Vulnerability Management During Zero-Day and Crisis Situations

Celebrity vulnerabilities are my definition of the cybersecurity vulnerability types mostly falling in the zero-day vulnerability category, but they can be much more. They are those security weaknesses that become popular for one or the other reasons. However, organizations should be prepared to handle any zero-day vulnerability with all possible safeguards and countermeasures because it can lead to potential cyber-attacks or data breaches.

The world has seen unprecedented growth in cybersecurity investment over the last few years. Yet, despite pumping in millions of dollars, data breaches are increasing by the day, reaching an all-time high last year. Trends show that this year is not going to be different and at the half-way mark; trends are correct. Celebrity vulnerabilities are called so as their names become famous due to distinct reasons. While not all celebrity vulnerabilities are harmful as the hype, they could sometimes be fatal to an organization. They may result in the loss of confidentiality, integrity, and availability of valuable and sensitive organizational information assets. Therefore, software developers and IT security departments must implement robust security controls.

The World of Celebrity Vulnerabilities

'Celebrity Vulnerabilities' are high-profile vulnerabilities and exploits, and they include hyped-up zero-days and severe bugs with high attacking potential. Due to their catchy names, there are vulnerabilities with high social and industry following. Some famous examples are the RCE vulnerabilities, such as Springshell and Badlock. The Log4j vulnerability is another instance that affects systems and services using the Java logging library and Apache Log4j versions between 2.0 and 2.15.

The Changing Threat Landscape with Pandemic

The year 2020 and 2021 were the years when the world stayed remote. Let us see how cybersecurity attacks grew significantly from a pre-pandemic world, how the great digital migration changed the way businesses operate in a post-pandemic world, and how the attack surface has expanded and will continue to expand in a post-COVID world.

Cybersecurity attacks in a pre-pandemic world:

- PurpleSec reported a total of 812.67 million malware infections in 2018.

- A recent Check Point research reported a growth of 40per cent in cyber-attacks globally during the pandemic.

The great digital migration in a post-pandemic world:

COVID-19 has spurred the virtual adoption and increased growth drastically for individuals and businesses alike. It helped companies to go virtual in such a short span of time, but at the same time, it has also opened new avenues of exploitation for cyber adversaries.

- Before COVID-19, only 30per cent of the US employees worked remotely, but as per an Owl Labs report, nearly 70per cent of full-time U.S. workers have worked virtually, and many continue to do so.

Extended attack surface in a post-pandemic world:

- In one of its surveys, AV-TEST reported 1353 million malware infections in 2022, a more than 30per cent rise from 2018.

- An Internet Security Report of WatchGuard reported a 67per cent rise in zero-day exploits in quarter three of 2021

- As per MIT Technology Review, there are 66 zero-days have been reported in 2021, which is almost the double what it was in 2020

Most Prominent Celebrity Vulnerabilities That Made Their Name in the Last Few Years

Some bugs became the talk of the town across large corporations, financial institutions, government installations, and defense organizations. Knowing and understanding threat vectors, their origin, and the vulnerabilities exploited by these threats can help organizations manage zero-day vulnerabilities effectively and efficiently.

" Staying Prepared with Adequate Safeguards and Precautions is Essential to Prevent Malicious Actors from Exploiting a Situation "      

- Heartbleed, known initially as CVE-2014-0160, allowed cyber attackers to intercept secure communications to steal identity credentials like login, personal data, and decryption keys.

- Springshell vulnerability affects the spring-beans artifact, a transitive dependency of a popular framework used in Java applications and requires JDK9 or a higher version to function.

- Stagefright is among one of the worst Android vulnerabilities and affects 95per cent of all Android devices. Besides hijacking the camera and microphone, this allows attackers to steal data from infected Android devices.

- Badlock, on the other hand, allows MITM (Man-in-the-middle) attackers to intercept communications between clients and servers hosting a SAM (Security Account Manager) database.

Vulnerability Management During Zero-Day and Crisis Situations

The IT and security teams staying alert with all appropriate safeguards and countermeasures will help mitigate any zero-day vulnerability with minimal damage and loss while maintaining effective business continuity. The following steps can go a long way in vulnerability management during zero-day and crisis situations.

● Effectively Organizing a Team: The key is to encourage the IT security team to act on a quick recovery plan before the bug exploits the vulnerability. Having a mix of team members from the red team and the blue team would be great. Time is critical because the more you delay, the more challenging it will be. Your incident response team should be on its toes to patch up the vulnerabilities and keep pace with the bug.

● Having a Robust Patch Management Program: An effective patch management program helps elevate an organization's cybersecurity posture. It helps ensure that the patch management policies are in place and are followed, security controls are in place to manage zero-day vulnerabilities, and the approved patches with the latest version are thoroughly tested and then installed.

● Employee Education, Awareness, and Training: Educating and training the employees to create a high level of cybersecurity awareness can help build a robust cyber-aware culture. Merely having a zero-trust policy in force may not help, but how the staff can remain compliant is more important. Following cyber hygiene practices can go a long way in protecting against any third-party invasion.

● Preventing Celebrity Vulnerabilities from Being Exploited: Integrating the following practices into an organization's software development life cycle and adopting robust security measures can help avoid components with known vulnerabilities and prevent such bugs from exploiting any system.

- Appropriately integrating all security measures in the design phase (Security-by-design) without fail for creating secure software

- Following a zero-trust policy when receiving input from an external system and performing timely server-side input validation

- A thorough security review of all open-source software and components to avoid known and unknown vulnerabilities

- Patching up the operating system vulnerabilities and keeping all pieces of OS and application software up to date

Final Words

No one can ignore vulnerabilities in the system, however negligible or severe they are, as their present and future impacts may not always be predictable. Hence, staying prepared with adequate safeguards and precautions is essential to prevent malicious actors from exploiting a situation. While celebrity vulnerabilities have their hype surrounding them, preparing a remediation program prior is crucial. A systematic cybersecurity approach from IT security teams and software developers and a zero-trust policy can prove helpful for every organization in eliminating such vulnerabilities and deterring any consequent threats.