--- title: "Digital Maintenance Lessons From Log4Shell" id: "53763" type: "post" slug: "digital-maintenance-lessons-from-log4shell" published_at: "2021-12-20T22:34:32+00:00" modified_at: "2026-03-17T14:23:53+00:00" url: "https://associationsnow.com/2021/12/20/digital-maintenance-lessons-from-log4shell/" markdown_url: "https://associationsnow.com/2021/12/20/digital-maintenance-lessons-from-log4shell.md" excerpt: "The high-profile Log4Shell exploit, which your organization should be aware of, offers a great reminder of the need to build a maintenance strategy." taxonomy_category: - "Learning" taxonomy_post_tag: - "app vulnerabilities" - "AssociationsNow" - "cybersecurity" - "Software" - "Technology" taxonomy_content_format: - "Article" taxonomy_role: - "Association CEO / Executive Director" - "C-Level" - "Executive Team" - "VP" taxonomy_persona: - "Association Professionals" --- [Home](https://associationsnow.com/) » [Articles](https://associationsnow.com/format/article/) » Digital Maintenance Lessons From Log4Shell When it comes to digital risks, it’s often the hangers-on that cause the biggest problems. And a recent exploit involving a piece of software your association probably doesn’t realize it uses is a timely reminder of an organization’s fundamental responsibility to ensure its applications are being properly maintained. ### What’s the Issue? Recently, a “zero-day” (i.e., already in the wild) vulnerability in [Log4j (opens in a new tab)](https://logging.apache.org/log4j/2.x/) , a common Java-based logging tool found in many web-based hosts, emerged as a significant risk for many website owners. The exploit, known as [Log4Shell (opens in a new tab)](https://www.wired.com/story/log4j-log4shell/) , allows for the execution of arbitrary code by third parties. Many popular services, such as Amazon Web Services and Apple’s iCloud, were initially affected. Because of its wide use in a diverse array of applications, the exploit is being called one of the worst in the history of the internet. And it’s putting organizations large and small on high alert. “It’s a very, very serious issue,” said Justin Cappos, an associate professor at New York University’s Tandon School of Engineering, [in comments to Yahoo Finance (opens in a new tab)](https://news.yahoo.com/log4j-why-this-massive-security-flaw-impacting-nearly-all-the-internet-222332341.html) . “Since it’s part of the software supply chain, many different pieces of software can be affected.” ### What’s the Lesson? In cases like these, immediacy matters (and yes, you should take steps to fix this), but so does preventive maintenance. This issue became such a big problem for so many organizations because of a fundamental failure to understand the underlying technology they use. This is an important lesson, but it’s not the first time it’s been taught. In 2014, for example, the tech world ran into a very similar problem with an exploit [called Heartbleed](https://associationsnow.com/2014/04/four-things-you-should-know-about-the-heartbleed-bug/) —an exploit so significant it essentially became branded—which harmed the security protocol OpenSSL. But unlike using OpenSSL, it’s often not even transparent whether your technology stack uses Log4j, making it potentially even more insidious. The job of associations here is to understand just what is lying under all those applications they use, and whether those applications have issues that could lead to security problems down the line. ### What’s the Potential? You can take practical actions to gain clarity around what exactly is in your software, so a problem like Log4Shell doesn’t catch your organization off guard. For example, using [a software bill of materials](https://associationsnow.com/2021/11/technology-pro-tip-ask-for-a-software-bill-of-materials/) , effectively an ingredients list for your applications, could help your organization ensure that industry partners are being forthright about the tools underscoring the applications they operate. This type of detection can be automated as well, through tools such as firewalls. But ultimately, as useful as a software bill of materials can be, it doesn’t take your organization off the hook in case of an exploit. After all, [as a recent quiz of ours highlighted](https://associationsnow.com/2021/12/think-you-know-your-data-privacy-try-this-quiz/) , the buck often stops with your association when privacy or data issues emerge—not with your vendors. As a result, your association needs to take these issues seriously and ensure it’s not guessing about whether your tools harbor a potential problem. (NiroDesign/iStock/Getty Images Plus) [Ernie Smith](https://associationsnow.com/author/ernie-smith/) Ernie Smith is a former senior editor for Associations Now. [More articles by this author](https://associationsnow.com/author/ernie-smith/) Tags: [#app vulnerabilities](https://associationsnow.com/tag/app-vulnerabilities/) [#cybersecurity](https://associationsnow.com/tag/cybersecurity/) [#Software](https://associationsnow.com/tag/software/) [#Technology](https://associationsnow.com/tag/technology/) **Stay Informed** [Subscribe to our free newsletter](https://associationsnow.com/newsletter/) , *Associations Now Daily News*, to find out what’s happening in the association world every business day. ## You Might Like - [PodcastAssociations Now Presents: Beyond the Tech Stack: How AI Is Changing the Association PlaybookOctober 29, 2026](https://associationsnow.com/2026/10/29/associations-now-presents-beyond-the-tech-stack-how-ai-is-changing-the-association-playbook/) - [PodcastSecuring Identity: What Associations Need to Know About Verifiable CredentialsJune 25, 2025](https://associationsnow.com/2025/06/25/securing-identity-what-associations-need-to-know-about-verifiable-credentials/) - [VideoAmerican College of Emergency Physicians: ACEP Geriatric Emergency Department Accreditation ProgramSeptember 24, 2026](https://associationsnow.com/2026/09/24/american-college-of-emergency-physicians-acep-geriatric-emergency-department-accreditation-program/) - [PodcastAssociations NOW Presents Practical AI-How Associations Are Putting It To WorkJanuary 29, 2026](https://associationsnow.com/2026/01/29/associations-now-presents-practical-ai-how-associations-are-putting-it-to-work/) ## Comments **Comments are for ASAE members.** [Learn more about comments on this site.](https://associationsnow.com/comments/) [Log in](https://associationsnow.com/login?redirect_to=https%3A%2F%2Fassociationsnow.com%2F2021%2F12%2F20%2Fdigital-maintenance-lessons-from-log4shell%2F%23comments) to your member account or [join ASAE](https://my.asaecenter.org/select-a-membership-type/) !