FOI 21/22-0740 DOCUMENT 1
From: s47F - personal privacy To: [redacted — s22(1)(a)(ii)] Cc: [redacted — s22(1)(a)(i)] - irrelevant mate; [redacted — s22(1)(a)(ii)] - irrelevant m Subject: Log4j2 vulnerability Date: Monday, 13 December 2021 2:08:11 PM
Hi [redacted — s22(1)(a)(i)],
Thanks for your time just now to discuss what we know about the Log4j2 vulnerability. As I mentioned on the call our Security team is still investigating, and as such, there is not a great detail of information to share at present. The below FAQ hopefully reassures the NDIA that we are actively protecting the NDIA’s data.
At Salesforce, Trust is our #1 value, and we take the protection of our customers’ data very seriously. We are aware of the recently disclosed Apache Log4j2 vulnerability (CVE-2021-44228). We are actively monitoring this issue, and are working to patch any Salesforce services that either use the vulnerable component Log4j2 or provide it to customers.
What is the impact?
-
Salesforce currently has no evidence of unauthorized access to Salesforce systems or customer data due to this issue. Salesforce’s investigation remains ongoing at this time.
-
If Salesforce becomes aware of unauthorized access to Customer Data, we will notify impacted customers without undue delay.
Why did it take so long for you to alert us about this incident?
-
Salesforce always strives to notify customers as quickly as possible once a service-impacting event has been detected.
-
Part of that detection involves investigating the overall scope of the impact as well as determining which customers are affected by the incident.
-
In some cases, the initial investigation may take some time to determine what the actual impact is and which customers are affected. When that happens, the Trust post can be delayed.
-
At Salesforce, we try to strike the balance between rapidly acknowledging an incident broadly and unnecessarily alerting customers to a situation that may not affect them.
Why weren’t we made aware of your intent to fix the vulnerability before you
What caused the change?
As part of our standard remediation process, when we discover security vulnerabilities, we act immediately to close them. Pre-notification risks giving unauthorized third parties more time and awareness to exploit the vulnerability, which would put the safety of your data and your business at risk.
How did Salesforce respond?
Salesforce is actively monitoring this issue and working to patch any Salesforce services that either use the vulnerable component, Log4j2, or provide it to customers.
We also have threat detections in place to alert for exploitation attempts.
What Salesforce products are vulnerable/affected?
For the protection of your company and other customers that may not yet have installed the security patch for this issue, we are not sharing this information at this time.
Where can I get additional information? We’re committed to keeping our customers informed. You can find the latest updates at https://status.salesforce.com.
As our internal FAQ is updated I will share any relevant details.
As always, any questions please don’t hesitate to ask.
Thanks,
[redacted — s47] Customer Success Director | Salesforce - Canberra, Australia Mobile: [redacted — s47] | Email: [redacted — s47]
Follow us on:
Page 2 of 2