Zero Day Vulnerability Response

Zero-Day Vulnerability Response

Responding to zero-day vulnerabilities — from discovery and triage through emergency patching, virtual patching (WAF), and post-incident hardening.

When to Use

• A zero-day CVE is announced affecting your technology stack
• Responding to active exploitation of an unknown vulnerability
• Implementing emergency mitigations before vendor patch is available
• Assessing exposure and risk across your infrastructure
• Communicating zero-day impact to stakeholders

Response Framework

ZERO_DAY_RESPONSE = {
    'triage': 'Assess impact: affected systems, exploitability, data exposure',
    'contain': 'Implement virtual patch, block exploitation vectors, limit exposure',
    'investigate': 'Check for signs of prior exploitation (logs, IOCs)',
    'mitigate': 'Apply vendor patch, workaround, or config change',
    'verify': 'Confirm mitigation effective, scan for residual exposure',
    'post_mortem': 'Update detection rules, improve patch process, document lessons',
}

class ZeroDayResponse:
    """Coordinate zero-day vulnerability response."""
    
    def __init__(self, cve: str, score: float, affected: List[str]):
        self.cve = cve
        self.score = score  # CVSS score
        self.affected = affected
        self.exploited_in_wild = False
        self.actions = []
    
    def virtual_patch(self, waf_rules: List[Dict]) -> List[str]:
        """Deploy WAF rules to block exploitation attempts."""
        # ModSecurity/WAF rule to block zero-day exploitation
        patched_endpoints = []
        for rule in waf_rules:
            # Deploy rule to WAF in blocking mode
            patched_endpoints.append(f"Deployed WAF rule: {rule.get('id', 'N/A')}")
        return patched_endpoints
    
    def assess_exposure(self, asset_inventory: List[Dict]) -> Dict:
        """Determine which assets are potentially vulnerable."""
        exposed = [a for a in asset_inventory if a.get('software') in self.affected]
        return {
            'total_assets': len(asset_inventory),
            'potentially_exposed': len(exposed),
            'critical_exposed': len([a for a in exposed if a.get('critical', False)]),
        }

Common Pitfalls

1. Panic patching without testing — emergency patches that break production are worse than the vulnerability
2. Only patching internet-facing systems — attackers move laterally; patch internal systems too
3. Not checking for prior compromise — assume the worst; check logs for exploitation signs
4. Only applying vendor patch — virtual patching (WAF, IDS) provides defense-in-depth alongside vendor patch
5. No communication plan — executives, customers, and regulators need timely updates

Verification Checklist

• CVSS score and exploitability assessed
• Virtual patch deployed to WAF/IDS
• Asset inventory checked for vulnerable systems
• Logs reviewed for signs of prior exploitation
• Vendor patch tested and deployed within SLA
• Internal and external communication sent
• Detection rules updated for exploitation attempts
• Lessons learned documented and patch process improved