1/10 受評估的資產都容易遭到 Log4Shell 攻擊
現在如果不解決，這個問題將會改寫 2022 年的運算環境。
Tenable 從每個弱點集結了大量的資料，包括最近十分引人矚目的 Log4Shell。我們發現的情況相當令人吃驚，但也不意外，所有已評估過的資產中，有 10% 容易受到 Log4Shell 攻擊。同時，令人感到不安的是，有 30% 的企業甚至還沒開始搜尋此錯誤，這樣延誤的疏失也給了威脅行動者積極搜尋與利用此錯誤的時機。
在已評估過的資產中，大約有 10% 的資產發現到 Log4Shell，包括各種伺服器、Web 應用程式、容器和 IoT 裝置。在所有產業和地理區域中，Log4Shell 可說是無所不在。 10 台企業伺服器中，就有一台曝露在風險之中。10 個 Web 應用程式中，就有一個曝露在風險之中，諸如此類。在我們數位基礎架構的所有層面中，將近的十分之一都有受到透過 Log4Shell 惡意刺探利用的可能性。
因此，受影響的企業數不勝數。我們的遙測顯示，截至 2021 年 12 月 21 日，只有 70% 的企業已針對該弱點進行掃描！Log4Shell 已被認定為我們有史以來遇過最重要的網路安全風險之一，然而卻有許多企業還沒開始採取行動：30% 的企業還沒開始針對 Log4Shell 評估他們的環境，更別說開始更新修補程式了。
資安專業人員分身乏術，在此歡度佳節的期間尤其辛苦，但這個風險十分獨特。廣泛的刺探利用已經開始，我們預期在一個月的時間內，就會看到在此刺探利用上的好幾波攻擊，造成更具侵略性的損害，而且到時候的攻勢很可能無法抵檔。
舉例來說，EternalBlue 雖然精心打造了重大攻擊，像是 WannaCry，但由於 Log4j 在基礎架構和應用程式中無所不在，因此它所造成的可能影響會更大。史上還沒有任何一個弱點如此明目張膽，急需修復。據我們所知，Log4Shell 將會改寫運算環境，將那些積極保護自己的企業和那些安逸輕忽此事的企業區分開來。
深入瞭解：
相關文章
How to Perform Efficient Vulnerability Assessments with Tenable
September 12, 2023Policy configuration choices in vulnerability assessment tools like Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management enable security professionals to effectively gather data that can be analyzed to aid in prioritizing remediation.
Tenable's 2023 Capture The Flag: Are You Ready to Test Your Hacking Skills?
July 26, 2023Tenable is bringing its annual hacking competition to Black Hat 2023 in a hybrid in-person and online experience, giving competitors around the world a chance to have fun and test their skills.
Cybersecurity Snapshot: IoT Vendors Fail at Vulnerability Disclosures, While Cyber Threats Again Top Business Risks
January 27, 2023Learn all about how most IoT product makers lack vulnerability disclosure policies. Plus, businesses again rank cyber risk as their top concern. Also, check out a new toolbox for cybersecurity awareness programs. Then scan the latest list of top malware. And much more!
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Enhancing Transportation Cybersecurity and Fleet Management for the DoD
March 25, 2024Few things can halt operations across the Department of Defense like a critical failure of logistics and transportation. From automated asset inventory to malicious-activity detections through baselining, learn how Tenable OT Security can protect these critical functions within the DoD and work towards the federal government’s zero trust mandate in OT environments.
Cybersecurity Snapshot: NSA Picks Top Cloud Security Practices, while CNCF Looks at How Cloud Native Can Facilitate AI Adoption
March 22, 2024Check out the NSA’s 10 key best practices for securing cloud environments. Plus, learn how cloud native computing could help streamline your AI deployments. Meanwhile, don’t miss the latest about cyberthreats against water treatment plants and critical infrastructure in general. And much more!
- Vulnerability Scanning