What are “zero-day” threats, and how can businesses defend against them?

Imagine if your car was stolen despite you being convinced that you had locked its door, only for you to find later that. Well, you hadn’t. As a result, you had inadvertently given the thief away into your car, leaving it easy pickings without you having realised until it was too late.

In essence, a “zero-day” threat is the cybersecurity equivalent of this kind of security compromise. Investopedia defines a zero-day attack as “an attack that exploits a potentially serious software security weakness that the vendor or developer may be unaware of.”

Therefore, the software developer has not been aware of the security hole for even a single day – hence the term “zero-day”. However, does all of this mean that, for businesses, defending against zero-day attacks would be hopeless? Not entirely – your own business could pursue these tactics.

1. Using analysis to detect zero-day attacks

One article published by Business 2 Community outlines four basic methods IT professionals have formulated for the near-impossible task of detecting zero-day attacks. These methods can be summarised as statistical analysis, signature analysis, behaviour analysis and hybrid analysis.

With statistical analysis, machine learning is used to collect data from zero-day exploits previously detected. As a result, a framework for safe system behaviour can take shape. Meanwhile, with signature analysis, machine learning can, for existing malware, analyse and create signatures subsequently used to detect vulnerabilities that, until then, had eluded notice.

Once a zero-day attack has happened, behaviour analysis can study the hacking entity’s behaviour and interaction with the site that has been attacked. Finally, the hybrid analysis combines the other three research forms to draw advantages from all three while minimising their drawbacks.

2. Keeping corporate software up to date as a matter of routine

In April 2017, a threat group known as the Shadow Brokers leaked a zero-day vulnerability that would enable attackers to compromise a vulnerable system’s security by remotely executing arbitrary code in it. From May to August 2017, EternalBlue – as the vulnerability came to be known – was exploited by an array of massive ransomware campaigns.

Ironically, however, as the vulnerability had already been patched a month before the leak, the bigger culprit for these campaigns’ success was not so much the vulnerability itself but instead that many machines had not been patched against it sufficiently quickly.

Consequently, ITProPortal says that “the events of 2017 provide the most compelling argument of all for routine software updates as part of any enterprise’s basic security hygiene initiatives.”

3. Implementing a multi-level cybersecurity policy

As zero-day attacks are unpredictable by nature, your firm should be on its guard 24/7 and have in place a suitably agile cybersecurity system – one capable of shielding your company’s workers, devices and network from any cyber threats.

That protective system could be Wandera’s Threat Defence solution, which would allow you to implement multi-layered cloud and endpoint security – including MI: RIAM, a sophisticated threat intelligence engine geared towards eliminating zero-day threats.