Log4j Vulnerability Prompts Insurance Commissioners to Issue Guidance | Faegre Drinker Biddle & Reath LLP

CISA Director Jen Easterly on Log4j: “These vulnerabilities are the most serious that I’ve witnessed in my profession.”¹

On December 11, 2021, the Cybersecurity and Infrastructure Safety Company (CISA), in partnership with the FBI and NSA, announced a critical remote code execution vulnerability experienced been identified in the Apache Log4j software library. This vulnerability allowed a profitable danger actor to acquire handle of a network method and cause a variety of destruction, together with the capacity to start ransomware, steal and damage victim information, deploy malware, and disrupt inside and infrastructure operational management.

This essential vulnerability specifically targeted on Apache’s Log4j program, versions 2.-beta by way of variation 2.1.4.1, generally recognised as “Log4Shell.” In accordance to CISA, Log4j is utilised in a variety of purchaser and enterprise providers, internet websites and purposes to log a company’s safety and efficiency data. This vulnerability is influencing hundreds of thousands of laptop or computer techniques due to the fact the Log4j program is generally applied to file all method of functions that go “under the hood” of afflicted pc networks and standalone machines.

In reaction to the Log4j threat, insurance policy regulators from four states have lately issued steering to regulated entities. They are:

• Illinois Division of Insurance coverage: Issued Bulletin CB 2021-15 Log4j Vulnerability on December 20, 2021 to all regulated entities to “take rapid methods to detect and mitigate any pitfalls posed by the Log4J vulnerabilities.” Controlled entities are “reminded to report cybersecurity occasions that drop under the Illinois Particular Details Security Act” to buyers and/or the Illinois Lawyer General. ²
• New York DFS: Issued Sector Assistance on December 17, 2021, to all regulated entities stating they “should promptly assess hazard to their corporation, consumers, consumers, and 3rd social gathering service vendors … and acquire action to mitigate hazard.” The bulletin also reminds regulated entitles to report cybersecurity situations less than 23 NYCRR 500.17(a) as instantly as feasible and inside 72 several hours.³
• Vermont Office of Financial Regulation: Issued an Business Warn on December 22, 2021, to all controlled entities that they “should promptly assess possibility to their group, buyers, people, and third social gathering services providers … and choose motion to mitigate chance.” The Market Warn also reminds controlled entities to report cybersecurity activities as required by 9 V.S.A. 2435 and DFR Bulletin #4.⁴
• Virginia Condition Corporation Commissioner’s Bureau of Insurance plan: Issued Bulletin Log4j Vulnerability on December 20, 2021, to all Licensees that they “should instantly assess risk to their corporation, consumers, people, and third-celebration assistance providers … and choose motion to mitigate risk.” The Bulletin also reminds licensees to report cybersecurity functions as needed by the Virginia Insurance policies Knowledge Security Act. ⁵

Thanks to the opportunity harm the Log4j vulnerability provides and the uncertainty of the depth of the real scope of this attack, it is likely far more insurance coverage commissioners will challenge assistance. To mitigate danger of damage, we recommend all controlled entities, at a minimum:

• Guarantee all Adobe software patches have been implemented.
• Establish methods susceptible to a Log4j attack.
• Decide if any units have previously been attacked.

Last of all, we counsel that regulated entities assessment and undertake the recommendations supplied at CISA’s Apache Log4j Vulnerability Advice internet site. If you are interested in further more data or assistance, be sure to speak to authors Jo Cicchetti and Jason G. Weiss.

FOOTNOTES

1. CISA, FBI, NSA and International Companions Challenge Advisory to Mitigate Apache Log4j Vulnerabilities, issued December 22, 2021 accessible at: https://www.cisa.gov/information/2021/12/22/cisa-fbi-nsa-and-global-companions-issue-advisory-mitigate-apache-log4j
2. CB-2021-15 Log4j Vulnerability, issued December 20, 2021 obtainable at: https://www2.illinois.gov/sites/Insurance plan/Organizations/CompanyBulletins/CB2021-15.pdf.
3. Log4j Vulnerability, NY DFS, issued December 17, 202, out there at: https://www.dfs.ny.gov/industry_steerage/industry_letters/il20211217_cyber_log4j_vulnerability.
4. CYBERSECURITY (APACHE LOG4J) VULNERABILITY Assistance, issued December 22, 2021 accessible at: https://dfr.vermont.gov/business-notify/apache-log4j-vulnerability-assistance.
5. Log4j Vulnerability, issued December 20, 2021 offered at: https://scc.virginia.gov/getattachment/7a82646e-7f26-40cb-8138-cc5d096057fa/Log4j_BOI_Bulletin.pdf.