This website collects cookies to deliver better user experience. Cookie Policy
Accept
Sign In
The Wall Street Publication
  • Home
  • Trending
  • U.S
  • World
  • Politics
  • Business
    • Business
    • Economy
    • Real Estate
    • Markets
    • Personal Finance
  • Tech
  • Lifestyle
    • Lifestyle
    • Style
    • Arts
  • Health
  • Sports
  • Entertainment
Reading: Push to Explain What Software Contains Gains Steam After Log4j Flaw
Share
The Wall Street PublicationThe Wall Street Publication
Font ResizerAa
Search
  • Home
  • Trending
  • U.S
  • World
  • Politics
  • Business
    • Business
    • Economy
    • Real Estate
    • Markets
    • Personal Finance
  • Tech
  • Lifestyle
    • Lifestyle
    • Style
    • Arts
  • Health
  • Sports
  • Entertainment
Have an existing account? Sign In
Follow US
© 2024 The Wall Street Publication. All Rights Reserved.
The Wall Street Publication > Blog > Tech > Push to Explain What Software Contains Gains Steam After Log4j Flaw
Tech

Push to Explain What Software Contains Gains Steam After Log4j Flaw

Editorial Board Published January 24, 2022
Share
Push to Explain What Software Contains Gains Steam After Log4j Flaw
SHARE

Companies must know what is inside their technology to secure it against hackers and prevent the type of upheaval seen at the end of 2021 due to a flaw in the free, widely used Log4j software, officials and analysts say.

Contents
Newsletter Sign-upWSJ Pro CybersecurityCISA chief Jen Easterly.More From WSJ Pro Cybersecurity

Disclosure of the vulnerability, which allows hackers to breach systems with relative ease, in early December prompted companies to rush to update their systems and prevent cyberattacks. Many security teams first had to find out if their software included Log4j, an open-source tool used to keep records of users’ activities so they can be reviewed later. Some companies are still combing their software for the flaw.


Newsletter Sign-up

WSJ Pro Cybersecurity

Cybersecurity news, analysis and insights from WSJ’s global team of reporters and editors.


“It’s often hard to spot because it’s not as simple as just running a vulnerability scanner, or checking a product version number,” said Jeff Macko, a senior director in consulting firm Kroll Holdings Inc.’s cyber risk business. Special tools for analyzing software are often required to find out whether Log4j or other vulnerable open-source parts are present.

Mr. Macko said he expects to be dealing with Log4j vulnerabilities for the next three to five years.

This lack of visibility into the guts of corporate software has given new urgency to an old idea—a complete inventory of what is inside software packages, including which open-source components programmers used during development. While such components are commonly used, open-source projects are sometimes maintained only by a handful of volunteers and often aren’t vetted by security teams, opening a company’s systems to attack.

Making such an inventory, known as a software bill of materials, or SBOM, has been promoted by the U.S. Cybersecurity and Infrastructure Security Agency as a way to shorten the time it takes to respond to new vulnerabilities. The Commerce Department is also an advocate, developing guidance on how to construct such an inventory in line with President Biden’s May 2021 executive order on cybersecurity.

CISA chief Jen Easterly.

Photo: Michael Brochstein/Zuma Press

CISA Director Jen Easterly said in a statement last month that the Log4j vulnerability “underscores the urgency of building software securely from the start and more widespread use of Software Bill of Materials.”

Building an SBOM that covers all technology at a company could be difficult. Large organizations such as major banks might run thousands of legacy applications, meaning that going through every piece to find open-source components is a daunting task.

“Frankly, legacy software without an SBOM is like a can of food from the 1920s without an ingredient label. Consume at your own risk,” said Sounil Yu, chief information security officer at Morrisville, N.C.-based cybersecurity company JupiterOne Inc.

Companies that can provide SBOMs demonstrate a mature software-development process, said Mr. Yu, who was previously chief security scientist at Bank of America Corp.

Software providers, in particular, are likely to come under significant pressure to produce SBOMs, he said, as client security teams are unlikely to endure long waits for vulnerability notifications from their suppliers while they figure out what is inside their products. In the Log4j case, tech providers rushed to develop patches to fix the flaw in their own products and to notify customers.

More From WSJ Pro Cybersecurity

Companies have two basic options for discovering whether the software they use contains open-source components, said Tim Mackey, principal security strategist at Synopsys Inc., a Mountain View, Calif.-based software-testing company. If the source code is available, it can be compared with open-source libraries for common components. Alternatively, the program itself can be run through a binary analysis process, where it is dissected to determine its parts, although the results might not be as clear as using the source code.

Still, Mr. Mackey said, bespoke software projects developed by teams outside a company’s technology division can complicate efforts to build comprehensive SBOMs, as they might not go through the usual checks and balances or even be known to technology staff.

