Zero-Day Vulnerabilities
A zero-day vulnerability is a software security flaw that is unknown to the vendor and for which no patch exists. 'Zero-day' refers to the fact that developers have had zero days to fix the issue. These vulnerabilities are extremely valuable to attackers because there is no defense against them until they are discovered and patched.
Why zero-days are dangerous
Because no patch exists, traditional security measures cannot block exploits targeting zero-day vulnerabilities. They can remain undetected for months or years (known as 'zero-day in the wild'). Nation-state actors and advanced persistent threat (APT) groups actively stockpile and trade zero-day exploits. The window between discovery and patching leaves all affected systems vulnerable. High-value zero-day exploits for popular software can sell for millions on the black market.
Notable zero-day attacks
Log4Shell (2021): a critical vulnerability in the widely-used Log4j logging library that affected millions of applications. Exchange ProxyLogon (2021): four zero-days in Microsoft Exchange Server exploited by state-sponsored groups. Kaseya VSA (2021): a supply chain attack exploiting zero-days in IT management software to deploy ransomware. MOVEit (2023): a zero-day in the file transfer software exploited to steal data from hundreds of organizations.
Defensive strategies
Apply defense-in-depth: multiple security layers so that a single zero-day doesn't mean total compromise. Use endpoint detection and response (EDR) that can detect anomalous behavior regardless of the exploit used. Segment your network to limit the impact of any single compromise. Keep all software updated to minimize the window of exposure once patches are available. Enforce application whitelisting and least-privilege access. Monitor threat intelligence feeds for emerging zero-day disclosures.
Discuss this with a senior responder.
Discuss this with a senior responderNeed incident response?
- Two-hour SLA
- Dutch senior responders