Log4j Hygiene

on YouTube ↗07m

" summary

Morgan Stanley hunts the Log4j RCE risk by running automated scanners and CI pipelines across 25 years of Java estate, turning findings into roughly 40,000 remediation tasks tracked and prioritized. The process builds analytics to map JAR usage, surfaces surprising hotspots of embedded and unused libraries, and leads to concrete actions such as deleting confirmed-unused JARs and issuing targeted code or config fixes. Tools and reports are reusable beyond Log4j.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 0:35Table of Contents
3. 1:05Who am I
4. 2:50Morgan Stanley
5. 4:30Recap
6. 6:05Conclusion

" related talks

• 17mLog4j - A Placement Student's Baptism by FireLiam Varney · ACCU 2025
• 33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)Steve Poole · EclipseCon 2022
• 51mLog4Shell Armageddon or OpportunitySteve Poole · JNation 2022
• 59mLog4j: Break Me CompletelyGrigoriy Koshelev · JPoint 2022
• 58mWhat the log4j incident taught us about Secure by DesignDaniel Deogun, Dan Bergh Johnsson · NDC Security 2023
• 51mDouble plus Ungood Why Log4Shell Is So BadJosh Cummings · Devnexus 2022
• 40mWhat Log4j taught meAndrzej Doliński · 4Developers 2022 Online
• 25mDevSecOps by Default: What have, can and must we learn from Log4Shell?Andreas Grabner · devopsdays Amsterdam 2022