Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Log4Shell: 5 Steps The OT Community Should Take Right Now

Operational technology (OT) environments are equally at risk from the Apache Log4j flaw. Here’s what you can do today.

Update December 17: Apache has updated the severity of CVE-2021-45046, a second Log4j vulnerability, from low to critical (9.0 CVSSv3) citing possible RCE under certain configurations. For more information, please refer to this post on the Tenable Community.

The internet is on fire; but you knew that already. CVE-2021-44228: Log4j Remote Code Execution Vulnerability (Log4Shell) is being categorized as one of the most pervasive and potentially far reaching vulnerabilities in history. Log4j is an open source Java logging library used extensively by developers. The use of third party libraries for core functionality isn’t just an IT problem. Log4j is embedded in operational technology (OT) environments. In fact OT vendors are already releasing advisories on how their products are impacted. 

In the weeks and months ahead, we will begin to understand the pervasiveness and extent of this particular vulnerability in OT infrastructure; but it is most certainly used to perform critical OT logging functions making that system vulnerable to trivial remote code execution. But even if you do not use this in your OT infrastructure, you may still be at risk.

As organizations have converged their IT and OT operations, it would not be the first time where an attack has migrated between IT and OT. Even if your facility is fully air-gapped, there is a better than average chance that you may be “accidentally converged.” Without taking definitive steps to secure the OT infrastructure, your operation may be at risk.

Just the FAQs: CVE-2021-45046, CVE-2021-4104: Frequently Asked Questions About Log4Shell and Associated Vulnerabilities.

Here are five steps to take in order to secure your OT environment against Log4j:

  1. Follow official guidance. Organizations such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have issued specific guidance. It is crucial to be familiar and follow this guidance on an ongoing basis. Compliance with, and reliance on, frameworks from MITRE, the U.S. National Institute of Standards and Technology (NIST), the U.K. Network and Information Systems (NIS) and the North American Electric Reliability Corporation (NERC) can help your organization establish best practices in order to stay vigilant against dynamic threat conditions.
  2. Know what you have. Asset inventory is a cornerstone of any security program and can provide deep situational awareness. It involves more than capturing the make-and-model of everything in your environment. It requires having an up-to-date inventory of firmware versions, patch levels, communication paths, access and much more. Network monitoring alone will only provide some of the detail; active and device-specific querying is also necessary in order to get the specifics.
  3. Run a targeted scan of IT assets. Once you have a good asset inventory, you should be able to run a vulnerability scan to see where else you may be impacted. Tenable research has identified and rolled out the signatures for detecting Log4J or Log4Shell exploit. Our ongoing release of plugins can be found here. Running a targeted scan with newly issued plugins is recommended in order to identify at-risk elements. 
  4. Understand your wider OT exposure. A best practices is to have a good scan option, like Nessus, to run a vulnerability scan of your IT assets, and have an OT-specific option like Tenable.ot to specifically deal with your OT assets. In fact, Tenable.ot contains Nessus inside and runs vulnerability checks for both IT and OT assets. Specific safeguards are employed to ensure that Nessus only ever scans IT assets while Tenable.ot addresses OT assets. 
  5. Be proactive in reducing risk. If you are relying only on intrusion detection alerts to warn you of a compromise or an exploited system, it is already too late. Ongoing threat assessments must involve the most up-to-date intelligence and sources. IT and OT networks are already interconnected in most environments and threat actors are taking advantage of this convergence. If you are concerned that Log4j may have already been leveraged in your environment, Tenable can help. 

Longer-term, the entire manufacturing and critical infrastructure community needs to improve its understanding of what is being used within systems in order to achieve the deep situational awareness required to address new threats as they emerge in the wild. The Software Bill of Materials (SBOM) initiative was directed by Executive Order issued in May 2021. An SBOM can provide end users the transparency required to know if their products rely on vulnerable software libraries.

There is no doubt that we will be dealing with the Log4j vulnerability for years to come and, unfortunately, there will undoubtedly be other vulnerabilities in the future. With the right people, processes and technologies in place, organizations around the world can quickly and collectively use risk-based decision making to minimize the consequences of vulnerabilities like Log4Shell and protect the world’s critical infrastructure.

Michael Rothschild, Tenable’s senior director of OT solutions, also contributed to this blog post.

Learn more

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save.

Add Support