The Shrinking Zero-Day Window

Cyber criminals are not lazy. Nor are they cheap with their Research & Development (R&D) money. They are running a business: a very serious business, which experts say will generate over ten trillion dollars per year of revenue by 2025. According to Cybersecurity Ventures, cybercrime is expected to grow at a rate of 15% per year for the next 5 years.

When mounting attacks, cybercriminals have a wide variety of tricks and schemes in their toolbox to choose from, but the alarming speed with which they are now able to exploit known vulnerabilities is astounding. Cybersecurity software provider Rapid7 recently updated their 2021 Vulnerability Intelligence Report.  Their analysis shows that in the space of one year, the average time between the discovery of a vulnerability and a Zero-Day attack has collapsed from 42 days to just 12 days.

What is a zero-day?

When a developer or vendor discovers a flaw in their software that results in an exploitable vulnerability, it means they have ‘zero days’ to get it fixed. However, these vulnerabilities are rarely fixed in a day. A zero-day attack simply means that cyber criminals exploit the vulnerability before the developers get it fixed. Hackers usually discover these vulnerabilities before the developers do – after all, it’s their job. In the hacker’s world, Vulnerability = Money.

Regardless of the type of IT support you use, from the low-level Break/Fix ‘IT guys’ to the best Managed Services Providers (MSPs) it is rare for any of them to find these deeply buried vulnerabilities, because they wouldn’t even know where to begin looking. These IT services provide maintenance and repair – they don’t spend their time scouring through thousands or even millions of lines of code for these flaws.

Zero day vulnerabilities don’t send out alarms, and until something goes wrong, like an attack, finding them is like looking for a needle in a haystack – specifically because they have no indication that there is a needle at all.

A forensic analysis performed after a devastating attack often reveals the flaw. This is the main impetus for cyber criminals to step up their game. Essentially. This is like finding an ‘unlocked door.’ Hackers need to take advantage of it before someone sees it and locks it. The fact that in one year the hackers became three ½ times faster at mounting and performing successful attacks does not bode well for the future. As previously noted, these crooks are not lazy.

Three events occur to turn a Zero-Day into an attack:
1) A zero-day vulnerability is the software flaw itself. Often discovered by the hackers before the developers are aware of it. Occasionally it is the result of a network flaw due to inferior IT services.
2) A zero-day exploit is the method hackers develop that will enable a successful attack.
3) A zero-day attack is simply using the exploit to breach a network for criminal ends.

What are some of the most recent zero-day attacks?

Smaller attacks happen frequently, but the most widely-reported breaches are:
Marriott International in September 2018
Facebook in April 2019
Alibaba in November 2019
LinkedIn in June 2021

The personal information of over 2.2 billion customers or users was stolen In these four attacks alone.

It is a false assumption that huge companies are the only businesses being targeted, because the inverse is true. The overall #1 target of cybercrime are Small and Mid-size Businesses (SMBs). SMBs are hackers’ ‘bread and butter.’

Think back to ‘Goldilocks and the Three Bears.’ If Goldilocks were a cybercriminal, she would look for the victims that are best suited to her: Government and Multinational conglomerates are ‘Too Big.’ Grifter snatch-and-grabs against consumers are ‘Too Small.’ BUT, for the vast middle class of cyber crooks, where the greatest number of hackers are, SMBs are ’Just Right.’

Just like the Charlotte IT Support community has its own ‘pecking order, the ‘community’ of cybercrime has its own system of echelons or classes. The lowest on the totem pole are small time hoods breaking into consumer cell phones or home PCs to grab a couple hundred bucks.

High-level hackers attack governments and mammoth corporations. They are the hackers who make the news feed – and they are not looking for you or your business.

It's the mid-level crooks you need to worry about – and they are the most plentiful in number. This is a business, and day after day, they stay focused – on SMBs. In the past, the conventional wisdom among experts was that because of the 42-day lag-time between the discovery of a vulnerability, the development of the right exploit and then the attack itself, these attacks were more or less relegated to high-stakes criminals. When the ability to initiate zero-day attacks went from a month and a half to a week and a half, the mid-level thieves started jumping in with both feet.

What is the best protection against zero-day attacks?

There is never any guarantee of 100% protection. Because they are based on vulnerabilities discovered before the developer or IT crew have detected and fixed them, it is difficult to protect against them. The steps taken by either your in-house IT department or outsourced Managed Services Provider like ITFirm.com should be geared towards eliminating the lion’s share of attacks and mitigating the damage should any attacks be successful.

How to mount an effective zero-day defense.
Adopt and implement these tools:

1) Windows Defender Exploit Guard
2) Effective Patch Management
3) Next-Generation Antivirus (NGAV)
4) Incidence Response Plan (Part of a Backup & Disaster Recovery Plan)