Information Security Basics
Which statement correctly describes a zero-day attack?
- AAn attack carried out only on the day the software is installed
- BAn attack that targets only old vulnerabilities for which fixes were released many years ago
- CAn attack that exploits a software vulnerability after it is discovered but before the vendor provides a fix (or before the fix is widely applied)
Show answer and explanation
Answer: C. An attack that exploits a software vulnerability after it is discovered but before the vendor provides a fix (or before the fix is widely applied)
A zero-day attack exploits a vulnerability while the vendor does not yet know about it, or knows but has not yet provided a fix (patch). Counting the day the fix is released as day one, the attack happens before it, on "day zero," hence the name. Since no patch can be applied, it is important to stack other measures to limit the damage, for example disabling unneeded services to reduce the attack surface, minimizing privileges, segmenting the network, using mechanisms that detect and respond to suspicious activity on endpoints (such as EDR), and applying workarounds published by the vendor. Once a fix is provided, it should be applied as soon as possible.
- A. The "zero" in zero-day does not refer to the day of installation but means the attack comes before a fix is provided.
- B. Attacks on vulnerabilities whose fixes were released long ago can be prevented by patching; they are not zero-day attacks.
- C. Correct. Exploiting a vulnerability before a fix is provided is a zero-day attack.