Press Release

Readout of CISA Call with Critical Infrastructure Partners on Log4j Vulnerabilities and the Need for Increased Vigilance this Holiday Season

Released
Revised
Related topics:
Cybersecurity Best Practices, Cyber Threats and Advisories,

WASHINGTON – This afternoon, the Cybersecurity and Infrastructure Security Agency (CISA) held a call with critical infrastructure entities from the public and private sectors to emphasize the importance of remaining vigilant against cyber threats over the holiday season, particularly with the widespread exploitation of vulnerabilities in the Log4j software, which pose a severe risk to network security. The call was led by CISA Director Jen Easterly and included updates from CISA’s Executive Assistant Director for Cybersecurity, Eric Goldstein. Nearly 5,000 people dialed in.

Director Easterly highlighted best practices and guidance CISA has made available to help our  partners, including the recently released CISA Insights: Preparing for and Mitigating Potential Cyber Threats. With the holidays around the corner, CISA recommends all organizations – regardless of size – take the following steps to safeguard themselves against cyber threats:

  • Exercise incident response and recovery playbooks;
  • Open information sharing channels with the U.S. government;
  • Consider a heightened monitoring and response posture and adequate staffing for SOCs and response teams; and
  • Refresh and exercise continuity of operations plans.

Executive Assistant Director Goldstein provided an update on CISA’s ongoing response to the Log4j vulnerabilities. Since the initial vulnerability was discovered more than a week ago, CISA has led a national and global response effort through the Joint Cyber Defense Collaborative to provide actionable mitigation guidance available on CISA.gov and create a community-sourced catalog of known exploited vulnerabilities on GitHub. On Friday, December 17, CISA issued an Emergency Directive requiring federal civilian executive branch agencies to take mitigation measures to secure their networks. Goldstein encouraged non-federal government participants on the call to review the directive and consider taking similar measures themselves.

CISA will continue to work shoulder-to-shoulder with public and private sector partners to mitigate Log4j vulnerabilities on their networks and share actionable information as it becomes available. The agency stands ready to support critical infrastructure entities in their efforts to safeguard their systems and respond to cyber threats.

###

Related Articles