The CSRB conducted an exhaustive review of the events surrounding the December 2021 disclosure of a vulnerability in #Log4j, which led to one of the most intensive cybersecurity responses in history. Highlights from the report 🧵 1/
#Log4j is one of the most serious software vulnerabilities ever. It’s an endemic vulnerability and unpatched versions will remain in systems for years to come, perhaps a decade or longer. The #Log4j event is not over. Risk remains and network defenders must stay vigilant. 2/
Many companies could not quickly identify where in their environments they had vulnerable code, revealing opportunities to increase software transparency and capacity to respond quickly to newly-discovered vulnerabilities. 3/
The CSRB raised concerns over Chinese government regulations on vulnerability disclosure, which could be used to get early access to newly-discovered vulnerabilities to exploit for malicious purposes. The report outlines what the Board heard from the Chinese government. 4/
This event highlighted security risks unique to the thinly-resourced, volunteer-led open source software community. Industry & the federal government must commit more resources to supporting open source software security. 5/
Software developers often do not have access to training programs in secure software development practices. The CSRB recommended that universities and community colleges should require a cybersecurity component for all #ComputerScience degrees & certifications. 6/
• • •
Missing some Tweet in this thread? You can try to
force a refresh
