CISA officials have indicated that they have not seen a significant government intrusion due to Log4Shell – yet. Jen Easterly, CISA Director, said, “This may be the case because sophisticated adversaries have already used this vulnerability to exploit targets and are just waiting to leverage their access until network defenders are on lower alert.”
Cyberattacks rose 50% in 2021 from 2020 and a particularly rough fourth quarter, mainly due to Log4J. This from Check Point Research.
Kaspersky’s survey data indicates higher spending on cybersecurity this year. 86% of IT decision-makers in North America said their organization intends to set aside a budget for cybersecurity when planning for 2022. In addition, 85% said their budget would increase anywhere up to 50% in the next 12 months. In addition, more than one in four (28%) said their company annually invests anywhere from $25,000-$50,000 per year in cyber insurance. There are three top criteria they would be willing to meet to obtain cyber insurance: security controls (70%), compliance (52%), and education (44%).
An open-source developer purposely corrupted two libraries in apparent protest of doing free work. “Respectfully, I am no longer going to support Fortune 500s (and other smaller sized companies) with my free work,” he says. “Take this as an opportunity to send me a six-figure yearly contract or fork the project and have someone else work on it.”
Salesforce is moving to require multi-factor authentication for its customers starting Feb 1. This will be Salesforces’s Authenticator app, time-based authenticator apps, security keys, or built-in authenticators like Touch ID, FaceID, and Windows Hello.
I continue to wish I had something pithy to say about open-source – a problem I’m tracking more than anything else right now.
The Salesforce move is one I want to highlight. Think you can’t make your customers do something? Sure you can.