1/10 受評估的資產都容易遭到 Log4Shell 攻擊
現在如果不解決，這個問題將會改寫 2022 年的運算環境。
Tenable 從每個弱點集結了大量的資料，包括最近十分引人矚目的 Log4Shell。我們發現的情況相當令人吃驚，但也不意外，所有已評估過的資產中，有 10% 容易受到 Log4Shell 攻擊。同時，令人感到不安的是，有 30% 的企業甚至還沒開始搜尋此錯誤，這樣延誤的疏失也給了威脅行動者積極搜尋與利用此錯誤的時機。
在已評估過的資產中，大約有 10% 的資產發現到 Log4Shell，包括各種伺服器、Web 應用程式、容器和 IoT 裝置。在所有產業和地理區域中，Log4Shell 可說是無所不在。 10 台企業伺服器中，就有一台曝露在風險之中。10 個 Web 應用程式中，就有一個曝露在風險之中，諸如此類。在我們數位基礎架構的所有層面中，將近的十分之一都有受到透過 Log4Shell 惡意刺探利用的可能性。
因此，受影響的企業數不勝數。我們的遙測顯示，截至 2021 年 12 月 21 日，只有 70% 的企業已針對該弱點進行掃描！Log4Shell 已被認定為我們有史以來遇過最重要的網路安全風險之一，然而卻有許多企業還沒開始採取行動：30% 的企業還沒開始針對 Log4Shell 評估他們的環境，更別說開始更新修補程式了。
資安專業人員分身乏術，在此歡度佳節的期間尤其辛苦，但這個風險十分獨特。廣泛的刺探利用已經開始，我們預期在一個月的時間內，就會看到在此刺探利用上的好幾波攻擊，造成更具侵略性的損害，而且到時候的攻勢很可能無法抵檔。
舉例來說，EternalBlue 雖然精心打造了重大攻擊，像是 WannaCry，但由於 Log4j 在基礎架構和應用程式中無所不在，因此它所造成的可能影響會更大。史上還沒有任何一個弱點如此明目張膽，急需修復。據我們所知，Log4Shell 將會改寫運算環境，將那些積極保護自己的企業和那些安逸輕忽此事的企業區分開來。
深入瞭解：
相關文章
Cybersecurity Snapshot: IoT Vendors Fail at Vulnerability Disclosures, While Cyber Threats Again Top Business Risks
January 27, 2023Learn all about how most IoT product makers lack vulnerability disclosure policies. Plus, businesses again rank cyber risk as their top concern. Also, check out a new toolbox for cybersecurity awareness programs. Then scan the latest list of top malware. And much more!
Tenable.sc 6.0: A Major Update that Boosts Visibility and Productivity
January 25, 2023Tenable.sc powers the risk-based vulnerability management programs (RBVM) of all types of organizations, anchoring the world’s most demanding cybersecurity environments. With the introduction of Tenable.sc 6.0, customers can now take advantage of significant new capabilities and enhancements, like a global CVE search to help them focus their RBVM efforts on what’s most important.
Cybersecurity Snapshot: Key 2022 Data for Cloud Security, Vulnerability Management, EASM, Web App Security and More
December 30, 2022As 2022 ends, we highlight important data points that shine a light on the trends, challenges and best practices that matter to cybersecurity leaders eager to boost their exposure management and reduce their organizations’ cyber risk.
Tenable Cyber Watch: White House Unveils $140M Investment for Responsible AI, Top 5 Malware in Q1 2023, and more
May 15, 2023This week’s edition of the Tenable Cyber Watch unpacks the White House’s $140 million dollar investment into AI research and development and explores the security implications of ChatGPT. Also covered: The top 5 malware strains for Q1 2023.
Cybersecurity Snapshot: How To Boost Customers' Trust in Your Digital Services
May 12, 2023Check out how beefing up digital trust in your technology yields key business benefits. Plus, a sophisticated cyber espionage operation has been defused. Also, why cyberattack victims should speak up. In addition, don’t miss our poll on mobile device security. And much more!
The Role of Open Source in Cloud Security: A Case Study with Terrascan by Tenable
May 11, 2023Open source software and cloud-native infrastructure are inextricably linked and can play a key role in helping to manage security. Open source security tools like Terrascan by Tenable are easy to scale, cost-effective and benefit from an agile community of contributors. Let’s take a look at how you can implement it today.
- 弱點掃描
