Log4Shell broke at the end of 2021 and the security industry spent December and a good chunk of January in emergency response mode. If you somehow missed it, Log4Shell was a critical remote code execution vulnerability (CVE-2021-44228) in Apache Log4j, a Java logging library that is embedded in an almost uncountably large number of applications and infrastructure components. The vulnerability was trivial to exploit and the attack surface was massive because almost nobody had a complete inventory of where Log4j was running in their environment.
That last point is the one I want to dwell on, because it cuts directly to the skills and knowledge that certification programs are supposed to develop and that incidents like this test in real time.
Why Does Asset Inventory Matter for Security?
Asset and software inventory management is foundational to any meaningful security posture. You cannot patch what you do not know you have. You cannot assess exposure to a vulnerability in a specific library if you do not have visibility into which applications in your environment use that library, in which versions, running on which systems. The organizations that responded to Log4Shell fastest and most completely were the ones with mature software bill of materials practices and application inventories. The ones that struggled most were the ones whose inventory was fragmented, incomplete, or simply nonexistent.
Which Certifications Cover Asset Management?
This is content that shows up in the ISACA CISA (Certified Information Systems Auditor) exam domains around IT asset management and information systems operations. It shows up in the CompTIA Security+ and CySA+ (Cybersecurity Analyst+) around vulnerability management. It shows up in the CISSP in the asset security domain. These are not obscure corners of the curriculum. They are foundational concepts that Log4Shell demonstrated have direct operational consequences when they are not implemented well.
What Makes Patch Management So Hard?
Patch management as a discipline also deserves mention. The challenge with Log4Shell was not just identifying where Log4j was running. It was the complexity of the patch response given how deeply embedded the library was in third-party and vendor-supplied software. Organizations had to coordinate with application vendors for patches to software they did not build themselves while also patching the components they did build. The patch management content in Security+ and related certifications, which sometimes feels abstract during study, became very concrete for security teams in December.
The Known Exploited Vulnerabilities catalog maintained by the Cybersecurity and Infrastructure Security Agency (CISA) is a resource worth bookmarking if you are in any kind of infrastructure or security role. It is updated regularly and reflects the actual vulnerability landscape that security practitioners are managing. Studying certification material alongside real-world resources like this gives you context that pure exam prep does not.
CompTIA Security+ Boot Camp
Instructor-led, with the exam voucher included.
How Do You Prepare for the Next Log4Shell?
Log4Shell will not be the last incident of its kind. The software supply chain and the pervasive use of open source components throughout enterprise software stacks means that critical vulnerabilities in widely-used libraries are an ongoing risk category that is not going away. Building the skills to respond effectively to those incidents, and more importantly to establish the asset management practices that enable a faster and more complete response, is a meaningful investment in both your personal competence and your organization’s resilience.
Frequently Asked Questions
What is Log4Shell?
Log4Shell is CVE-2021-44228, a remote code execution flaw in the log4j-core component of Apache Log4j 2. Apache rates it 10.0 Critical, the highest CVSS score. Follow-up fixes were needed for related flaws such as CVE-2021-45046, so the fix is to run a current Log4j 2 release.
Is Log4j 1.x safe since it was not affected by Log4Shell?
No. Apache says Log4j 1 reached end of life in 2015 and vulnerabilities reported after August 2015 are not checked or fixed. Apache’s advice is to upgrade to Log4j 2.
What is the CISA Known Exploited Vulnerabilities catalog?
It is a list kept by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities known to have been exploited in the wild. CISA says organizations should use it as an input to their vulnerability management prioritization. It can be searched online or downloaded as CSV or JSON.
Which CISSP domain covers asset management?
Domain 2, Asset Security, makes up about 10% of the CISSP exam under the outline effective April 15, 2024. The exam has 100 to 150 items over three hours, and the passing score is 700 out of 1000.
Which versions of Security+ and CySA+ are current in 2026?
As of October 2026, Security+ V7 (SY0-701) is current, and CompTIA expects to launch V8 on or around November 17, 2026. CySA+ V4 (CS0-004) launched June 23, 2026, and the English CySA+ V3 exam retires December 22, 2026. ExamNav offers a CompTIA Security+ boot camp.
Related reading
- Ransomware Is the New Normal. These Certs Will Help You Fight Back.
- Zero Trust Went From Buzzword to Job Requirement. Here's What That Means for Your Cert Path.
- CompTIA Security+ boot camp
Brian Rhoades is a Senior VMware Instructor and IT veteran with more than 15 years of hands-on experience in virtualization, systems engineering, and cloud infrastructure. He has trained thousands of IT professionals to confidently work with VMware vSphere, vSAN, and NSX, and has authored multiple books and study guides for outlets across the industry. Brian has a habit of being somewhere new every few weeks, which if you've ever tried to pin down a good VMware instructor, explains a lot.
