> Just saying it was "simply a matter of upgrading a dependency." is so amazingly far from what such an event requires
5 people total?
that have too look at the problem for a few days and then go back to their regular duties.
Which is their job, BTW, you don't need "special teams".
I work for a company that has more than 20 thousand employees.
How we fixed it?
Every team checked if their dependencies contained a vulnerable version of log4j, fixed it, ran the tests, submitted the new code, the CI/CD did the rest.
5 people total?
that have too look at the problem for a few days and then go back to their regular duties.
Which is their job, BTW, you don't need "special teams".
I work for a company that has more than 20 thousand employees.
How we fixed it?
Every team checked if their dependencies contained a vulnerable version of log4j, fixed it, ran the tests, submitted the new code, the CI/CD did the rest.