Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 16 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list.
Today a blog post from December 16th, 2021, Reader Comment – Log4Shell Do Something Now, jumped into the list. This post looked at some of the response issues related to the Log4 vulnerabilities. These vulnerabilities were the first time (and looking back, the only time) that the OT vendor community jumped on a 3rd party vulnerability with any sort of unanimity. That response was both quick and flawed; to be fair, a combination that is frequently seen in emergency situations.
The problem was that there was no problem. The world did not end. There were no massive takeovers of vulnerable systems. The OT world chugged along pretty much the same as it did before Log4Hell. I am afraid that the lesson learned can be summed up in a phrase I learned many years ago (damn, close to 40 now) that I learned in French Commando School; “No sweat, no safety.”
We can see this reflected today in the industry response to the Iranian (probably) water system hacks of last month; “What? Me Worry?” Nothing crashed and burned; product was still delivered, no safety issues, and you want water facilities to change their operating scheme? “Bother me next week.”
NOTE: With me taking the weekends off now, more of these older posts are showing up in analytical data on Monday’s, I will continue to use these posts for Monday morning fodder if they have some relevancy to current conditions.
Posts
No comments:
Post a Comment