FTC Warns Companies to Remediate Log4j Security Vulnerability

By Cynthia J. Larose

Before the holidays, we warned of a critical vulnerability in a widely-used Java logging utility that could affect tens of thousands of companies.   Since that original alert, multiple US and foreign government cybersecurity agencies published a joint advisory and guidance for affected organizations recommending that patches or workarounds be applied immediately to mitigate the vulnerabilities and exposure.   The US Cybersecurity and Infrastructure Security Agency also ordered US federal civilian executive branch agencies to patch within days of the order. 

The Federal Trade Commission has now issued a release warning all companies utilizing the Java-based Log4j to identify and remedy the reported vulnerabilities.  The FTC warns that companies are obligated to “take reasonable steps to mitigate known software vulnerabilities” under various laws, including the FTC Act and the Gramm-Leach-Bliley Act, and that the Commission “intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure.”

If your company has not analyzed its exposure to Log4j, it is time to do so and to deploy patches or workarounds if patches are not possible.  Apache has created a full site with patches and more information.   Breaches resulting from a failure to address this critical vulnerability can exposure your company to regulatory actions in addition to potential litigation.

Subscribe To Viewpoints

Published

    • Viewpoint Topics

  • Privacy & Cybersecurity

    • Professionals

  • Cynthia J. Larose

    • Related Practices

  • Privacy & Cybersecurity
    • Privacy & Thumbnail Viewpoints Thumbnail

    CRITICAL ALERT: Log4Shell

    December 13, 2021| Alert|

    Author

    Cynthia J. Larose

    Member / Co-Chair, Privacy & Cybersecurity Practice

    Cynthia J. Larose is Chair of the firm's Privacy & Cybersecurity Practice, a Certified Information Privacy Professional-US (CIPP-US), and a Certified Information Privacy Professional-Europe (CIPP-E). She works with clients in various industries to develop comprehensive information security programs on the front end, and provides timely counsel when it becomes necessary to respond to a data breach.