Log4j Incident Management Survey

Submitted by kogardner on Fri, 12/17/2021 - 12:02

The N.C. Joint Cybersecurity Task Force wants to emphasize the criticality of the Apache Log4j vulnerability and set expectations that this is not going to be a quick or easy effort. Expect that overall remediation activities will take several weeks or months.

Please be sure to refer to our website for the latest information and guidance as it pertains to North Carolina. You can also view a list of vendors confirmed or suspected to be affected by the Log4j vulnerability.

Please note that all reported sensitive security information is protected under N.C.G.S. 132-6.1(c) and is not for public disclosure.

Indicates required field

Contact Details

Organization Name

Point of Contact Name

Point of Contact Email

Point of Contact Phone

What sub-sector does your organization fall under?

Primary County Served

Vulnerability Details

Does your organization need assistance from the N.C. Joint Cybersecurity Task Force?

Was your organization vulnerable to the Log4j vulnerability, as of Dec. 9, 2021?

How is your organization vulnerable to the Log4j vulnerability?

Application Details

View a list of reported and suspected vendors, products, services, and/or software exposure.

Subset of Reported & Suspected Vendors, Products, Services and/or Software Exposure

(As of Dec. 12, 2021)

Vendor	Product, Service and/or Software
Adobe	ColdFusion 2021
Amazon	OpenSearch, AWS Glue, CloudFront, AWS Greengrass, API Gateway
Atlassian	Jira Server & Data Center, Confluence Server & Data Center, Bamboo Server & Data Center, Crowd Server & Data Center, Fisheye, Crucible
Broadcom	CA Advanced Authentication, Symantec SiteMinder (CA Single Sign-On), VIP Authentication Hub, Symantec Endpoint Protection Manager (SEPM)
Cisco	Numerous products: (Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021)
Citrix	None reported; several still under investigation
ConnectWise	Manage on-premise Global Search capability -third party component vulnerable
cPanel	Solr Plugin: log4j CVE-2021-44228, does it affect Cpanel? \| cPanel Forums
Debian	Stretch, Buster, Bullseye, Bookworm
Docker	couchbase, Elasticsearch, Logstash, sonarqube, solr
FortiGuard	FortiSIEM, FortiInsight, FortiMonitor, FortiPortal, FortiPolicy, ShieldX
F-Secure	Policy Manager, Policy Manager Proxy, Endpoint Proxy, Elements Connector
Ghidra	Open-source reverse engineering tool from the NSA
IBM	WebSphere Application Server versions 9.0 and 8.5
Juniper Networks	Paragon Active Assurance, Paragon Insights, Paragon Pathfinder, Paragon Pplanner
McAfee	Numerous products
MongoDB	Atlas Search
Okta	RADIUS Server Agent, Okta On-Prem MFA Agent
Oracle	Numerous products
OWASP Foundation	Zed Attack Proxy (ZAP) scanner below 2.11.1
Red Hat	Numerous products
Siemens	Numerous products
SolarWinds	Server & Application Monitor (SAM), Database Performance Analyzer (DPA)
SonarSource	ElasticSearch component in SonarQube
SonicWall	Email security version 10.X
Sophos	Mobile EAS Proxy
Splunk	Numerous products
TrendMicro	Vision One, TrendMicro Email Security & HES, TippingPoint Threat Management Center, Sandbox as a Service, Cloud App Security
VMware	Numerous products
Ubiquiti	UniFi Network Application
Ubuntu	Numerous versions
Zoho	ADAudt Plus component
Zscaler	Numerous products

Please visit the Apache Log4j Vulnerable Vendors page for the most up-to-date security information related to known vendors.

If your organization was exposed via third-party applications, services or products, please input them below.

Vendor Name	Application/Service/Product Name	Operations
Vendor Name	Application/Service/Product Name

Based on the definitions listed below, please select only one option that best fits your organization’s current status?

Patched

All Log4j vulnerabilities have been patched to the most updated security update (2.16.0, as of Dec. 13, 2021).

Exposed

Systems and services using Log4j have not been patched and are vulnerable, but no IOCs have been identified on the network at this time.

Compromised

IOCs associated with the vulnerability have been observed in the network.

Threat Hunting

In the process of searching the network and IT infrastructure to determine if a compromise has occurred.

Remediated

Log4j vulnerabilities have been patched, and threat hunting has completed. If compromise was identified, the system has since been cleared.

Patch Details

Patch Date

Has your organization patched to the most current security update?

What security update version did you use?

Has your organization completed threat hunting?

Has your organization validated there are no signs of compromise to include signs of unauthorized access, lateral movement or C2 communications?

Recommend investigating for signs of compromise from at least Nov. 1, 2021, through present.
Performing vulnerability checks on local servers using https://github.com/logpresso/CVE-2021-44228-Scanner.
Referencing the most recent guidance from CISA on remediation: Apache Log4j Vulnerability Guidance

Note: Antivirus and simple endpoint protection services are not sufficient as standalone tools to identify potential indicators of compromise.

Does your organization need assistance with threat hunting?

Exposure Details

Does your organization need assistance with patching?

Does your organization need assistance with threat hunting?

Compromise Details

If indicators of compromise were identified in your network, what were they?

Does your organization need assistance with remediating?

Is your organization willing to share the following?

Questions	Yes	No
Logs (Microsoft, firewall, antivirus, etc.)	Yes	No
Scanning results	Yes	No
Images (snapshots) of the compromised servers	Yes	No
Memory dumps	Yes	No
Executable malware files identified	Yes	No

Threat Hunting

Has your organization completed patching?

Patch Date

Has your organization patched to the most current security update?

What security update version did you use?

Has your organization validated there are no signs of compromise to include signs of unauthorized access, lateral movement or C2 communications?

Recommend investigating for signs of compromise from at least Nov. 1, 2021, through present.
Performing vulnerability checks on local servers using https://github.com/logpresso/CVE-2021-44228-Scanner.
Referencing the most recent guidance from CISA on remediation: Apache Log4j Vulnerability Guidance

Note: Antivirus and simple endpoint protection services are not sufficient as standalone tools to identify potential indicators of compromise.

Does your organization need assistance with threat hunting?

Remediation Details

Did your organization patch, decommission or otherwise mitigate the vulnerability?

Date of Patch, Decommission or Mitigation

What security update version did you use?

Has your organization validated there are no signs of compromise to include signs of unauthorized access, lateral movement or C2 communications?

Recommend investigating for signs of compromise from at least Nov. 1, 2021, through present.
Performing vulnerability checks on local servers using https://github.com/logpresso/CVE-2021-44228-Scanner.
Referencing the most recent guidance from CISA on remediation: Apache Log4j Vulnerability Guidance

Note: Antivirus and simple endpoint protection services are not sufficient as standalone tools to identify potential indicators of compromise.

Does your organization need assistance with threat hunting or remediation?

If indicators of compromise were identified in your network what were they?

Other Details and Additional Information