Zero-day attacks: Protections, best practices and how to implement them

Sources:

• InfosecInstitute
• Zero-day (0day) exploit, Imperva
• Cybersecurity: How to get your software patching strategy right and keep the hackers at bay, ZDNet
• Five Key Capabilities To Look for in a Managed Web Application Firewall (WAF) Provider, GBHackers on Security

Introduction

Zero-day attacks are one of the most dangerous cybersecurity threats. This type of cyberattack targets software vulnerabilities previously unknown to software or antivirus vendors, exploiting those vulnerabilities before they can be mitigated. As a result, zero-day attacks enter a system without any defenses in place — giving administrators zero days to fix the already exploited security flaw.

Web browsers, email attachments and zero-day malware are common attack vectors for zero-day attacks. The targets of these attacks include large and small enterprises with valuable business data, home internet users and Internet of Things (IoT) devices.

Technical challenges of coping with zero-day attacks

By definition, zero-day attacks are only detected on the day they occur. This makes them an enormous technical challenge for software administrators and cybersecurity professionals.

While consistent and robust vulnerability scanning is an important part of any cybersecurity strategy, it does little to specifically prevent zero-day attacks. Vulnerability scanning can detect some — but not all — zero-day exploits. Even when such attacks are detected via scanning, IT professionals must act immediately to perform code review and sanitize their code. In most cases, the attacker acts faster than the organization, and the vulnerability is detected but exploited at the last minute.

Another common cybersecurity solution is patch management, or the quick deployment of software patches to cover up security vulnerabilities. Like vulnerability scanning, however, patch management isn’t entirely effective in blocking zero-day attacks. While the detection and patching of vulnerabilities do prevent some attacks, other vulnerabilities may be left undetected, and hackers can act in the time it takes to discover and patch vulnerabilities.

Best practices to protect against zero-day attacks

Given the unique challenges of preventing zero-day attacks, there are several best practices you can implement to mitigate risk.

Use an effective WAF

The most powerful way to prevent zero-day attacks is by using a strong web application firewall (WAF). By reviewing all incoming traffic to web applications, a WAF filters out malicious traffic and prevents the exploitation of vulnerabilities.

Protecting against zero-day attacks is a matter of acting as quickly as possible. While detecting security flaws, sanitizing code and patching vulnerabilities take time, WAFs prevent bad traffic from targeting any vulnerabilities in the first place. An effective WAF should be able to respond in real time and continuously adapt to stay up to date with the latest threats.

Monitor outbound as well as inbound traffic

Keeping an eye on your network’s outbound traffic can also help mitigate zero-day attacks. Zero-day attacks sometimes involve the installation of malicious bots and Trojans on outgoing transfers to issue alternate instructions to remote systems.

Organizations can block such connections with the use of firewalls and outbound proxies. Analyzing the router’s activity log can help IT professionals determine which inbound and outbound traffic should be permitted. Any suspicious outbound connections should immediately be blocked on the router.

Outline a clear incident response plan

Zero-day attacks create enormous pressure for time, and developing a detailed incident response plan beforehand is critical to acting quickly and minimizing damage.

The key steps for creating an effective incident response plan include:

• Developing a thorough understanding of your company’s IT infrastructure: Know exactly which systems are in place, the function of each system component and network and their degree of importance within your organization
• Identifying and analyzing your system’s weak points: Conduct regular assessments of your system to pinpoint potential flaws and vulnerabilities. Work to alleviate these vulnerabilities right away to minimize risk
• Assembling an emergency response team: Build a strong team specifically for responding to incidents. Make clear each team member’s role in the incident response strategy
• Creating quick response guides: Create quick guides that clearly outline responses to different attack scenarios. Keep an easily accessible printout available for immediate reference
• Preparing for disaster recovery. While incident response will hopefully mitigate the problem, you do need to prepare for a disaster recovery scenario. Back up all systems and outline a clear strategy in advance for recovering from hardware errors and more.

Train employees in threat mitigation

All employees — not just IT professionals — should be trained in basic threat mitigation, such as how to respond appropriately to unknown email attachments or apparent anomalous activity.

Email attachments, in particular, are a common threat vector for zero-day attacks. Email attachments can exploit vulnerabilities in specific file types and web applications. To prevent this kind of attack from happening, it’s critical to teach employees how to identify and respond appropriately to unknown emails.

Conclusion

While zero-day attacks are, by nature, difficult to prevent, they’re not unstoppable. To prevent such attacks, organizations need to deploy a holistic cybersecurity strategy: one that not only scans for and patches vulnerabilities but that also involves closely monitoring web traffic, creating an incident response plan and training employees.