods to clear your mattress. Not only for day-to-day cleanliness and hygiene, however let’s say…

4 Min Read
Preserve an Eye on Your Residence With Our Favourite Out of doors Safety Cameras
Tech

Preserve an Eye on Your Residence With Our Favourite Out of doors Safety Cameras

Evaluate These Safety CamerasBest MicroSD Playing cards{Photograph}: AmazonSome safety cameras help native storage, enabling you to file movies on the…

41 Min Read
Hold Tabs on Your Pets and Youngsters With the Finest Indoor Safety Cameras
Tech

Hold Tabs on Your Pets and Youngsters With the Finest Indoor Safety Cameras

Examine Indoor CamerasBest MicroSD Playing cards{Photograph}: AmazonMany safety cameras assist native storage, enabling you to document movies on the digicam…

21 Min Read
The Wall Street Publication

About Us

The Wall Street Publication, a distinguished part of the Enspirers News Group, stands as a beacon of excellence in journalism. Committed to delivering unfiltered global news, we pride ourselves on our trusted coverage of Politics, Business, Technology, and more.

Company

  • About Us
  • Newsroom Policies & Standards
  • Diversity & Inclusion
  • Careers
  • Media & Community Relations
  • WP Creative Group
  • Accessibility Statement

Contact

  • Contact Us
  • Contact Customer Care
  • Advertise
  • Licensing & Syndication
  • Request a Correction
  • Contact the Newsroom
  • Send a News Tip
  • Report a Vulnerability

Term of Use

  • Digital Products Terms of Sale
  • Terms of Service
  • Privacy Policy
  • Cookie Settings
  • Submissions & Discussion Policy
  • RSS Terms of Service
  • Ad Choices

© 2024 The Wall Street Publication. All Rights Reserved.

Welcome Back!

Sign in to your account

Lost your password?