For this assignment, imagine you are the Chief Information Security Officer $($CISO$)$ of a tech company. Your organization is using Java and Log$4$j in all software products your company produces. Leveraging what you have learned in this class, a few curated articles, and your experiences and opinions, you will assess the vulnerability, its impact, and response to it$.$

To do this assignment, you will be guided to read articles, and given a writing prompt. Read the articles and respond to the prompt before you move to the next article and prompt. As always, follow the writing guidelines and have some fun with this. There are no right or wrong answers, just an opportunity to think through a situation and evaluate how well you think it was handled.

Steps to Complete:

$1.$ Reading

First, we need to understand what logging$,$ and Log$4$j$,$ are.

Logging basics are explained in this articleLinks to an external site..

To understand more about Log$4$j$,$ watch this videoLinks to an external site., paying particular attention to the $4$:$00$ mark and onward.

If you wish to dive deeper, this articleLinks to an external site. goes into greater depth discussing the need for logging and comparing frameworks for use with Java applications. Heads up $-$ the article discusses both Log$4$j $1$ and $2.$ For this assignment, we only care about Log$4$j$2.$

$2.$ Writing

In $1-2$ paragraphs, talk to me about logging$.$

From your perspective, why is logging important? As a CISO, what would you want logging enabled on in your company? What do you think you would use logging for?

$3.$ Reading

Second, we need to understand what remote code execution $($RCE$)$ attacks are. Read this articleLinks to an external site. to understand more about what these attacks are, the different ways they can be exploited to impact you, and suggestions for detecting and mitigating them.

$4.$ Writing

What are RCEs? Why do they seem to be considered so severe? How much impact can you imagine an RCE could have on a business?

$5.$ Reading

Now that we have contextual awareness, we need to understand, at a high level, what the Log$4$j vulnerability is$.$ Read this articleLinks to an external site. Links to an external siteto get an understanding. Be aware $-$ this is a low$-$level article that explains the exploit using memes and metaphors to support understanding.

If you'd like to dive deeper into the vulnerability and understand how it can be executed and exploited, read this articleLinks to an external site..Links to an external

$6.$ Writing

In $1-2$ paragraphs, let's dive deeper into why Log$4$j$,$ specifically, was such a critical vulnerability. Tell me about how severe this vulnerability is in your mind. As a CISO, think about the technical environment you are responsible for. With what you would be logging$,$ tell me about the types of data, systems, or products that you'd be most concerned about should the vulnerability be exploited in your environment.

$7.$ Reading

Okay, we understand the context of logging and RCEs. We understand the Log$4$j vulnerability. Now let's dig into why this vulnerability has been called 'the biggest vulnerability in computing historyLinks to an external site.$\text{'}.$

Read the first three articles in this series which introduce the concept of Software Supply Chain. Article $1,$Links to an external site. Article $2$Links to an external site., Article $3$Links to an external site..

$8.$ Writing

As a CISO of a tech company which produces software using Java and Log$4$j$,$ we can assume the products you build also use open$-$source software, libraries, and other components. We can also assume that components you use to run your business $($laptops$,$ servers, containers, printers, security systems, IoT controllers for your HVAC system, etc.$)$ are also built using open$-$source software, libraries, and other components.

Imagine that today is December $1,2021$ and the Log$4$j zero$-$day vulnerability was just disclosed to the world. In $1-2$ paragraphs, tell me what goes through your mind. What's your reaction to the news? Think about your corporate environment and products that you produce, all which may be vulnerable to this issue. What are you most concerned about? What would you want to fix first, and how quickly? Is there anything that wouldn't bother you if it remained vulnerable? Tell me why you would, or would not, be concerned and how you would prioritize detecting and fixing the issue.

$9.$ Reading

Let's think about what life as a CISO looks like after Log$4$j$.$ Read this article about building a vulnerability management frameworkLinks to an external site.. Now, read this article about software composition analysis. Links to an external site.

$10.$ Writing

In $1-2$ paragraphs, let's talk about your priorities as a CISO. Talk to me about what types of tools you'd use to detect the issue in your environment $($laptops$,$ servers, printers, etc.$).$ Talk to me about what types of software$/$tools you may want to deploy to manage the software you produce, and the software you consume, al