| Zero-day is a flaw in software, hardware or firmware that is unknown to the party responsible for patching or otherwise fixing the flaw. The term zero-day may refer to the vulnerability itself, or an attack that has zero days between the time the vulnerability is discovered and the first attack. Once a zero-day vulnerability has been made public, it is known as an n-day or one-day vulnerability. Since zero-day vulnerabilities aren't known in advance, there is no way to guard against such exploits before they happen. Ordinarily, when a researcher detects that a software program contains a potential security issue, he or she will notify the software vendor so they can fix the code and distribute a patch or software update. The hope with a zero-day vulnerability is that even if an attacker hears about the vulnerability, it will take time to figure out how to exploit it without being detected -- and meanwhile, the fix will have been made available. Antimalware software, intrusion detection systems (IDSes) and intrusion prevention systems (IPSes) are often ineffective against zero-day attacks because the attacks do not yet have a known signature. One of the best ways to detect a zero-day attack is simply to monitor network logs. Activities falling outside of the normal scope of operations could be an indicator of a zero-day attack. Other suggestions for mitigating the effects of a zero-day attack include: - Keep all systems patched and up to date.
- Perform regular vulnerability scanning.
- Apply encryption and authentication controls to network traffic.
- Isolate sensitive traffic flowing between servers.
- Use network access control to prevent rogue machines from gaining access.
- Lock down wireless access points.
- Stay on top of security news.
| 
Posts
No comments:
Post a Comment