This website collects cookies to deliver better user experience. Cookie Policy
Accept
Sign In
The Wall Street Publication
  • Home
  • Trending
  • U.S
  • World
  • Politics
  • Business
    • Business
    • Economy
    • Real Estate
    • Markets
    • Personal Finance
  • Tech
  • Lifestyle
    • Lifestyle
    • Style
    • Arts
  • Health
  • Sports
  • Entertainment
Reading: Push to Explain What Software Contains Gains Steam After Log4j Flaw
Share
The Wall Street PublicationThe Wall Street Publication
Font ResizerAa
Search
  • Home
  • Trending
  • U.S
  • World
  • Politics
  • Business
    • Business
    • Economy
    • Real Estate
    • Markets
    • Personal Finance
  • Tech
  • Lifestyle
    • Lifestyle
    • Style
    • Arts
  • Health
  • Sports
  • Entertainment
Have an existing account? Sign In
Follow US
© 2024 The Wall Street Publication. All Rights Reserved.
The Wall Street Publication > Blog > Tech > Push to Explain What Software Contains Gains Steam After Log4j Flaw
Tech

Push to Explain What Software Contains Gains Steam After Log4j Flaw

Editorial Board Published January 24, 2022
Share
Push to Explain What Software Contains Gains Steam After Log4j Flaw
SHARE

Companies must know what is inside their technology to secure it against hackers and prevent the type of upheaval seen at the end of 2021 due to a flaw in the free, widely used Log4j software, officials and analysts say.

Contents
Newsletter Sign-upWSJ Pro CybersecurityCISA chief Jen Easterly.More From WSJ Pro Cybersecurity

Disclosure of the vulnerability, which allows hackers to breach systems with relative ease, in early December prompted companies to rush to update their systems and prevent cyberattacks. Many security teams first had to find out if their software included Log4j, an open-source tool used to keep records of users’ activities so they can be reviewed later. Some companies are still combing their software for the flaw.


Newsletter Sign-up

WSJ Pro Cybersecurity

Cybersecurity news, analysis and insights from WSJ’s global team of reporters and editors.


“It’s often hard to spot because it’s not as simple as just running a vulnerability scanner, or checking a product version number,” said Jeff Macko, a senior director in consulting firm Kroll Holdings Inc.’s cyber risk business. Special tools for analyzing software are often required to find out whether Log4j or other vulnerable open-source parts are present.

Mr. Macko said he expects to be dealing with Log4j vulnerabilities for the next three to five years.

This lack of visibility into the guts of corporate software has given new urgency to an old idea—a complete inventory of what is inside software packages, including which open-source components programmers used during development. While such components are commonly used, open-source projects are sometimes maintained only by a handful of volunteers and often aren’t vetted by security teams, opening a company’s systems to attack.

Making such an inventory, known as a software bill of materials, or SBOM, has been promoted by the U.S. Cybersecurity and Infrastructure Security Agency as a way to shorten the time it takes to respond to new vulnerabilities. The Commerce Department is also an advocate, developing guidance on how to construct such an inventory in line with President Biden’s May 2021 executive order on cybersecurity.

CISA chief Jen Easterly.

Photo: Michael Brochstein/Zuma Press

CISA Director Jen Easterly said in a statement last month that the Log4j vulnerability “underscores the urgency of building software securely from the start and more widespread use of Software Bill of Materials.”

Building an SBOM that covers all technology at a company could be difficult. Large organizations such as major banks might run thousands of legacy applications, meaning that going through every piece to find open-source components is a daunting task.

“Frankly, legacy software without an SBOM is like a can of food from the 1920s without an ingredient label. Consume at your own risk,” said Sounil Yu, chief information security officer at Morrisville, N.C.-based cybersecurity company JupiterOne Inc.

Companies that can provide SBOMs demonstrate a mature software-development process, said Mr. Yu, who was previously chief security scientist at Bank of America Corp.

Software providers, in particular, are likely to come under significant pressure to produce SBOMs, he said, as client security teams are unlikely to endure long waits for vulnerability notifications from their suppliers while they figure out what is inside their products. In the Log4j case, tech providers rushed to develop patches to fix the flaw in their own products and to notify customers.

More From WSJ Pro Cybersecurity

Companies have two basic options for discovering whether the software they use contains open-source components, said Tim Mackey, principal security strategist at Synopsys Inc., a Mountain View, Calif.-based software-testing company. If the source code is available, it can be compared with open-source libraries for common components. Alternatively, the program itself can be run through a binary analysis process, where it is dissected to determine its parts, although the results might not be as clear as using the source code.

Still, Mr. Mackey said, bespoke software projects developed by teams outside a company’s technology division can complicate efforts to build comprehensive SBOMs, as they might not go through the usual checks and balances or even be known to technology staff.

