Hey #infosec peeps, many of us are tired, frustrated, and exasperated by #Log4Shell.
That said, how about we not blast developers en-masse or even within OSS or even within the Log4j project. Let's remember we have culpability here as well.
1/
That said, how about we not blast developers en-masse or even within OSS or even within the Log4j project. Let's remember we have culpability here as well.
1/
We did nothing with a warning that was given to us in 2016 at BlackHat. Not one detection rule or scanner policy was created.
Despite extensive OSS security research done by orgs and academia, we failed to find this vuln in probably the single most popular Java package.
2/
Despite extensive OSS security research done by orgs and academia, we failed to find this vuln in probably the single most popular Java package.
2/
How many of us are scrambling now because basic security controls (WAF's, Outbound connectivity lockdowns, etc.) that could have limited/prevented exploit of this vulnerability don't exist in our environments?
3/
3/
And before you come at me with "Well they didn't give me funding, they didn't give me people, they don't care, etc." check inward first.
Did you position those initiatives as business enabling/enhancing? Or did you talk about risk/threat mitigation only?
4/
Did you position those initiatives as business enabling/enhancing? Or did you talk about risk/threat mitigation only?
4/
Did you create a roadmap that showed how individual initiatives linked progressively? Did you get sponsorship from individual business lines where you could sell actual value of an initiative in terms of cost savings or better yet additional revenue generation?
5/
5/
I could go on but hopefully you get the point. We all have our roles we play in these things. So put away your venom. Appreciate the world of the devs, especially OSS maintainers, and let's fix our house first before we burn down someone elses? OK?
/FIN
/FIN
• • •
Missing some Tweet in this thread? You can try to
force a refresh
