The rise of the zero-day market

https://www.schneier.com/essays/archives/2007/01/schneier_fu...

I got to experience plenty of that myself when I started. They (a) didn't care, (b) called me a liar, or (c) called me well-intentioned but too incompetent to assess the [non-existent] risk to their users/customers. This continued while Microsoft and other big names got smashed by more attacks than we could keep track of which were often easily prevented (eg buffer overflows). Eventually, many companies were forced to do something for real about their software quality thanks to all the attacks and disclosures w/ exploits as proof. Microsoft adopting SDL and mitigation practices is probably the greatest success of full disclosure given their near monopoly on desktops.

Interesting enough, he kind of contradicts his own position later. He first argues against full disclosure as purely damaging with no benefit because nobody can keep systems updated at the necessary rate. Then, he says security in his testing improved from 4 minutes to 1 hour to break thanks to awareness from all the breaches in the news that he implies are partly due to full disclosure. So, did they have zero benefit or did they plus black hats benefit via awareness? Even he can't seem to buy his own claim twice in the same article...

1. https://medium.com/@fallible/we-discovered-severe-bugs-in-11...

Also the article concentrated on malicious, that is, malware, exploitations.

Also can define zero day as any problem never seen before. The cause might be software flaws, hardware failures, human system management errors, and more, all in addition to malicious causes.

Then for any and all zero day problems, need to detect, diagnose, and correct.

So, start at the beginning: How to detect?

Here issues are, what parts of, say, a server farm to monitor, what data to get and use, what to do about rates of false alarms and missed detections, and more.