Kroll’s Mr. Macko warned that component inventories won’t counteract inherently weak security. Implementing network security that watches for odd behavior from applications and following basic cybersecurity hygiene will help to mitigate the impact of attacks.

“It’s painful that we have to learn our lessons by getting a bloody nose first,” he said.

Write to James Rundle at [email protected]

Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8

TAGGED:Tech NewsWall Street Publication
Share This Article
Twitter Email Copy Link Print
Previous Article Noncitizens shy to vote even when it’s legal Noncitizens shy to vote even when it’s legal
Next Article CBS retools streaming service to better resemble TV network CBS retools streaming service to better resemble TV network

Editor's Pick

Alyssa Farah Griffin: ‘The View’ Co-Host is Pregnant With Child #1!

Alyssa Farah Griffin: ‘The View’ Co-Host is Pregnant With Child #1!

Studying Time: 3 minutes The View co-host Alyssa Farah Griffin is pregnant! On ‘The View,’ Alyssa Farah Griffin breaks the…

By Editorial Board 3 Min Read
Arturo Gatti Jr. Reason behind Dying: Son of Boxing Legend Passes Away at 17
Arturo Gatti Jr. Reason behind Dying: Son of Boxing Legend Passes Away at 17

Studying Time: 2 minutes Aruturo Gatti Jr. — an aspiring boxer and…

3 Min Read
Mandy Moore ‘Unrecognizable’ to Followers After Debuting New Face
Mandy Moore ‘Unrecognizable’ to Followers After Debuting New Face

Studying Time: 4 minutes Mandy Moore has followers scratching their heads. This…

6 Min Read

Oponion

Dem Rep. Jared Moskowitz slams ‘dozens of members’ of his personal celebration for antisemitism

Dem Rep. Jared Moskowitz slams ‘dozens of members’ of his personal celebration for antisemitism

Rep. Jared Moskowitz (D-Fla.) slammed the “dozens of members” of…

November 20, 2024

Small enterprise confidence dipped in August amid rising election uncertainty

Rep. Maria Salazar, R-Fla., on Vice…

September 15, 2024

Celebrity Adele joins backers of music royalties platform Audoo | Cash Information

Adele, the Grammy award-winning artist, has…

May 16, 2025

Grocer weighs in on lethal Boar’s Head recall shifting how shoppers store in shops

New Yorkers are feeling the pinch…

November 14, 2024

Chinese Startups Try to Make It Big in the U.S.—Without the Backlash

Companies are moving their headquarters out…

November 29, 2022

You Might Also Like

WIRED’S Favourite PC Monitor Is  Off
Tech

WIRED’S Favourite PC Monitor Is $75 Off

In case you're uninterested in staring a tiny laptop computer display whereas working from residence, think about scooping up our…

3 Min Read
Your Cat In all probability Is not Ingesting Sufficient Water. A Fountain Can Assist.
Tech

Your Cat In all probability Is not Ingesting Sufficient Water. A Fountain Can Assist.

Evaluate Our PicksOthers We ExaminedCourtesy of PetkikPetkit Eversweet Max for $90: This techy computerized fountain will be both cordless or…

17 Min Read
Wish to Begin a Web site? These Are the Finest Web site Builders
Tech

Wish to Begin a Web site? These Are the Finest Web site Builders

Prime Web site BuildersFinest for Most IndividualsSquarespace CoreLearn ExtraFinest Low cost Web site BuilderHostinger Web site BuilderLearn ExtraFinest for Small…

5 Min Read
Specialised’s New Electrical Mountain Bike Is So Enjoyable I Forgot to Go House
Tech

Specialised’s New Electrical Mountain Bike Is So Enjoyable I Forgot to Go House

The following experience was on singletrack from my home to Spirit Mountain, Duluth’s downhill lift-accessed park with 24 trails starting…

4 Min Read
The Wall Street Publication

About Us

The Wall Street Publication, a distinguished part of the Enspirers News Group, stands as a beacon of excellence in journalism. Committed to delivering unfiltered global news, we pride ourselves on our trusted coverage of Politics, Business, Technology, and more.

Company

  • About Us
  • Newsroom Policies & Standards
  • Diversity & Inclusion
  • Careers
  • Media & Community Relations
  • WP Creative Group
  • Accessibility Statement

Contact

  • Contact Us
  • Contact Customer Care
  • Advertise
  • Licensing & Syndication
  • Request a Correction
  • Contact the Newsroom
  • Send a News Tip
  • Report a Vulnerability

Term of Use

  • Digital Products Terms of Sale
  • Terms of Service
  • Privacy Policy
  • Cookie Settings
  • Submissions & Discussion Policy
  • RSS Terms of Service
  • Ad Choices

© 2024 The Wall Street Publication. All Rights Reserved.

Welcome Back!

Sign in to your account

Lost your password?