WTF is a zero-day?
Short version
A zero-day is a flaw that gets attacked while it is still unknown, so defenders had no warning.
The briefing
- NIST's definition
- An attack that exploits a previously unknown hardware, firmware or software vulnerability.
- The name
- It is about the head start. The defenders got zero days of warning.
- Loose use
- You will see the word on flaws that are public with no patch yet and on bugs that were fixed weeks ago.
- Zero-day or in the wild
- A zero-day attack is exploitation in the wild by definition, but a flaw can stay under attack long after its fix ships.
- Old bugs still kill
- CISA warns that attackers may target vulnerabilities for months or even years after updates are available.
- No fix yet
- You cannot patch what nobody has fixed, so a true zero-day tests everything else you have.
In the Threat Brief this looks like:
Zero-day in ExampleApp. No patch yet.
That word gets used loosely, so read the advisory. If there really is no fix, your other defenses are doing the work.
Example only. The product, versions and names are made up.
What to do
- Read the advisory and ask two questions. Is a fix out? Is it being attacked?
- Lean on least privilege, short-lived credentials, separation between systems and logging.
- Layer your defenses so that when one fails, the next one catches it.
- When the fix ships, take it fast and from the vendor directly. Attackers read advisories too.
- Then check for signs of compromise, since the attack started before the fix existed.