#IMOS22 Log4j Reflections: What the Vulnerability Has Taught the IndustryEvery so often we see a security incident so major that it renders large portions of the internet critically vulnerable. We saw it with Heartbleed, EternalBlue, and more recently, Log4J. Also known as Log4Shell, this vulnerability in the Java logging tool Log4J 2 knocked the infosec community on its back as it struggled to fix thousands of affected applications.
This session explores the origin and nature of the Log4J vulnerability, investigating how it happened, why it hit us so hard, and why some found it so difficult to fix. We also look into the lessons learned from the whole incident and how we might be able to apply these lessons to mitigate and avoid similar problems in the future.