Can your file transfer provider resolve a zero-day breach?

Zero-day breaches strike fear into the hearts of any cybersecurity department, as they are the most difficult to prepare for due to their unknown threat vector. Worse, a zero-day exploit may require a rush mitigation or replacement process that may introduce additional security issues. 

Unfortunately, zero-day breaches appear to be rising. According to Mandiant Consulting’s M-Trends report, zero-day exploit attacks rose 50% in the last year, after setting new records in each of the last few years as well,

File transfer solutions are not immune from zero-day breaches, either, which is why this post will discuss how to choose a file transfer application based on its readiness to address unexpected security vulnerabilities.  

What is a zero-day breach?

Zero-day breaches refer to any exploit of a software application for which no patch or other remediation exists. In other words, “zero-days” refer to unknown vulnerabilities that an application’s developers have not yet discovered but may be in use by malicious actors. 

Due to the time and complexity involved in finding them, zero-day vulnerabilities are most frequently identified by security researchers, state actors and hackers. While “white hat” actors will quietly inform a software vendor in order to avoid any damage from an exploit, threat actors may wait for the appropriate time to use the exploit. 

Another challenge with zero-day breaches is that, depending on the type and scale of the exploit, it may not be possible to identify signs that an intrusion has occurred.

Why do some file transfer applications struggle with zero-day breaches?

Code errors and other bugs exist in almost any software application that has ever been written, but not all of them have the potential to be exploited. The challenge, from a developer and user perspective, is discovering unknown issues that may lead to an exploit. Doing so requires significant investment in ongoing engineering and testing that may not be available within an organization or may not be a priority.

Most file transfer protocols are decades old at this point. As a result, many file transfer providers view their applications as legacy tools that have not quite reached the extended support phase, but are not receiving significant product investment. 

Customers can also view file transfer applications as simple tools that do not require investments in ongoing support or maintenance. As technology evolves, however, this approach carries a risk that discovered vulnerabilities may not become known to the user until it’s too late. 

How can you assess your file transfer provider’s breach readiness? 

It’s difficult to prepare for the unexpected, but it is possible. When choosing a file transfer provider, we recommend examining the key areas below to ensure that your solution will be able to handle a potential zero-day breach. 

1. Active 24/7 support

If your application does not have existing support options, it’s highly unlikely that the provider has the ability to respond quickly to any issue that may occur. An active support team serves as the front line for customer communication about any potential issues, and will also coordinate the supplier’s response if an issue does occur. 

Without this crucial component, you may struggle to know if your application is affected by a vulnerability, or if the vendor is even aware of an issue you discover. 

Forum-based or email-only support teams will likely be too understaffed and slow to respond in a situation where every minute increases your organization’s data security risk. 

Cerberus FTP Server by Redwood offers 24/7/365 support via our Enterprise Plus Edition. 

2. Ongoing development

As software ages, institutional knowledge of the product fades as engineers leave or move to other projects. File transfer applications with active product roadmaps are best positioned to quickly develop patches in the event of a zero-day vulnerability, because they will have engineers actively working on the product who are familiar with its codebase. 

If an exploit is identified, your application provider could lose critical time responding by having to onboard engineers, pore over documentation that may or may not be up-to-date, and familiarize themselves with the codebase. These steps alone could take days while attackers continue their exploits. 

Cerberus FTP server’s engineering team operates on a quarterly release schedule, ensuring we are constantly fixing bugs and improvements identified by our internal team and customer base. 

3. External testing and verification commitments

Software quality benefits from as many sets of friendly eyes as possible looking for bugs. Your file transfer application provider should have a robust, proactive third-party penetration test and security verification plan in place to provide an objective assessment of the vendor’s security controls and identify gaps overlooked in internal reviews. These audits are particularly crucial for maintaining an unbiased view of the vendor’s overall security posture.

In addition to penetration testing, your application’s third-party reviews should include several additional evaluation layers:

• Static Application Security Testing (SAST), which analyzes an application’s source code, bytecode or binary code for security vulnerabilities. 
• Software Composition Analysis (SCA), which reviews third-party libraries and open-source components that developers use in applications to ensure these components meet security requirements.
• Dynamic Application Security Testing (DAST), which tests a running application in its live environment to detect certain behaviors or misconfigurations that could lead to exploitation. DAST is often your best tool for simulating attacks that mimic the behavior of zero-day exploits.

4. A zero-day response plan

A robust zero-day response plan is critical for minimizing the impact of an exploit. Leading file transfer applications such as Cerberus FTP Server, implement well-defined, real-time response strategies that activate as soon as a vulnerability is identified. 

These plans typically include:

• A customer communications plan to keep all stakeholders informed as soon as an issue arises and throughout the mitigation process
• Mobilization plans to add resources where required to fast-track patch deployment
• Additional testing plans to ensure no further issues are introduced in a patch

These measures provide peace of mind and enable businesses to implement protective actions while awaiting a permanent fix.

To learn more about securing your file transfer application from zero-day exploits, download our MFT server partner JSCAPE by Redwood’s guide “How to secure file transfers in the breach era” today.