You work hard to secure your business network. Yet determined hackers probe persistently until they find a software vulnerability you don’t know about. They use this previously unknown and unpatched flaw to do their worst.
Zero-day attackers can steal data, corrupt files, take control of devices, install malware or spyware, and more.
The December 2021 Log4j vulnerability that impacted Amazon Web Services, Microsoft, Cisco, Google Cloud and IBM is just the latest serious threat.
It’s another day, and yet another zero-day exploit is making the news. Whatever week you’re reading this, we can guess there’s a zero-day attack in the works.
Zero Day Definitions
Zero-day vulnerability – a flaw the software developer is unaware of, so there is no patch yet.
Zero-day exploit – the method hackers use to leverage the vulnerability.
Zero-day attack – when someone uses a zero-day exploit
WHAT IS A ZERO DAY EXPLOIT?
A zero-day exploit is computer code taking advantage of a vulnerability in software. This type of attack hurts business because it’s being exploited before developers have a chance to address it. The developer has only just learned about the flaw and has had “zero days” to fix it. Hence, the name zero-day attack.
HOW DOES A ZERO-DAY ATTACK WORK?
You work hard to secure your business network. Unfortunately, hackers are determined to get in. They probe persistently until they find a software vulnerability you don’t know about. They use this unknown and unpatched flaw to access your system.
The vulnerability may have been there from the day the software was released, or it may come as the software updates. Threat actors, meanwhile, prod the software and scrutinize the code to find vulnerabilities. Once they find a loophole, they work to write and install an attack before the developer discovers the flaw.
Bad actors can buy zero-day exploits on the Dark Web and customize an attack on your business.
The zero-day attack may be immediate once a bad actor finds a vulnerability, or they might infiltrate the network and wait patiently for the best time to attack. That could depend on their goal, which may be financial gain, hacktivism, corporate espionage, or cyberwarfare.
RECENT EXAMPLES OF ZERO DAY ATTACK
Zero-day hacks can target operating systems, Web browsers, office applications, open-source components, hardware and firmware, or the Internet of Things. That makes for a pretty large threat surface.
A zero-day attacker can steal data, corrupt files, take control of devices, install malware or spyware, and more.
Consider these well-publicized examples of zero-day attacks from the past two years:
- In December 2021, Amazon Web Services, Microsoft, Cisco, Google Cloud, and IBM were among the major tech players affected by the Log4j vulnerability in an open-source logging library. Wired reported the exploit, “will continue to wreak havoc across the internet for years to come.” The US’s Cybersecurity and Infrastructure Security Agency director described the flaw as “one of the most serious I’ve seen in my entire career, if not the most serious.”
- Earlier in 2021, Google Chrome was hit by a series of zero-day threats and issued updates to a vulnerability stemming from a bug in its Web browser’s V8 JavaScript engine.
- Zoom was targeted in 2020. Hackers were able to remotely access users’ PCs if the video conferencing platform was running on an older version of Windows.
- Apple’s iOS fell victim in 2020 to two sets of zero-day bugs that saw attackers compromising iPhones remotely.
PREVENTION AND DETECTION
It is possible to prevent zero-day attacks? Protecting your business against the latest IT threats should always be a top priority.
#1. Preventative security
The number one way to mitigate the damage from any attack to your system is to prevent it from happening in the first place. Maintaining a good firewall and up-to-date antivirus is the best step you can take to ensure the security of your system.
A firewall, monitoring traffic in and out of your network, reduces unauthorized entry over the network. Even without knowing the exact nature of the attack, suspicious activity traveling in and out of the system can be stopped.
The same is true of modern Antivirus. Even when it can not identify the specific zero-day threat from its virus database; it can often identify malicious intent from learned behavior in the system.
Goliath helps clients prevent cyberattacks.
Contact us @ advisory@goliathsec.com to find out more and talk to one of our experts from our Cyber Advisory Team.
#2. A Locked Down Network
Should a zero-day threat make it into your network, our next goal should be to limit its effects. By restricting user access to only essential files and systems we can limit the damage done to the smallest number of systems. Good security policy dictates that each account should only have full access to the systems needed to complete the user’s job. For example, users from the accounts department shouldn’t have access to sales department databases.
In this way, the damage of a single compromised account is limited to only the network area it operates in. Such limited impact should be easy to control and can be reversed with regular backups.
Let us manage your Firewall for you with (next-gen) Firewall-as-a-Service.
Contact us @ advisory@goliathsec.com to find out more and talk to one of our experts from our Cyber Advisory Team.
#3. Good Data backup
Whether your entire network has been exploited or only a small area has been affected; good data backups are your protection against major lasting damage. Having a good backup means having the procedures in place to both create regular backup copies and make sure they can be restored at a later date.
Reliable and well-tested backups are worth their weight in gold. Knowing your data is safe and your system can be recovered is peace of mind against even the most highly destructive zero-day attacks.
#4. Intrusion Protection
While the precise methods of a zero-day exploit can’t be known in advance, a network intrusion protection system (NIPS) can monitor the firms’ network for unusual activity.
The advantage of NIPS over a traditional antivirus only system is it does not rely on checking software against a known database of threats. This means it does not need updates or patches to learn about the latest attacks. NIPS works by monitoring the day-to-day patterns of network activity across the network.
When traffic or events far out of the ordinary are detected action can be taken to alert system administrators and lock down the firewall. Devices such as USB drives and mobile devices can all introduce threats to the network. They can often make it past the firewall because they are physically introduced to the system.
NIPS protects against threats introduced to the network from both external and internal sources.
When antivirus isn’t enough, consider MDR – Managed Detection and Remediation.
Contact us @ advisory@goliathsec.com to find out more and talk to one of our experts from our Cyber Advisory Team.
#5. Full Cover Protection
Used in combination these techniques can prevent, protect, and mitigate against the kinds of threats that even the top security firms haven’t patched yet. We think it’s important to keep your firm secure whatever it might come up against in the future. And, having security experts on hand 24/7 is a nice bonus.
For information about our Managed Security Services, email us @ advisory@goliathsec.com
CONCLUSION
Zero-day attacks are a nightmare for everyone involved. The sooner you act, the better. You can keep an eye on security news. When a zero-day exploit is announced, act quickly to identify where you are vulnerable, and patch that vulnerability.
With Goliath, zero-day attacks are no longer a concern for you. Our team will monitor, prevent, detect, and remediate any issues that are found on your network.
Learn more here: Goliath XDR services.
Comments are closed