Let’s hit some of the security stories from the holidays to check for trends.
There was another Log4J security hole. It’s only rated moderate and fixed in Log4J 2.17.1. CISA also released guidance for dealing with the risks related to the software library.
Microsoft notified a group of Azure customers about a bug that exposed the source code of their Azure web apps since at least September of 2017. The issue has been fixed, and Microsoft spent the time since the notification in September also finding out how many were impacted. The expectation is that the vulnerability was likely exploited.
Microsoft also fixed an issue with Exchange that prevented servers from sending emails. Nothing will be lost related to a date check error, but administrators need to patch their servers.
LastPass had a scare after users reported they were notified of unauthorized access attempts – but the company says it was bot activity, and no passwords were compromised.
All this Log4J stuff has resulted in a call from the White House to work with them to improve the security of open-source software. The effort starts with a one-day discussion this month. President Biden also signed the National Defense Authorization Act of 2022, which codifies an approach to cybersecurity that depends on the decisions of private-sector entities to protect the bulk of the nation’s critical infrastructure. The requires the Cybersecurity and Infrastructure Security Agency to biennially update an incident response plan and consult with sector-specific agencies and the private sector to establish an exercise program to assess its effectiveness.
Why do we care?
Besides the tactical catch-up from the holiday, it’s the push from the government to note. That will be a theme this year as it relates to the security stories. Expect more proactive action from the executive branch to come.