Blog

Thought Leadership

Threat Finds

N-Day vulnerabilities: minimizing the risk with Self-Learning AI

N-Day vulnerabilities: minimizing the risk with Self-Learning AIDefault blog imageDefault blog image
28
Jul 2022
28
Jul 2022

Responding to the latest critical vulnerability has become a regular routine in the daily life of cyber security professionals.

In the last two years, there has been a carousel of patches for vulnerabilities affecting email servers (ProxyLogon), remote working infrastructure (Atlassian Confluence), third party tools (Kaseya), and supply chain software (Log4j).  

In the days following the public disclosure of such vulnerabilities, any associated exploit is referred to as an “N-day”. The release of a patch marks day 1, but over the following days any unpatched systems are at risk of attack from exploits which target the vulnerability. This contrasts with zero-day attacks, which exploit vulnerabilities for which no patch is available, often because knowledge of the vulnerability isn’t yet in the public domain. 

N-days occupy a unique space in cyber risk analysis. Headline-grabbing zero-day attacks have the potential to be high impact, but in reality such attacks are rare and have a low likelihood. A more common cyber-attack, using commodity malware which has been well documented in the wild, may have a high likelihood but will have a low impact when faced with a mature security stack. But in the hours and days following the publication of a new vulnerability, there is a high likelihood of a high impact attack against an organization which makes use of a new exploit.

Table 1: A potential qualitative risk analysis comparing three cyber risks: a threat group targets an organization using either commodity malware, a zero-day exploit, or by leveraging an N-day vulnerability.


After a critical vulnerability is published, security teams battle against time and resourcing constraints to apply the appropriate patch or patches, all the while trying to protect assets without a playbook of what an attack may look like. Darktrace has found that 85% of high-risk vulnerabilities are not patched within one week and 70% remain unpatched after a month. In the meantime, threat groups have become armed with a new attack method: an N-day exploit. 

In their latest research, Darktrace’s Inside the SOC team detail how the techniques used by Self-Learning AI to detect zero-day attacks can also be leveraged by organizations to Detect and Respond to N-day attacks.

But with Darktrace PREVENT, defenders can go one step further, enabling security teams to harden defenses before the next attack vector is even published. 

The Darktrace PREVENT product family empowers defenders to model likely attack paths, intelligently prioritize critical servers or highly exposed people in the organization, and test vulnerable pathways by emulating real-world attacks. Darktrace PREVENT then feeds data back into Darktrace DETECT + RESPOND to harden defenses around critical attack paths or assets and further enhance cyber resilience. For example, if Darktrace PREVENT discovers that a critical database is serving high-risk users, it can feed that information back into Darktrace DETECT, which in turn increases the level of scrutiny around that asset. 

Figure 1: Visualising Darktrace’s technology vision of a Cyber AI Loop: four interconnected AI engines continuously enhancing each other’s capabilities. 


While Darktrace DETECT + RESPOND wrap what amounts to an ‘AI safety blanket’ around vulnerable assets and attack paths, Darktrace PREVENT presents prioritized recommendations for long term risk mitigation. Stretched security teams therefore know, based on Darktrace’s deep and evolving understanding of the entire business, where to focus their time and resources in order to reduce risk to the greatest extent. 

As a result, when the next N-day vulnerability comes around, defenders have the confidence that any prospective impact has already been minimized and the potential cyber risk is low.

More in this series:

항목을 찾을 수 없습니다.

Like this and want more?

Receive the latest blog in your inbox
감사합니다! 제출되었습니다!
양식을 제출하는 동안 문제가 발생했습니다.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Oakley Cox
Analyst Technical Director, APAC

Oakley is a technical expert with 5 years’ experience as a Cyber Analyst. After leading a team of Cyber Analysts at the Cambridge headquarters, he relocated to New Zealand and now oversees the defense of critical infrastructure and industrial control systems across the APAC region. His research into cyber-physical security has been published by Cyber Security journals and CISA. Oakley is GIAC certified in Response and Industrial Defense (GRID), and has a Doctorate (PhD) from the University of Oxford.

USE CASES
PRODUCT SPOTLIGHT
항목을 찾을 수 없습니다.
COre coverage
항목을 찾을 수 없습니다.
This Article
N-Day vulnerabilities: minimizing the risk with Self-Learning AI
Share
Twitter logoLinkedIn logo

귀하의 비즈니스에 좋은 소식입니다.
나쁜 사람들에게 나쁜 소식입니다.

무료 평가판 시작

무료 평가판 시작

유연한 배송
가상환경에 설치하거나 하드웨어에 설치할 수 있습니다.
빠른 설치
설치하는 데 1 시간 밖에 걸리지 않으며 이메일 보안 평가판의 경우 더 적게 걸립니다.
여정 선택
클라우드, 네트워크 또는 이메일을 포함하여 가장 필요한 곳 어디에서나 셀프 러닝 AI를 사용해 보십시오.
약정 없음
Darktrace Threat Visualizer 및 세 개의 맞춤형 위협 보고서에 대한 모든 액세스 권한이 있으며 구매 의무는 없습니다.
감사합니다! 제출되었습니다!
양식을 제출하는 동안 문제가 발생했습니다.

Get a demo

유연한 배송
가상환경에 설치하거나 하드웨어에 설치할 수 있습니다.
빠른 설치
설치하는 데 1 시간 밖에 걸리지 않으며 이메일 보안 평가판의 경우 더 적게 걸립니다.
여정 선택
클라우드, 네트워크 또는 이메일을 포함하여 가장 필요한 곳 어디에서나 셀프 러닝 AI를 사용해 보십시오.
약정 없음
Darktrace Threat Visualizer 및 세 개의 맞춤형 위협 보고서에 대한 모든 액세스 권한이 있으며 구매 의무는 없습니다.
감사합니다! 제출되었습니다!
양식을 제출하는 동안 문제가 발생했습니다.