CISA Pleased With Agencies’ Urgent Response to Log4j Vulnerability

The Cybersecurity and Infrastructure Security Agency saw swift response from federal information technology and cybersecurity leaders amid the emergence of the Apache Log4j vulnerability.

A CISA official told Federal News Network that CISA was pleased with the urgency shown by the federal government since the onset, adding that the agency hosted multiple calls with chief information officers and chief information security officers, as well as IT operations and security operations center personnel.

According to the official, no federal civilian networks have been compromised by the Log4j vulnerability, Federal News Network reported Tuesday.

The new cyberthreat emerged in early December, after which CISA issued a directive requiring agencies to identify and patch instances of Log4j on their internet-facing systems until Dec. 23. Agencies were also mandated to report all affected software applications to CISA by Dec. 28.

The race to identify vulnerable network systems as the year comes to a close mirrors a similar situation at the end of 2020, when the SolarWinds vulnerability surfaced.

A year later, experts say the federal enterprise is now better equipped to deal with cybersecurity incidents and primed for more progress in 2022.

Mark Montgomery, senior adviser to the Cyberspace Solarium Commission,  described 2021 as a year of blocking and tackling cyberthreats. He touted moves such as changes made to CISA authorities and the establishment of a Response and Recovery Fund for pushing the cybersecurity agenda forward.

Chris Cummiskey, a consultant and former Department of Homeland Security undersecretary for management, believes the U.S. government is capable of coming up with a more effective cyber response with there being better coordination between the White House key cyber functions, the National Security Agency, the FBI and CISA.