Log4j - How the Cloud Providers responded!
Cloud Security Podcast15 Joulu 2021

Log4j - How the Cloud Providers responded!

Cloud Security News this week 15 December 2021

  • This week, the world of cybersecurity has been consumed by the Log4Shell vulnerability. So whats it all about. Log4j is a Java library for logging error messages in applications. It was developed by the open-source Apache Software Foundation and is a key Java-logging framework. The critical zero day security vulnerability has been named ‘Log4Shell’ and has a maximum CVSS ( Common Vulnerability Scoring System ) score of 10. The zero-day had been exploited at least nine days before it surfaced on Thursday. This vulnerability puts any device connected to the internet and running Apache Log4J, versions 2.0 to 2.14.1.at risk. This impacts cloud services, developer services, security devices, mapping services, and more.
  • AWS has released details on how the flaw impacts its services and said it is working on patching its services that use Log4j and has released mitigations for services like CloudFront. This can be viewed here. Microsoft has also released Guidance for preventing, detecting, and hunting for Log4j exploitation here and Google cloud is also “is actively following the security vulnerability” and has released recommendations for investigating and responding to the Apache “Log4j 2” vulnerability here IBM said it is "actively responding" to the Log4j vulnerability across IBM's own infrastructure and its products, can be found here and Oracle has issued a patch too here. There is a comprehensive list of all known softwares vulnerable and not vulnerable to LogShell is available on GitHub along with any known fixes. Here
  • This vulnerability is being exploited to install malware, crypto mining, perform DDOS attacks, drop Cobalt Strike beacons, scan for vulnerable servers and exfiltrate information.
  • To finish on a note other log4J - Have you heard about Dazz? Well if you haven't, they are a one-year old cloud security remediation startup that recently closed another round of funding and raised 60 million dollars. Dazz is looking to automate cloud security through their AI driven product in a developer friendly way. You can find out more about them hereEpisode Show Notes on Cloud Security Podcast Website.

Podcast Twitter - Cloud Security Podcast (@CloudSecPod)

Instagram - Cloud Security News

If you want to watch videos of this LIVE STREAMED episode and past episodes, check out:

- Cloud Security Podcast:

- Cloud Security Academy:

Jaksot(344)

Realities of Cloud Networking in AWS

Realities of Cloud Networking in AWS

AWS networking isn’t as simple as it seems and when you’re dealing with regulated industries like healthcare, the stakes are even higher.In this episode we sit down with Kyler Middleton and Jack W. Ha...

28 Helmi 202553min

Cloud Incident Response in Microsoft Azure

Cloud Incident Response in Microsoft Azure

In this episode, we dive deep into Azure security, incident response, and the evolving cloud threat landscape with Katie Knowles, Security Researcher and former Azure Incident Responder. We spoke abou...

20 Helmi 202554min

AWS Multi-Account Security: What Netflix Learned

AWS Multi-Account Security: What Netflix Learned

🚀 How do you secure thousands of AWS accounts without slowing down developers? Netflix’s cloud security experts Patrick Sanders & Joseph Kjar join us to break down their identity-first security model...

13 Helmi 202550min

Cloud Security Detection & Response Strategies That Actually Work

Cloud Security Detection & Response Strategies That Actually Work

We spoke to Will Bengtson (VP of Security Operations at HashiCorp) bout the realities of cloud incident response and detection. From root credentials to event-based threats, this conversation dives de...

4 Helmi 202557min

CISO Challenges Across Industries

CISO Challenges Across Industries

In this episode, we sit down with Sunil Rane, an experienced cybersecurity leader with over 20 years in cybersecurity across industries like healthcare, education, media, and consulting. Sunil shares ...

28 Tammi 202531min

Why Solving the Data Problem is Key to Cloud Security?

Why Solving the Data Problem is Key to Cloud Security?

In this episode we’re joined by Francis Odum, founder and lead research analyst at Software Analyst Cyber Research. Drawing from his extensive research and conversations with CISOs, security operators...

24 Tammi 202550min

The economics of cybersecurity and trends

The economics of cybersecurity and trends

In this episode, host Ashish Rajan spoke to Mike Privette, founder of Return on Security, to explore the landscape of cybersecurity as we look toward 2025. Mike shared his unique insights on the econo...

21 Tammi 202526min

The Truth About CNAPP and Kubernetes Security

The Truth About CNAPP and Kubernetes Security

In this episode of the Cloud Security Podcast, host Ashish Rajan speaks to James Berthoty, founder of Latio.Tech and an engineer-driven analyst, for a discussion on cloud security tools. In this episo...

14 Tammi 202540min