> What these applications are supposed to connect to are likely unknown. This is a major problem at enterprises
Only if they fail to consolidate vendor integrations and/or have already insufficient staff. (Which is often indeed a problem.)
Simple, if brutal solution; Infosec audits logs and works with application teams to confirm existing traffic and pre-document new traffic out. With properly staffed teams you should run out of surprises within a year.
> Simple, if brutal solution ... properly staffed teams
The recruitment part is not simple, maybe bordering to impossible? for some larger companies. I say, based on my past experiences in how clueless big companies can be concerning what technical people they hire.
Depends on how you game OKRs. Implement auditing Q1. Contact all teams Q2. Have 75% of teams Q3. 90% of teams Q4. Just an example but its all in how you sell it. Big IT understands icebergs, you just have to give a good/accurate roadmap and execute if they agree on it.
You might be correct that a lack of insight on this sort of thing is an organizational problem. My experience indicates that if you can't get a list of dependencies based on a series of e-mails down an org chart, something is wrong. Either someone is managing too many services for the level of tooling you have, or there's a complete breakdown in org comms (which happens more in larger enterprises.)
That's a bummer, but I suspect many on HN can in fact build software that isn't total garbage.
not just for security either. i can't count the number of times i've traced a performance problem or bug to a piece of code that was doing some io when it didn't need to
What are you doing about it?
With log4j you have a brutal combination of:
1. RCE
2. Exposure
RCE happens frequently but often attackers don't have an easy time getting to the exploitable code. With log4j it's trivial - every app can be owned.
But here are some questions:
1. Why do those apps have the ability to make network requests?
2. For the apps that need to make those requests internally, why aren't those over mTLS?
3. For the apps that need to make them externally, why isn't that going through egress proxying?
4. Why are there credentials spewed all over your environment variables across your services? Are they short lived?
It's actually not super hard to have a worst-case scenario vulnerability like log4j be not that bad for your organization. A bit of hardening and even if something like this happens you're in a good position to wait, monitor, and patch.