146: The Google CyberCAT is Out of the Bag

On The Cloud Pod this week, Oracle finally has some news to share. Plus Log4j is ruining everyone’s lives, AWS suffers a massive outage post re:Invent, and Google CAT releases its first threat report. 

A big thanks to this week’s sponsors:

• Foghorn Consulting, which provides full-stack cloud solutions with a focus on strategy, planning and execution for enterprises seeking to take advantage of the transformative capabilities of AWS, Google Cloud and Azure.

• JumpCloud, which offers a complete platform for identity, access, and device management — no matter where your users and devices are located. 

This week’s highlights

• A critical vulnerability in Apache Log4j wrought havoc over the weekend. Cloud platforms and developers alike are racing to fix the bug, which gives hackers an opportunity to take control of systems remotely. 
• On the heels of re:Invent, AWS suffered a major outage last Tuesday in its US-EAST-1 region, which had staggering repercussions across the cloud. 
• Google Cybersecurity Action Team (CAT) releases its first Threat Horizons report, revealing its top three concerns threatening cloud users today.  

Top Quotes  

• “It’s amazing how much of our infrastructure and applications live on these open source contributions of one or two people, and how critical they are to the entire ecosystem. And when they break or they’re vulnerable, it becomes a huge issue for us very quickly.”
• “Think about what Microsoft did: They started signing device drivers and signing applications that run in Windows, and everyone thought Oh, they’re just exerting control, what a terrible idea. They’re just trying to corner the market. And now, of course, 15 years later, binding authorization is probably the most critical next step in securing the cloud.”

General News: The Log4j Vulnerability is COVID for Tech

• In light of the critical Apache Log4j 2.0 vulnerability that gives attackers the ability to to execute arbitrary code on other systems, AWS has released a hotpatch for the logging platform. The aim is to help developers mitigate risk as they work to update their systems to 2.15 or newer. 
• VentureBeat reminds us that while the Log4j debacle is bad, at least organizations now have tools and processes in place to respond quickly to zero-day bugs. 
• GCP has released a set of recommendations for those who are investigating and responding to the Log4j 2.0 vulnerability. 
• To help customers detect whether their systems have been compromised by the Log4j bug, Google has updated its IDS signature to automatically scan for any Log4j exploit attempts. 
• Google creates a new Web Application Firewall (WAF) rule to detect and block Log4j exploit attempts by attackers. 

AWS: What Better Way to Follow Up re:Invent Than With a Giant Outage?

• On the Tuesday after re:Invent,