We’ve gathered the following information from a video interview with Joe Jeanjaquet, Senior Director of Applied Technologies at Eclypses.
What is a zero-day attack?
A zero-day attack occurs when an attacker takes advantage of a vulnerability that exists within a software or hardware, that the developer is unaware exists, to steal data or damage a system. This is referred to as a “zero-day” because the victim has “zero-days” to prepare for it, as it can happen suddenly and with no warning.
Who is vulnerable to zero-day attacks?
We are all vulnerable to zero-day attacks. As a consumer our data is at risk when companies we trust to secure them become victims. In these cases, financial and personal information can be stolen from us by hackers. As a developer, even utilizing all the best practices doesn’t guarantee safety from zero-days as third-party or outside systems still run high risks of being vulnerable and allowing hackers into their network. Finally, as a company one small flaw in the security that is exploited could result in large financial loss as the company is the one expected to foot the bill when their customers are victimized by a zero-day attack.
Why are the number of zero-day attacks increasing so rapidly? 
There are many reasons why zero-day attacks are increasing. One reason is the increase in the value of digital assets causing hackers to be more motivated to access data. This leads to a second reason because as the value of data rises, we also see a rise in the number of people willing to pay hackers to gain access to networks in what is referred to as “exploit as a service.” Large sums of money in the form of bounties are offered to hackers to steal data from various companies and individuals providing even more financial motivation to perform zero-days. The third reason is the increase of quality open-source tools that people are meant to use for development, but instead take advantage of to steal data.
Are there any specific industries that are more vulnerable to a zero-day attack?
- Crypto and NFT Markets
- Financial and Investment Organizations
- Government and Critical Infrastructure
Any industry where data has a value will be a main target for zero-days. Three key examples of this include crypto and NFT markets, financial and investment organizations, and government and critical infrastructure. These targets deal in large amounts of money and valuable, highly sensitive information, making them prime targets for people with financial or political motivation behind them.
What are best practices to avoid zero-day attacks?
When talking about security it is important to consider both the reactive and proactive approaches. Reactive has always been the main form security takes when it comes to zero-days since they are so difficult to predict and prevent. However, as they continue to grow in number, it is clear this is simply a defeatist attitude and will not prevent future attacks from devastating victims. Instead, companies must adopt proactive security measures by protecting data where it is created, the application, instead of just in the operating system. With MTE, data is protected as soon as it is created, closing a large gap which many hackers take advantage of to perform zero-day attacks. Don’t wait to become the next victim of a zero-day, be proactive in protecting your data.
