Zero-day vulnerabilities, for readers new to vulnerability
classifications, are vulnerabilities in hardware or software that have
been discovered, but do not yet have an available patch or fix. When
details of the security hole become widely known, it gives attackers
free rein to develop exploits, and forces infosec folks to figure out
how to block attacks, develop workarounds or live without whatever
service the systems provide.
Unfortunately, these vulnerabilities are a growing reality. For the last
several months, attackers have been releasing zero-day vulnerabilities
and exploits for everything from word processors and spreadsheets to
specific operating systems.
If there was ever a nearly impossible task of embracing and enforcing
best practices across an organization this is it. So, how can we
better protect against zero-day holes and still continue to function?
One resource to be familiar with is eEye Research, a site that tracks
these vulnerabilities.
http://research.eeye.com/html/alerts/zeroday/index.html.
The site currently contains nine vulnerabilities that range in days of
exposure from 17 to 428 (more than a year!) and the eEye list is not
complete. Exploits and vulnerabilities are being trafficked in closed
circles that have not surfaced yet.
We must also assume our strategy should include defense-in-depth,
security mechanisms that remain flexible and maneuverable (such as host
based intrusion detection systems and software firewalls) while
embracing processes and standards that enclave our environments and
close every unneeded port on every machine across the enterprise.
Last, stay current on the issues as they emerge. RSS feeds, security
intelligence clients (such as WatchDog, free from our site) and security
portals are the primary weapons.
Organizations that fail to heed the warning signs and that have not
embraced holistic security had better invest heavily in tools for
incident response, incident handling and forensics.
Watchdog
http://reg.itworld.com/servlet/Frs.frs?Context=LOGENTRY&Source=security_site&Source_BC=1&Script=/LP/10005210/reg
