You may have heard by now that a security vulnerability in a software logging package called Apache Log4j was discovered late last year. Many of the available Java artifacts from Maven Central have been repaired. This means, that an artifact affected by log4j is considered fixed if it has been updated to log4j 2.17.0 or has been removed from its dependency altogether. However, while about 5000 of the affected artifacts have indeed been fixed, there are still more than 30,000 that are still affected. In short, when all layers and dependencies are taken into account, it may be years before the vulnerability is completely cleared.
Business Must Continue
This vulnerability is so deep and widespread, there will be no simple quick fix. In the meantime, the business must go on. Networks need to perform. Networks need to grow and change. Cloud services must still provide applications and services. How can we monitor and protect our network systems and information and stay safe from cybercrime while continuing to support clients?
The first course of action is to explore package dependencies and upgrade your versions of log4j. The second is to routinely check the weekly threat report from National Cyber Security Centre (UK) for vulnerability updates. In the USA, the Cyber Security and Infrastructure Security Agency (CISA) is another source of updates about current vulnerabilities. And the third is to be vigilant with network monitoring and protection by connecting tools that help protect the network infrastructure and confidential information. Many tools like Intrusion Protection Systems (IPS) and Data Loss Protection (DLP) enforce policies that help maintain the integrity of your proprietary information.
These tools can be safely connected using network TAPs like the SmartNA portfolio from Network Critical. Unlike making connections with SPAN ports which can drop packets and provide incomplete monitoring data, TAP connections provide 100% of network information for completely accurate monitoring and diagnostics. In addition, TAPs are invisible to the network. Therefore, TAPs have no log4j dependency. Taking this path to connect cyber security tools can help managers rest a little easier knowing that they are not introducing new problems while trying to protect from others.
Hardware and Software Support Services
Do not underestimate the value provided by vendor support services. Many software and hardware companies provide ongoing support services that offer updates and fixes after initial deployment. Subscribing to these services can be a critical tool keeping systems and software up to date. Maintaining current software and firmware levels can close vulnerabilities before they turn into crisis situations. If a crisis occurs, however, being a support subscriber can put you at the top of the queue for remediation assistance.
Network Critical Support Services
A great example of industry-leading post-sales support is the Network Critical two-tier support system. Tier one is a standard factory warranty. Technical support is available over the phone and defective equipment will be replaced at no charge to the customer. Once a defective unit is returned, a new device will be shipped to the customer’s location. This program is pretty standard across the industry. It must be noted, however, that even though the support program is there for you, equipment returns are rare. Network Critical products carry some of the highest MTBF in the industry. That said, robust support services are still a critical safety net with any technology.
At Network Critical customer support is a culture, not just a program. Beyond basic support, a tier two option, called Gold Support is offered for high availability networks where a quick turnaround and expert assistance are required. Gold support is available as an add-on during the standard warranty period and continues as an ongoing subscription service. The features of Gold Support include:
24-hour advanced replacement of defective hardware
Unlimited technical support with priority access
Network design services
Remote configuration assistance
Access to the online case management system
Free firmware and feature enhancement updates
Navigating Difficult Waters
Managers are navigating networks through business changes brought about by the Covid virus and at the same time, fighting network attacks from cyber viruses. Persistent cyber attacks, Log4j vulnerabilities, phishing, ransomware, and other cybercrimes require robust and consistent security measures.
A measure of calm may be enjoyed knowing that your Network Critical TAPs and Packet Brokers are not visible to the network and not vulnerable to Log4j attacks and are running with the latest firmware. Network managers can now rest easy by safely attaching cyber security and monitoring tools to network links using the most reliable and well-supported visibility products in the industry. For more information and design ideas for enhancing the security of your network go to www.networkcritical.com/contact-support.
Comments