RE: Definition of Zero Day Protection

["Brian Smith" <bsmith () tippingpoint com>]

Mark,

The problem with zero day protection is inherently ambiguous --
it could be protection against zero day exploits or zero day
vulnerabilities (or something entirely different, I suppose).
So it's important that when a marketdroid touts zero day
protection, ask them if they mean protection against zero
day vulnerabilities or zero day exploits.

        Brian

-----Original Message-----
From: Teicher, Mark (Mark) [mailto:teicher () avaya com]
Sent: Monday, August 09, 2004 3:51 PM
To: Brian Smith; Carey, Steve T GARRISON
Cc: Seanor, Joseph (Joe); focus-ids () securityfocus com
Subject: RE: Definition of Zero Day Protection


Brian,

I under the definition of zero day exploit, and zero day
vulnerabilities, I was looking for the definition of the Zero Day
Protection concept, since it very confusing for us newbies to Intrusion
Detection and Intrusion Prevention.

/mark

-----Original Message-----
From: Brian Smith [mailto:bsmith () tippingpoint com] 
Sent: Monday, August 09, 2004 02:45 PM
To: Carey, Steve T GARRISON; Teicher, Mark (Mark)
Cc: Seanor, Joseph (Joe); focus-ids () securityfocus com
Subject: RE: Definition of Zero Day Protection

It's important to distinguish between zero day exploits and zero day
vulnerabilities.  Zero day exploits exploit a known vulnerability with a
new exploit (like Code Red vs. Code Red II).
Zero day vulnerabilities are flaws in software that no one knows about
except the attacker.

Several products (TippingPoint, MacAfee, ISS, to name a few) can detect
and block zero day exploits by detecting network traffic that tries to
exploit the underlying vulnerability.  These all work by decoding the
application request and checking that the network traffic is attempting
to exploit the underlying vulnerability.

Zero day vulnerabilities are another animal entirely.  These are
detected (if at all) by noticing statistical or behavioral anomalies.
For example, they might detect a sudden surge in UDP traffic destined
for a particular port, or notice that two machines are starting to
communicate on a port that they've never used before.  There's no known
way to surgically block just the bad traffic in that case.  As Steve
says, blocking traffic detected by behavioral/statistical anomalies will
sometimes block new applications.

Several products offer mitigation strategies to limit the new traffic's
ability to impact existing applications (e.g., they might rate limit the
UDP traffic to 1 Mbps so it doesn't swamp you network), but I don't know
of any product that can block zero day vulnerabilities with blocking
legitimate traffic.  If a vendor thinks their product can block zero day
vulnerabilities without blocking legitimate traffic, please post the
details of how your product works.  I'm sure everyone here would love to
get some hard facts on this type of technology.

        Brian Smith


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------