Late last week, a critical security vulnerability in the open source Apache logging library (log4j) was disclosed to the public. ImageSilo Engineering immediately began a thorough review of all systems to determine the impact of this vulnerability on ImageSilo systems and customers. The vast majority of software utilized by ImageSilo does not contain or utilize Apache libraries, making the vulnerability a non-issue for those systems. In addition, the network and security architecture of ImageSilo would have prevented the exploitation of this vulnerably if it existed. For the handful of ImageSilo systems that utilize Apache software, no systems were found that present a risk of exploitation.

In addition to the review of our own systems, we are monitoring any AWS services used by ImageSilo to ensure that patches or mitigations are put in place by AWS.

While the initial review of the impact of this issue has shown a very limited exposure to this vulnerability, we continue to monitor and evaluate the situation. As always, the integrity, security and availability of our customer’s data is of utmost importance.

Please feel free to contact ImageSilo Administration with any questions or comments.
866.374.3569 (303.493.6900)
siloadmin@imagesilo.com

This informational message is in reference to the emergency maintenance notification issued yesterday (Dec 7, 2021). As reported, ImageSilo Engineering became aware of service disruptions occurring with Amazon Web Services (AWS) at approximately 8:29 AM MST. AWS determined that the root cause of the disruption was “an impairment of several network devices in the US-EAST-1 Region”. This affected multiple AWS services, and continued through most of the day causing widespread outages for many online service providers.

The primary impact to ImageSilo operations came as a result of authentication issues using the ImageSilo FTP Transfer Service (transfer.imagesilo.com). While some authentication requests were successful, a high percentage of requests were failing due to network connection issues to the authentication gateway. This impact persisted for the duration of the AWS service disruption.

Aside from the ImageSilo FTP Transfer Service, there was minimal impact to ImageSilo operations. A handful of customers experienced limited recoverable errors related to attaching new documents and checking in new versions, but the vast majority of ImageSilo functionality operated as normal. For those that experienced the limited recoverable errors, typically, once the operation was re-tried, it would be successful. These limited recoverable errors began at the beginning of the service disruption (first event at 8:40 AM MST), and the last issue occurred prior to 1:57 PM MST.

AWS reported at 5:35 PM MST that all issues with the network devices had been resolved, after which ImageSilo Engineering confirmed that all services were functioning as expected.

ImageSilo Engineering takes great measures to ensure the integrity, security and availability of our customers’ data. We design our systems to span across multiple availability zones across the AWS US East region, and have plans and capabilities to move all of ImageSilo operations to another region in the event of a non-recoverable catastrophe in the US East region. While we regret that our customers experienced any issues as a result of this regional AWS service disruption, we are pleased to report that the vast majority of ImageSilo operations functioned without issue.

Please feel free to contact ImageSilo Administration with any questions or comments.
866.374.3569 (303.493.6900)
siloadmin@imagesilo.com