Background:

In December $2021,$ the tech world, still reeling from the impacts of the SolarWinds breach in December $2020,$ was rocked again with news of a massively severe zero$-$day vulnerability in Log$4$jLinks to an external site.. Log$4$j is a prominent logging solution used for Java apps. "A zero$-$day vulnerability is an undiscovered flaw in an application or operating system, a gap in security for which there is no defense or patch because the software maker does not know it exists$$they$$ve had $$zero days$$ to prepare an effective response," per HP EnterpriseLinks to an external site., when the vulnerability is publicly disclosed, often by the security researcher who discovered it$.$ If you're unfamiliar with logging$,$ this articleLinks to an external site. gives a brief overview of its importance and use cases.

This particular vulnerability was vulnerable to an attack called Remote Code ExecutionLinks to an external site..

Assignment:

For this assignment, imagine you are the Chief Information Security Officer $($CISO$)$ of a tech company. Your organization is using Java and Log$4$j in all software products your company produces. Leveraging what you have learned in this class, a few curated articles, and your experiences and opinions, you will assess the vulnerability, its impact, and response to it$.$

To do this assignment, you will be guided to read articles, and given a writing prompt. Read the articles and respond to the prompt before you move to the next article and prompt. As always, follow the writing guidelines and have some fun with this. There are no right or wrong answers, just an opportunity to think through a situation and evaluate how well you think it was handled.

Steps to Complete:

$1.$ Reading

First, we need to understand what logging$,$ and Log$4$j$,$ are.

Logging basics are explained in this articleLinks to an external site..

To understand more about Log$4$j$,$ watch this videoLinks to an external site., paying particular attention to the $4$:$00$ mark and onward.

If you wish to dive deeper, this articleLinks to an external site. goes into greater depth discussing the need for logging and comparing frameworks for use with Java applications. Heads up $-$ the article discusses both Log$4$j $1$ and $2.$ For this assignment, we only care about Log$4$j$2.$

$2.$ Writing

In $1-2$ paragraphs, talk to me about logging$.$

From your perspective, why is logging important? As a CISO, what would you want logging enabled on in your company? What do you think you would use logging for?

$3.$ Reading

Second, we need to understand what remote code execution $($RCE$)$ attacks are. Read this articleLinks to an external site. to understand more about what these attacks are, the different ways they can be exploited to impact you, and suggestions for detecting and mitigating them.

$4.$ Writing

What are RCEs? Why do they seem to be considered so severe? How much impact can you imagine an RCE could have on a business?

$5.$ Reading

Now that we have contextual awareness, we need to understand, at a high level, what the Log$4$j vulnerability is$.$ Read this articleLinks to an external site. Links to an external siteto get an understanding. Be aware $-$ this is a low$-$level article that explains the exploit using memes and metaphors to support understanding.

If you'd like to dive deeper into the vulnerability and understand how it can be executed and exploited, read this articleLinks to an external site..Links to an external

$6.$ Writing

In $1-2$ paragraphs, let's dive deeper into why Log$4$j$,$ specifically, was such a critical vulnerability. Tell me about how severe this vulnerability is in your mind. As a CISO, think about the technical environment you are responsible for. With what you would be logging$,$ tell me about the types of data, systems, or products that you'd be most concerned about should the vulnerability be exploited in your environment.

$7.$ Reading

Okay, we understand the context of logging and RCEs. We understand the Log$4$j vulnerability. Now let's dig into why this vulnerability has been called 'the biggest vulnerability in computing historyLinks to an external site.$\text{'}.$

Read the first three articles in this series which introduce the concept of Software Supply Chain. Article $1,$Links to an external site. Article $2$Links to an external site., Article $3$Links to an external site..

$8.$ Writing

As a CISO of a tech company which produces software using Java and Log$4$j$,$ we can assume the products you build also use open$-$source software, libraries, and other components. We can also assume that components you use to run your business $($laptops$,$ servers, containers, printers, security systems, IoT controllers for your HVAC system, etc.$)$ are also built using open$-$source software, libraries, and other components.

Imagine that today is December $1,2021$ and the Log$4$j zero$-$day vulnerability was just disclosed to the world. In $1-2$ paragraphs, tell me what goes through your mind. What's your reaction to the news? Think about your corporate