WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive (ED) 22-02 today requiring federal civilian departments and agencies to assess their internet-facing network assets for the Apache Log4j vulnerabilities and immediately patch these systems or implement other appropriate mitigation measures. This Directive will be updated to further drive additional mitigation actions.
The directive is in response to the active exploitation by multiple threat actors of vulnerabilities found in the widely used Java-based logging package Log4j. Since the vulnerabilities were first discovered, CISA has been working with our partners in the public and private sectors to identity vulnerable products, raise awareness, and encourage all potentially affected organizations to take immediate action.
“The log4j vulnerabilities pose an unacceptable risk to federal network security,” said CISA Director Jen Easterly. “CISA has issued this emergency directive to drive federal civilian agencies to take action now to protect their networks, focusing first on internet-facing devices that pose the greatest immediate risk.
Read more…
Source: U.S. Cybersecurity and Infrastructure Security Agency