See the whole environment
Dec 14th, 2021 by Jesper Kråkhede
This week the world found out about a vulnerability in Log4j, a logging library used in a huge number of Java applications. It can be exploited remotely by simply getting the application to log a specific text string. The attackers started scanning for it within hours.
The first question every customer asked was: Where do we have Log4j? And for most of them it was a very hard question to answer.
Why? Because nobody had the whole picture. The server team knew their servers, the application team knew some of the applications, the network team knew the firewalls and the client team knew the laptops. But Log4j can be inside a vendor product on a server, an appliance in the network or a tool on a developer´s laptop. Nobody owned the question ‘where is this component?’.
This is a pattern I see in almost every incident. The attacker doesn´t care about your organisation chart. He moves from a laptop to a server to a network device to the cloud, and every time he crosses a border between two teams the investigation slows down.
Technically, you need an inventory that covers everything: hardware, software and the components inside the software. You need logs from every layer in one place. And you need tools that let you search all of it with one query.
Know your whole environment, not just your part of it.