Enterprises Had Patched 45% of Vulnerable Cloud Resources 10 Days After Log4Shell Disclosure
Summary
An analysis of more than 200 enterprise cloud environments found 93% at risk from Log4Shell and an average 45% of vulnerable cloud resources patched by Dec. 20, 2021.
Key points
- Wiz and EY analyzed more than 200 enterprise cloud environments; 93% were at risk from Log4Shell.
- By Dec. 20, 2021, organizations had patched an average of 45% of vulnerable cloud resources, up from 30% six days after public disclosure.
- Financial services organizations had patched an average 50% of vulnerable assets, compared with 34% in manufacturing.
- The analysis found 20% of at-risk workloads had high cloud-account privileges and 7% were internet-exposed.
- The article says 45% of vulnerable machines lacked endpoint protection agents, which may not cover all cloud resources.
- Remediation was complicated by large numbers of workloads, embedded or packaged Log4j dependencies, vendor update delays, and subsequent Log4j vulnerabilities. The article names CVE-2021-40546 and CVE-2021-45105.
Article Details
- Event Type
- Wiz and EY analysis of enterprise cloud environments' exposure to Log4Shell and patching progress ten days after disclosure.
- Impact
- The analysis found 93% of surveyed cloud environments were at risk, with organizations patching an average of 45% of vulnerable cloud resources by December 20, 2021. An average of 20% of at-risk workloads had high privileges, 7% were internet-exposed, and 45% of vulnerable machines lacked endpoint protection agents. The article also reports active internet-wide attack attempts and notes that Log4Shell affects on-premise networks as well as cloud environments.
CVE
CVE-2021-40546patch was issued. Two additional log4j versions were released to fix less severe vulnerabilities (CVE-2021-40546, CVE-2021-45105) and workaround instructions were modified. In other words, remediation is a movingCVE-2021-44228Ten days after the critical vulnerability called Log4Shell (CVE-2021-44228) first set the Internet ablaze, organizations are almost halfway through remediating the issue in their cloud environments. See the fullCVE-2021-45105Two additional log4j versions were released to fix less severe vulnerabilities (CVE-2021-40546, CVE-2021-45105) and workaround instructions were modified. In other words, remediation is a moving target and
Vendors
EYWiz and EY (Ernest & Young) analyzed more than 200 enterprise cloud environments with thousands of cloud accounts. The results were striking: While 93% of all cloud environments are at risk from Log4Shell, on averageWizWiz and EY (Ernest & Young) analyzed more than 200 enterprise cloud environments with thousands of cloud accounts. The results were striking: While 93% of all cloud environments are at risk from Log4Shell, on average
Products
Industries
Financial Servicesof organizations in each sector. We found that remediation rates vary considerably by industry. Financial services, where companies have patched 50% of vulnerable assets on average, led the pack, whileManufacturingservices, where companies have patched 50% of vulnerable assets on average, led the pack, while manufacturing lagged (34% average rate).