FINRA Alerts Member Firms to Security Vulnerability in Apache Log4j Software

The US Financial Industry Regulatory Authority (FINRA) has issued a regulatory notice, alerting its member firms to recently identified vulnerability in Apache Log4J software, which is an open-source, Java-based logging utility widely used by enterprise applications and cloud services.

FINRA detailed that the "Log4Shell" vulnerability presents risk for member firms because they may be using this software in internal applications, or the software may be embedded in third-party software packages. In addition, many applications written in Java are potentially vulnerable.

"FINRA reminds firms that the U. S. Securities and Exchange Commission's (SEC) Regulation S-P Rule 30 requires firms to have written policies and procedures that are reasonably designed to safeguard customer records and information and FINRA Rule 4370 also applies to denials of service and other interruptions to members' operations,"the authority stated.

"In addition to firms' compliance with SEC regulations, FINRA expects firms to develop reasonably designed cybersecurity programs and controls that are consistent with their risk profile, business model and scale of operations,"FINRA added.

As bad actors may take advantage of this vulnerability to compromise systems to potentially steal information or engage in fraudulent activities, FINRA recommends member firms consider engaging their technology staff along with third-party vendors, including any IT service providers, and taking necessary steps.

This week, the UK-based interdealer broker TP ICAP also unveiled an update on security vulnerability​, saying that its security team continues to investigate and evaluate the Log4j Java library remote code execution (RCE) vulnerability.