Zero-day: what it means

In short

The term is used in three closely related senses: the zero-day vulnerability (the flaw not yet fixed), the zero-day exploit (the code that exploits it) and the zero-day attack (the use of that exploit against a target). When the vendor publishes the patch, the vulnerability becomes an "n-day": known, with a remedy available, but still dangerous for anyone who has not updated.

How it works

The typical cycle goes like this: someone discovers the flaw, exploits it or sells it, the vendor becomes aware of it (from a researcher, an affected customer, an investigation), develops and publishes the fix, then companies install it. Days or months can pass between discovery and patch. Between the patch and its installation, in many companies, more months pass: and that is where most real-world attacks happen.

Zero-days have a high economic value and are used sparingly, often against very widespread products exposed on the internet: VPNs, firewalls, mail servers, file transfer platforms.

Why it matters

Against a zero-day there is no update to install, so defence shifts to what you can control in any case:

• reducing what is exposed: a service that cannot be reached from the internet cannot be attacked from the internet (this is the job of Attack Surface Management);
• knowing what you have: when the advisory comes out, the inventory tells you within minutes whether you use that product and in which version;
• watching behaviour: a SIEM or an EDR can notice the anomalous activity that follows exploitation, even if the vulnerability is unknown;
• applying the temporary mitigations indicated by the vendor straight away, and the patch as soon as it comes out.

Example

At the end of May 2023 a criminal group exploited an unknown vulnerability in MOVEit Transfer, file exchange software used by thousands of organisations, later catalogued as CVE-2023-34362. The attackers stole data from a great many companies and public bodies before the fix was available, and then used it for extortion. The organisations that did not expose that service on the internet, or that managed to isolate it as soon as the advisory came out, limited the damage.

The lesson applies to an SME too: you cannot predict the next zero-day, but you can know in advance what you expose and who to call when it happens. On crisis handling, see the CSIRT entry.

Related terms

• CVE
• Patch management
• Threat intelligence
• Indicators of compromise (IoC)