{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Vulnerability & Patch Management","Secure Development (SDLC) & Application Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event","iso-27005-threat"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Avuln-zero-day","description":"Adversary employs attacks that exploit as-yet-unpublicized vulnerabilities (targeted, based on reconnaissance, or nontargeted), compromising systems before any patch or signature exists.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"vuln-zero-day","taxonomies":["nist-800-30-threat-event","iso-27005-threat"],"treatment":"mitigate"},"id":"risk:vuln-zero-day","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Avuln-zero-day","sourceIds":["aiuc-1","cobit-2019","dora","eu-ai-act","iso-27001","nist-800-53","nist-csf-2","pci-dss"],"sourceUrl":null,"title":"Zero-day exploitation","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:22f4784516c521fb419f7c01e7d1b4c5d2a6daad9b2e06e4d8aa22a3cb39d78e","properties":{"rationale":"Continuous integrity monitoring surfaces the unexpected changes left by unknown-vulnerability exploitation as adverse events.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-06-3863b890.json","sourceId":"uc:UC-VULN-06","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:294018791896c64a9d93a83900a6161e68d2bfea3af191c2c2be93b99dcb998c","properties":{"rationale":"Defense in depth, fail-safe defaults and execution-domain isolation limit exploitation of unknown, unpatched vulnerabilities.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:311639e86b776f3f168a0b4f45e79accc724e13dd8882b4898685f949d3cabc3","properties":{"rationale":"Exchanging IOCs/TTPs gives early warning of novel exploits, but the sharing arrangement feeds detection/blocking rather than itself being the operative zero-day defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-16-462251f1.json","sourceId":"uc:UC-BCDR-16","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3125978e4c4b0254f5023cb92a8b6fea0088eb0478698a6922a5fefd1a5f8a6d","properties":{"rationale":"Threat-intel feeds give early IOC/TTP warning of novel exploits, enabling detection before any signature or patch exists.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-09-911f6a6c.json","sourceId":"uc:UC-ASSET-09","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:40118493df14de997232c3400b3ca70d2ce29fbc04338b5b6ae4187f2f9d60f7","properties":{"rationale":"Time-bound patch deployment shrinks the exposure window once a patch ships for a formerly-unknown vulnerability.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-03-cc58f6a7.json","sourceId":"uc:UC-VULN-03","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4e0509dfb7597290ec3dcc049cfe682091df5de03f67a14d2adde01bbcb37150","properties":{"rationale":"Email/web filtering and behavioral anti-malware block delivery of phishing-borne and novel exploit payloads lacking a signature.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-05-5870fcee.json","sourceId":"uc:UC-VULN-05","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:68349674078884030f9fc40ad511634f4e53eb9d8d66183b1619a7329e2a47be","properties":{"rationale":"On exploit-induced failure, failing to a known safe state preserves security protections and blocks unsafe continuation, limiting impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-08-0a9cdc47.json","sourceId":"uc:UC-VULN-08","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ccf79837aa9b13290d566d8e6e077a6b06da511d36b26c16b86050e090c548b1","properties":{"rationale":"Secure coding reduces the count of latent, as-yet-undiscovered vulnerabilities in own code.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","sourceId":"uc:UC-SDLC-05","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cf0005f9ca50ea2a3b5744e0e8b210a94efb318b29adc6553044f184c11e4e66","properties":{"rationale":"Taint activations detect exfiltration from exploitation of unknown vulnerabilities that preventive and signature controls missed.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-11-b9fdd819.json","sourceId":"uc:UC-VULN-11","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f3f40cfad72e696ffe8ca0681924d57b321303688a9c267f9f65d31c2560f714","properties":{"rationale":"Periodic non-persistent refresh evicts adversaries who exploited unknown vulnerabilities, limiting dwell when no patch exists.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-09-01891801.json","sourceId":"uc:UC-VULN-09","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fccc8e725dda5b6c1b43e601d7c58d977a08ae2f91ddab77565bbaa1754ff03c","properties":{"rationale":"DEP/ASLR memory protections block reliable exploitation of unknown memory-corruption vulnerabilities before any patch exists.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-07-abfa5ce7.json","sourceId":"uc:UC-VULN-07","targetDetailPath":"/data/v1/records/risk-vuln-zero-day-a821d603.json","targetId":"risk:vuln-zero-day","type":"mitigates"}],"schemaVersion":1}