1/10 受評估的資產都容易遭到 Log4Shell 攻擊
現在如果不解決，這個問題將會改寫 2022 年的運算環境。
Tenable 從每個弱點集結了大量的資料，包括最近十分引人矚目的 Log4Shell。我們發現的情況相當令人吃驚，但也不意外，所有已評估過的資產中，有 10% 容易受到 Log4Shell 攻擊。同時，令人感到不安的是，有 30% 的企業甚至還沒開始搜尋此錯誤，這樣延誤的疏失也給了威脅行動者積極搜尋與利用此錯誤的時機。
在已評估過的資產中，大約有 10% 的資產發現到 Log4Shell，包括各種伺服器、Web 應用程式、容器和 IoT 裝置。在所有產業和地理區域中，Log4Shell 可說是無所不在。 10 台企業伺服器中，就有一台曝露在風險之中。10 個 Web 應用程式中，就有一個曝露在風險之中，諸如此類。在我們數位基礎架構的所有層面中，將近的十分之一都有受到透過 Log4Shell 惡意刺探利用的可能性。
因此，受影響的企業數不勝數。我們的遙測顯示，截至 2021 年 12 月 21 日，只有 70% 的企業已針對該弱點進行掃描！Log4Shell 已被認定為我們有史以來遇過最重要的網路安全風險之一，然而卻有許多企業還沒開始採取行動：30% 的企業還沒開始針對 Log4Shell 評估他們的環境，更別說開始更新修補程式了。
資安專業人員分身乏術，在此歡度佳節的期間尤其辛苦，但這個風險十分獨特。廣泛的刺探利用已經開始，我們預期在一個月的時間內，就會看到在此刺探利用上的好幾波攻擊，造成更具侵略性的損害，而且到時候的攻勢很可能無法抵檔。
舉例來說，EternalBlue 雖然精心打造了重大攻擊，像是 WannaCry，但由於 Log4j 在基礎架構和應用程式中無所不在，因此它所造成的可能影響會更大。史上還沒有任何一個弱點如此明目張膽，急需修復。據我們所知，Log4Shell 將會改寫運算環境，將那些積極保護自己的企業和那些安逸輕忽此事的企業區分開來。
深入瞭解：
相關文章
How Risk-based Vulnerability Management Boosts Your Modern IT Environment's Security Posture
July 11, 2024Vulnerability assessments and vulnerability management sound similar – but they’re not. As a new Enterprise Strategy Group white paper explains, it’s key to understand their differences and to shift from ad-hoc vulnerability assessments to continuous, risk-based vulnerability management (RBVM). Read on to check out highlights from this Tenable-commissioned study and learn how RBVM helps organizations attain a solid security and risk posture in hybrid, complex and multi-cloud environments.
Cybersecurity Snapshot: FTC Believes TikTok Broke U.S. Law, Asks Justice Dept. To Intervene, while French Cyber Agency Warns About Nobelium / Midnight Blizzard
June 21, 2024TikTok’s legal troubles in the U.S. could get thornier after the FTC refers complaint to the DOJ. Meanwhile, France says Russia-backed Nobelium / Midnight Blizzard is a major cyber espionage threat to European governments. Plus, check out a Tenable poll about dealing with vulnerabilities without patches. And did LockBit 3.0 make a comeback in May? Maybe – or maybe not. And much more!
How to Perform Efficient Vulnerability Assessments with Tenable
September 12, 2023Policy configuration choices in vulnerability assessment tools like Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management enable security professionals to effectively gather data that can be analyzed to aid in prioritizing remediation.
How Risk-based Vulnerability Management Boosts Your Modern IT Environment's Security Posture
July 11, 2024Vulnerability assessments and vulnerability management sound similar – but they’re not. As a new Enterprise Strategy Group white paper explains, it’s key to understand their differences and to shift from ad-hoc vulnerability assessments to continuous, risk-based vulnerability management (RBVM). Read on to check out highlights from this Tenable-commissioned study and learn how RBVM helps organizations attain a solid security and risk posture in hybrid, complex and multi-cloud environments.
Microsoft’s July 2024 Patch Tuesday Addresses 138 CVEs (CVE-2024-38080, CVE-2024-38112)
July 9, 2024Microsoft addresses 138 CVEs in its July 2024 Patch Tuesday release, with five critical vulnerabilities and three zero-day vulnerabilities, two of which were exploited in the wild.
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
- Vulnerability Scanning