Log4j is a ubiquitous piece of software used to record activities in a wide range of systems found in consumer-facing products and services. Recently, a serious vulnerability in the popular Java logging package, Log4j (CVE-2021-44228) was disclosed, posing a severe risk to millions of consumer products to enterprise software and web applications. This vulnerability is being widely exploited by a growing set of attackers.

The FTC has warned the following:

“The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future. ”

This wouldn’t be the first time the FTC would be taking legal action against organizations who fail to mitigate cybersecurity flaws. The most ubiquitous case would be the FTC’s lawsuit against Equifax, after failing to patch an Apache server in 2017.

Equifax settled and agreed to pay $700 million to consumers.

The following statements by the Federal Trade Commission (FTC) aim to provide more guidance to relevant organizations:

“When vulnerabilities are discovered and exploited, it risks a loss or breach of personal information, financial loss, and other irreversible harms. The duty to take reasonable steps to mitigate known software vulnerabilities implicates laws including, among others, the Federal Trade Commission Act and the Gramm Leach Bliley Act. It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action.” reads the announcement published by the US FTC.

The US Agency also urges organizations to conduct an assessment of their infrastructure checking for Log4J vulnerabilities, it also recommends consulting the Cybersecurity and Infrastructure Security Agency (CISA)’s Apache Log4j Vulnerability Guidance.

Need a second look at your organization’s information security program or its risk controls? Click here to set up a free consultation.