The recently discovered flaw in the widely used open-source Apache Log4j software reaffirms our view of heightened risks from the increasingly digital and globally interconnected ecosystem, with opaque and complex supply chains.

We expect entities with well-developed cyber risk management frameworks to be diligently executing their cyber response plans to fix the flaw. This includes patching, assessing exposure, and attempting to gauge any immediate breaches. The more sophisticated cyber risk management frameworks would have been able to detect any malicious behavior prior to the public announcement of this flaw. Now, the focus has shifted to responding and--if needed--recovering for those that did not.

We continue to see the exposure of business models and digital networks to disruption and cyber risk as key global structural credit risks. Credit-relevant cyber events are increasing at unprecedented levels. Even prior to the emergence of the Log4j flaw, we had forecast more meaningful systemwide attacks next year given the opportunities for hackers over the past 12-18 months to gain access to IT infrastructure (for further details see "Cyber: Are Credit Markets Ready For A systemwide Attack?" published Dec. 3, 2021.

Over the past few days, entities across the world have been in a race against time to reduce exposure to the flaw, understand potential exposure stemming from suppliers and third-party vendors, and--importantly--limit the amount of time that attackers have unfettered access to internal IT networks and infrastructure. Apache released two patches to known vulnerabilities within days of disclosing the vulnerability. However, even once applied, we expect entities to be on high alert for many weeks to come given the likelihood that their systems may have been compromised.

Active Detection Is The New Active Prevention In Cybersecurity

We have long said that active detection is the new active prevention in cybersecurity. Following the discovery of the Log4j flaw and appropriate identification of active threats, ongoing active detection will be more of a competitive advantage than ever before. Entities that have prioritized and invested in this important facet of cybersecurity will be in a much stronger position to mitigate risks from this event. Although it may be difficult to directly attribute future attacks to this flaw, we expect the access and internal network information gained by external actors will pose a threat well into the future. At a minimum, we expect to see increased DDoS and targeted ransomware attacks, and we recognize the increased potential for more sophisticated attacks.

Exposure to this flaw poses clear risks for rated entities, mainly because of the wide-ranging use of the Log4j framework. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) believes hundreds of millions of devices are likely affected. Log4j is a widely used by vendor applications, increasing the likelihood that some part of an issuers' network may be compromised. Once any threat actors gain access through the vulnerability, they could deploy malware, steal credentials or data, or launch DDoS attacks, among other threats. This, in turn, could result in lost revenues, contingent liabilities, and increased costs associated with containing an attack. Despite the magnitude of this event from an IT perspective, this type of event should not be unexpected, and issuers should have response plans embedded into their risk management policies.

The Central Role Of Cyber Governance Is More Central Than Ever

Although the scale of this event is undoubtedly large, the role of cyber governance remains central, and this will differentiate the magnitude of the impact that entities will experience. We will engage with rated entities as necessary to understand more about their cyber response plans and their views on potential exposure. We expect a wide range of motives for attacks (not just politically driven) to emanate from this event, which could make this more financially material than other events.

As is the case in any cyber event, we expect entities that are badly prepared, handle the event poorly, have weaker balance sheets, and lack adequate cyber insurance or other means to address the potential financial impact will be most exposed. Our wider focus on governance as part of our forward-looking credit analysis helps us detect weaker risk management policies, including those for managing cyber risk. We see a strong link between weak general governance standards and weak cyber governance.

Expect The Unexpected: High Alert Needed For More Than A Few Days

We expect the world to be on high alert to potential exposure over the coming weeks, and active detection will be key to containing and mitigating potential damage. This should include risk assessments and active dialogue with suppliers and third-party vendors. Given the potential long tail and latent exposure from this event, active detection will need to continue in order to avoid potential pitfalls. Although the flames currently appear to be under control, this may be a smokescreen. There may be a large-scale targeted future attack off the back of this flaw; expecting the unexpected in the cyber realm is key to maintaining creditworthiness.

Related Research

• Cyber: Are Credit Markets Ready For A systemwide Attack?, published Dec. 3, 2021
• Cyber Risk In A New Era: Are Third-Party Vendors Unwitting Cyber Trojan Horses For U.S. Public Finance?, Oct. 25, 2021
• Cyber Risk In A New Era: The Increasing Credit Relevance of Cybersecurity, July 14, 2021
• The Future Of Banking: Bank Cloud Adoption Goes From Blue Sky Thinking To Economic Necessity, Feb. 8, 2021
• Cyber Risk in a New Era | S&P Global Ratings (spglobal.com)
• Digitalization Of Markets | S&P Global Ratings (spglobal.com)