Protect Your Network with Zero-Day Threat Protection

Zero-day threats refer to a class of vulnerabilities that are detected in a system or device but have yet to be patched by the vendor community.

Typically targeted towards a specific company, device, or application, a successful zero-day attack can inflict significant damage across an organization. For example, DataProt reports that ransomware attacks are expected to occur every 11 seconds and cost over $20 billion globally per annum. Past experience indicates that threat actors target organizations with multiple interconnected systems, security flaws, deep pockets, and the willingness to pay to restore business services.

Between the time of discovery until the vendor issues a patch, cybercriminals race to exploit the vulnerability. A study by Cisco states that 5% of vulnerabilities are remediated within one month of discovery, while 67% are resolved within three months. Over 16% remain open for a whole year or more. The same study found that a whopping 95% of assets contain at least one highly exploitable vulnerability.

Relying solely on vendors to repair your systems gives threat actors immense opportunities to access and exploit them. A 2020 report on the costs of the ten largest computer malware incidents in history places the annual cost of exploitation at over $55 billion. In addition, the increase in digital transformation processes across modern companies has led to the rapid expansion of the attack surface and, in turn, its attractiveness to bad actors.

Through its best-in-class research and threat protection platform, Trend Micro can enable organizations to mitigate risk and avoid costly damage.

Mitigating zero-day threats

The cyber landscape is increasing in diversity and scale with more applications, devices, and networks storing and transmitting more information than ever before. This increase presents cybercriminals with a target-rich environment to exploit. Most of these attacks target either an entire company’s infrastructure or part of the infrastructure that contains a weakness.

Consider all the devices that are a part of the internet of things (IoT). For example, a vulnerability in a connected medical device can allow malicious actors entry and the ability to move horizontally through a hospital’s infrastructure and launch a ransomware attack. The most effective ways to mitigate these types of risks come from early detection methods made possible through continuous investigation.

Trend Micro™ Research directs resources towards collecting and analyzing information that can be indicative of potential threats. Using artificial intelligence (AI) and machine learning (ML), this cybersecurity research team sifts through vast amounts of data to identify tangible and potential dangers. These teams build on knowledge of threat patterns gained over years of global intelligence to pick the essential snowflakes out of the information blizzard.

Since 2014, Trend Micro has blocked over 300 billion threats. The intelligence comes from network traffic and investigations conducted with the help of law enforcement agencies to, in turn, infiltrate underground criminal organizations globally to learn how they operate.

Knowing how and why attacks work is key to anticipating the next step and aids the creation of preventative measures. Attacks may take its form by developing a variation of an existing attack, or they may be a targeted attack on a company with similar infrastructure to one that was previously attacked. Trend Micro analyzes customer traffic to detect potential vulnerabilities, remediate them, and harden the infrastructure by limiting interconnectivity. This is done by implementing the “principle of least privileges” for access. With over 450 internal researchers and data scientists networked across the world, Trend Micro can address global and regional specific threats and attacks, while working with national and international authorities to stop cyber threats.

Prevention, detection, and response are crucial steps towards mitigating zero-day risks. After identifying a vulnerability, it’s a race against time to block it. Trend Micro provides risk mitigation strategies to neutralize the risk, keeping customers protected often months before the public patch is available.

Mitigating the Log4j threat

The Log4Shell threat (also known as Log4j and officially referred to as CVE-2021-44228) was discovered at the end of 2021 when it attacked the popular Apache Log4j 2 logging utility. This threat passes essential information to threat actors and enabled remote code execution (RCE) on a targeted machine. An upgrade of Log4j (Log4j 2) soon resolved this vulnerability.

In addition to the vendor-supplied solution, Trend Micro provides its customers with additional protection against these types of attacks, including detecting malicious components that may compromise other parts of your system.

The Trend Micro free assessment tool harnesses the scanning power of the Trend Micro Vision One™ threat detection platform. This allows you to identify the endpoints and server applications subject to infection by Log4j.

In addition, Trend Micro customers can benefit from threat sweeping capabilities. Trend Micro Visions One detects indicators of compromise (IoCs) for Log4j as part of daily sweeping activities. These intrusion detection systems and intrusion prevention systems (IDS/IPS) provide additional levels of security for all malicious code, including Log4j. This actionable security alert delivers a complete discussion of Trend Micro capabilities developed in response to this threat..

Additional threat mitigation methods

Virtual patching implements protection in production environments to detect and block suspicious activity and remove the paths between the malware and its target. As part of regular security functions, these capabilities protect against known and unknown threats.

For cloud or hybrid infrastructure organizations, Trend Micro Cloud One™ – Workload Security customers use Trend Micro search capabilities to detect hosts where suspicious activity may be occurring. Furthermore, Trend Micro has developed preventative measures in the form of rules, filters, and detection capabilities for additional levels of protection. Trend Micro provides customers with trusted domain filtering, only allowing traffic from known and trusted domains while allowing access by location through geolocation and domain filtering. This allows organizations to shrink their digital attack surface by limiting a variety of threats.

Best-in-class solutions

MITRE is a not-for-profit organization that works to solve problems for a safer world. MITRE ATT&CK, a globally available free database used to create threat models, mitigates the threat of cyberattacks. The MITRE ATT&CK cybersecurity software evaluation cited Trend Micro as providing exceptional attack protection.

Trend Micro Cloud One™ – Network Security offers the first line of defense against Log4j and other zero-day security threats. Security teams can leverage cloud-native threat and vulnerability detection and protection by inspecting and filtering ingress and egress traffic. Designed to work with all public cloud providers, Network Security scans, discovers, and thwarts threats while providing the necessary information to restore protection and guard against attacks.

Network Security leverages information provided by Trend Micro Research and the Trend Micro™ Zero Day Initiative™ (ZDI) so you can take advantage of virtual patching. This limits the widening of your attack surface and restores post-threat PCI compliance.

Staying one step ahead of cybercriminals

Zero-day attacks, by definition, are unknown until they inflict damage. The primary way to protect the cyber community is through extensive research, developing preventative measures, and incorporating this information into solutions that can implement these measures.

ZDI brings together an entire vendor agnostic community to help hunt and detect the latest vulnerabilities. With the information gained on the latest reported vulnerabilities, Trend Micro can quickly implement virtual patching technology to protect customers’ applications and infrastructure.

Trend Micro mitigates zero-day attacks through research, solutions, and community participation while Trend Micro Cloud One solutions have built-in zero-day protection to reduce the risk of vulnerabilities, giving you peace of mind with continuous protection your assets.

Find more information on how Trend Micro secures your environment by utilizing decades of security expertise, global threat research, and continuous innovation.