Log4j Critical Vulnerability

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Log4j Critical Vulnerability On 15 December 2021, ENISA, the EU Agency for Cybersecurity has released a Joint Statement together with the European Commission, CERT-EU, and the network of the EU national computer security incident response teams (CSIRTs network), regarding a Critical Vulnerability on a Java-based logging package, Log4j. Authorised Persons are expected to assess their potential exposure to this vulnerability and to apply adequate mitigation measures in a timely manner by following official guidelines. At the time of writing, ENISA states that this is still “a developing situation” and therefore it is highly recommended that Authorised Persons continue to follow any developments and recommendations as necessary. The Authority would like to remind Authorised Persons of their expectation to employ continuous monitoring to identify potential threats to, and vulnerabilities in, their Information and Communications Technologies, in a timely manner, whilst having sound threat and vulnerability management processes and practices in place. Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function within the MFSA on sirc@mfsa.mt. 16 December 2021