- [Instructor] In this segment,
we're gonna talk about Zero-day Vulnerabilities.
You know, zero-day vulnerabilities
are really, really dangerous.
Now, by the strictest definition of zero-day vulnerability
is one that is not yet publicly disclosed
or one that's been discovered as a result of an attack.
But in reality, we use the term "zero-day"
to describe an exploit that does not yet have a fix.
Now, the term "zero-day" stems
from the time the vulnerability is discovered,
often referred to as day zero.
And the subsequent race that we have
between our security teams and our attackers,
and the race is to either fix or patch the vulnerability
or to successfully exploit it.
Let's take a look at the timeline of a zero-day attack.
Now, the first thing that has to happen is,
the vulnerabilities have to be identified.
So how are the vulnerabilities identified?
Well, you know, our criminals invest
an awful lot of time and resources and effort
in R&D, research and development,
testing open source code and proprietary applications,
looking for vulnerabilities
that have not yet been identified or reported.
Alternately, they may turn to the black market
and purchase information about vulnerabilities.
So once they've got that information,
now they have to decide
how valuable that information is to them.
So they're going to go out
and they're going to look for vulnerable systems.
They're going to do that by using automated scanners
or bots, or even manual probing,
but they want to understand what the market is, if you will,
for those vulnerabilities.
If they decide to go ahead,
because that vulnerability is gonna be valuable to them,
then they're going to work on the dual tasks
of creating the appropriate exploits
and planning the attack.
Now, those exploits might be a kit or a script or a process
that's going to enable them
to exploit the discovered vulnerability.
What's the attack gonna look like?
Well, it really depends
on what they're attempting to accomplish.
If it's a targeted attack,
well, the attackers are probably gonna carry out
reconnaissance, right, on their intended victim
because they wanna reduce the chance of being caught
and increase the chance of success.
But if it's going to be
a more general broad-based opportunistic attack,
then they're more likely to use phishing campaigns or bots
to try to hit as many targets as quickly as possible.
In either case, once they're ready, they're going to attack.
And here's where the race is on,
because they wanna attack before a patch is available,
right, when systems are at their absolute most vulnerable.
So what's an organization to do
while they're waiting for a fix?
Well, whenever possible,
organizations should be implementing compensating controls.
Now, if that's not possible,
they'll need to make risk-based
(indistinct) operational decisions
which may include pausing or stopping
whatever the affected target is,
and of course be ready to patch
as soon as a patch or an update is available.
Now, one would think that as soon as a patch is available,
that a zero-day attack is no longer viable.
Unfortunately, that's not true
because so many organizations are very lax about patching
or they're slow to patch
that even after a patch or a fix is available,
often there's a window of opportunity
for the attackers to still take advantage
of that zero-day vulnerability to still exploit it,
to still cause havoc.
So it's really important
that you stay up on your threat intelligence,
that you know about zero-day vulnerabilities,
and that you're really, really looking for that patch
and getting that patch implemented absolutely
as soon as possible.
And that, my friend, is a closer look.