Sonatype found that nearly 70% of dependency management decisions are suboptimal in a study that evaluated 100,000 production applications and 4,000,000 open-source component migrations. 

A large part of this is due to lack of security automation, explained Ax Sharma, senior security researcher, and advocate at Sonatype, in a webinar called “The Impact of Zero-Day Attacks on SSC Management.” 

The company also found that when it came to the big breaches such as Log4Shell in December 2021 and Spring4Shell that allowed attackers to remotely execute malicious code, companies that didn’t automate their supply management and weren’t paying attention to vulnerabilities were especially vulnerable. 

The Sonatype Log4j Resource Center dashboard also shows that downloads of Log4Shell have dropped from 50% at the time of the vulnerability disclosure to 33%, but that’s still a lot, according to Sharma. 

“At the time, people were very concerned if they are vulnerable to the Log4Shell vulnerability,” Sharma said. “If you’re using a few components, it could be a component within a component within a component that contains this library, and you just don’t know how it’s being used in your environment. So I think this is where automation wins because you need to find the vulnerable class and the vulnerable code and exactly how it’s being used.”

Since organizations can’t expect their security teams to go through thousands of lines of code and files per day with a manual approach, they can utilize free scanners from companies like SISA, Google, and Microsoft to see if they’re vulnerable to Log4j and can also use essential perimeter security controls. 

“Even if you were impacted by Log4j and you had strong incident response tools in place like a good IDS or IPS, maybe suspicious traffic could be flagged by those rules,” Sharma said. 

Another suggestion is to patch vulnerabilities fast by prioritizing CVEs based on how much each one impacts the environment. There were so many Log4Shell CVEs, but not all of them were critical, and this left system admins and management confused and scratching their heads over the holidays deciding what to prioritize.

Getting updates is also sound security advice, Sharma explained, but make sure that the updates are legitimate and safe and don’t break anything. Such was the case with the SolarWinds attack that was caused by updates that contained trojanized dynamic link libraries (DLLs).

To learn more, watch the webinar “The Impact of Zero-Day Attacks on SSC Management,” available on-demand now.