Preventing Zero Days, The Mandalorian Way

### Overview In this presentation, John Moeller (IT Security Manager at American Family Insurance) and Anders Norremo (founder of ThirdPartyTrust, now at BitSight) explore zero-day vulnerabilities, incident response, and third-party cyber risk management. Framing their discussion around the six cultural tenets of the Mandalorian, the speakers illustrate how foundational defense principles, cross-departmental collaboration, and supply chain awareness can protect organizations against critical vulnerabilities.

### Key Topics - **Understanding Zero Days and the Exploit Lifecycle**: Defining a zero day as a vulnerability where defenders have had zero days to patch once known. The speakers review the progression from discovery to exploit development, black-market sales, public awareness, patch creation, and distribution. - **The Mandalorian Framework**: Using six Mandalorian tenets to address cybersecurity practices: 1. *Wearing Armor*: Implementing security best practices, foundational frameworks (such as the NIST Cybersecurity Framework), and solid IT asset management. 2. *Speaking the Language*: Translating cybersecurity into the language of the business, aligning with business processes, and engaging teams during routine periods rather than only during crises. 3. *Defending Yourself and Your Family*: Expanding security oversight beyond internal walls to cover the digital supply chain and third-party ecosystem. 4. *Raising Children as Mandalorians*: Treating security as a shared responsibility through awareness, training, and building security guardrails. 5. *Contributing to the Clan’s Welfare*: Sharing knowledge with suppliers, industry peers, and community groups. 6. *Rallying to the Cause*: Cross-training teams and mobilizing the entire organization to detect and respond to security threats quickly.

### Technical Details - **High-Profile Zero-Day and Supply Chain Incidents**: The speakers examine recent widespread events, including the 3CX Voice over IP exploit (an active supply chain breach requiring uninstallation or rapid mitigation), the SolarWinds build-system compromise affecting downstream customers, and the pervasive Log4j library vulnerability that probed an estimated 44% of corporate networks. - **Vendor & Ecosystem Concentration**: Citing reports from Mandiant and Verizon, the speakers highlight that a significant portion of zero-day exploits (roughly 75%) concentrate around major software ecosystems—specifically Microsoft, Apple, and Google—with common threat vectors centering on credential theft, phishing, and Remote Desktop Protocol (RDP). - **Third-Party Cyber Risk Management (TPCRM)**: Effective TPCRM requires an accurate asset inventory, assessing vendor criticality and impact, continuous monitoring, and collaborative vulnerability scanning. The speakers emphasize that third-party connections should be treated with zero trust (analogous to a hostile network) while maintaining collaborative relationships to remediate external risks. - **Detection and Response Metrics**: While human error remains a factor in a high proportion of breaches (82% cited from Verizon data), the technical imperative is to build guardrails and automated detection. The speakers note that non-actor disclosure and detection times are increasingly measured in days rather than months.

### Takeaways - **Asset Management is Essential**: Without deep visibility into internal software libraries and external dependencies, identifying exposure to flaws like Log4j or 3CX is nearly impossible. - **Security Requires Cross-Functional Partnerships**: Cybersecurity teams cannot operate in a silo; success depends on embedding workflows into IT, procurement, HR, and legal operations. - **Secure the Digital Supply Chain**: Organizations must continually monitor and assess third parties, setting clear contractual SLAs for vulnerability remediation. - **Defense in Depth**: Organizations should apply multi-layered defenses (network segmentation, encryption, firewalls, and logging) rather than relying solely on post-release patching.