Kroll’s Mr. Macko warned that component inventories won’t counteract inherently weak security. Implementing network security that watches for odd behavior from applications and following basic cybersecurity hygiene will help to mitigate the impact of attacks.

“It’s painful that we have to learn our lessons by getting a bloody nose first,” he said.

Write to James Rundle at [email protected]

Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8

TAGGED:Tech NewsWall Street Publication
Share This Article
Twitter Email Copy Link Print
Previous Article Noncitizens shy to vote even when it’s legal Noncitizens shy to vote even when it’s legal
Next Article CBS retools streaming service to better resemble TV network CBS retools streaming service to better resemble TV network

Editor's Pick

Alyssa Farah Griffin: ‘The View’ Co-Host is Pregnant With Child #1!

Alyssa Farah Griffin: ‘The View’ Co-Host is Pregnant With Child #1!

Studying Time: 3 minutes The View co-host Alyssa Farah Griffin is pregnant! On ‘The View,’ Alyssa Farah Griffin breaks the…

By Editorial Board 3 Min Read
Man fatally shot throughout argument over lady at gathering at Tuscaloosa storage unit; suspect jailed
Man fatally shot throughout argument over lady at gathering at Tuscaloosa storage unit; suspect jailed

One individual was killed and a number of other others injured in…

2 Min Read
Amy Duggar Describes Studying Grandfather Was a ‘Predator’
Amy Duggar Describes Studying Grandfather Was a ‘Predator’

Studying Time: 4 minutes Amy Duggar King grew up figuring out and…

6 Min Read

Oponion

The exhibition “Sargent and Paris” opens on the Met

The exhibition “Sargent and Paris” opens on the Met

From April 21 to August 3, 2025, the Metropolitan Museum…

April 19, 2025

23 Easter Brunch Menu Concepts To Make Internet hosting Really feel Easy

Spring has formally sprung, and I’m…

April 7, 2025

Job development picked up in June regardless of financial uncertainty

Richmond Federal Reserve Financial institution President…

July 7, 2025

Horoscopes Sept. 29, 2024: Roger Bart, use your expertise fortuitously

CELEBRITIES BORN ON THIS DAY: Kevin…

September 29, 2024

NYT Strands right this moment — hints, solutions and spangram for Monday, September 23 (sport #204)

Strands is the NYT’s newest phrase…

September 23, 2024

You Might Also Like

The Greatest Carpet Cleaners We have Discovered, Examined in Busy Households
Tech

The Greatest Carpet Cleaners We have Discovered, Examined in Busy Households

Evaluate Our PicksOthers Examined{Photograph}: Simon HillHoover HF4 Hydro for £199: For UK people in flats or small homes with a…

11 Min Read
The Amazfit T-Rex 3 Professional Is Like a Low cost Garmin That Does not Work
Tech

The Amazfit T-Rex 3 Professional Is Like a Low cost Garmin That Does not Work

Every little thing. Every little thing concerning the consumer expertise is the catch. It’s the catchiest catch. Just about each…

2 Min Read
Gear Information of the Week: Intel’s New Chips Arrive, and Apple Might Debut iPads and MacBooks This Month
Tech

Gear Information of the Week: Intel’s New Chips Arrive, and Apple Might Debut iPads and MacBooks This Month

Intel's future has by no means appeared so unsure. However a lot of the firm's roller-coaster journey of a 12…

5 Min Read
The Corvette E-Ray Is Dynamically Up There With the Greatest
Tech

The Corvette E-Ray Is Dynamically Up There With the Greatest

A 1.9-kWh lithium-ion battery has been packaged inside the automotive’s already beefy central tunnel, and extra cooling has been added…

3 Min Read
The Wall Street Publication

About Us

The Wall Street Publication, a distinguished part of the Enspirers News Group, stands as a beacon of excellence in journalism. Committed to delivering unfiltered global news, we pride ourselves on our trusted coverage of Politics, Business, Technology, and more.

Company

  • About Us
  • Newsroom Policies & Standards
  • Diversity & Inclusion
  • Careers
  • Media & Community Relations
  • WP Creative Group
  • Accessibility Statement

Contact

  • Contact Us
  • Contact Customer Care
  • Advertise
  • Licensing & Syndication
  • Request a Correction
  • Contact the Newsroom
  • Send a News Tip
  • Report a Vulnerability

Term of Use

  • Digital Products Terms of Sale
  • Terms of Service
  • Privacy Policy
  • Cookie Settings
  • Submissions & Discussion Policy
  • RSS Terms of Service
  • Ad Choices

© 2024 The Wall Street Publication. All Rights Reserved.

Welcome Back!

Sign in to your account

Lost your password?