A Zero Day Exploit is an exploit that is circulating before the software vendor has learned of it. They can linger around as un-patched vulnerabilities if the vendor is slow or unable to respond to them.

Security software with lots of bells and whistles tends to encourage end users to feel more secure. They have firewalls, Antivirus protection, all sorts of resident programs and pretty icons. Something pops up now and then asking for their input; again insuring them it is working hard to protect them. They pay good money for this software, so it must give them some reason to rest easier at night. The sad fact is that even the best network protection scheme short of not having a network, is never safe. Let’s take a look at the situation today, and let’s talk about what we know. As of the writing of this article there are 3 un-patched vulnerabilities affecting Microsoft Word that have been known for over one month. That means that in spite of your efforts to protect yourself it is possible that a user at your company could receive an email containing an attached word document with an exploit designed to compromise your systems and your user would be the only line of defense. You’ve done everything you can do to layer your defenses, keep your systems up to date, and protect them pro-actively with other security software but there still is a chance that it could come down to the actions of that end user. That is why you should not overlook the human element in your security apparatus. Building a security aware culture is an important step in any IT security strategy. Teaching end users to get confirmation from third parties when they receive a message containing a suspicious attachment for example; can go a long way in preventing exploitation of your valuable resources. Scheduling regular training sessions where current issues are addressed can pay large dividends if even one compromise of your security apparatus is avoided. Educated users are safer users.

At Managed Solutions we advocate quarterly training sessions for existing employees and orientation for new users of our clients systems. By keeping the humans up to date with the latest information, our customers can substantially lower the chances of experiencing costly cleanup operations, loss of reputation and most importantly lost customers. What does your company do to educate its users? Perhaps it is time for you to consider a shift towards a more educated end user base. A security aware culture is the main protection we have against zero day exploits.