Cybersecurity Policy Report, Hackers Seen Relying More on ‘Zero-Days’ for Successful Attacks, (Nov 13, 2024)
Malicious cyber actors relied more heavily on the use of “zero-day” vulnerabilities—newly discovered security flaws for which no fix is available—to conduct cyber attacks in 2023 than in the previous year, cyber defense agencies from five nations said in a report published yesterday.
“In 2023, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks compared to 2022, allowing them to conduct cyber operations against higher-priority targets,” according to the report titled “2023 Top Routinely Exploited Vulnerabilities.”
“In 2023, the majority of the most frequently exploited vulnerabilities were initially exploited as a zero-day, which is an increase from 2022, when less than half of the top exploited vulnerabilities were exploited as a zero-day,” the report notes.
But many successful cyber attacks relied on known vulnerabilities that organizations failed to patch, according to the report, which lists the 15 vulnerabilities that hackers exploited the most last year.
It recommends ways for technology vendors and end-users to improve their cyber defenses. For example, vendors should pay more attention to security when bringing products to market, and end-users should deploy patches more quickly.
“More routine initial exploitation of zero-day vulnerabilities represents the new normal which should concern end-user organisations and vendors alike as malicious actors seek to infiltrate networks,” Ollie Whitehouse, chief technology officer for the United Kingdom’s National Cyber Security Centre, said in a news release.
“To reduce the risk of compromise, it is vital all organisations stay on the front foot by applying patches promptly and insisting upon secure-by-design products in the technology marketplace,” Mr. Whitehouse said.
“We urge network defenders to be vigilant with vulnerability management, have situational awareness in operations and call on product developers to make security a core component of product design and life-cycle to help stamp out this insidious game of whac-a-mole at the source,” he added.
In addition to the NCSC, the report was issued by cyber defenders in the U.S., Australia, Canada, and New Zealand.
News: InternationalLegislation DataSecurity