Zero Days should not be a fire drill

Steve Winterfeld and Tony Lauro draw on their incident response work across breaches and widely publicized vulnerabilities to argue that a zero day is a systemic problem, not just a SOC incident. They point to events such as Heartbleed, Log4j, SolarWinds, Spectre and Meltdown, and say the first questions are where the affected software and firmware sit in your environment and where they sit in your critical vendors' environments. Asset inventories, software bills of materials and a firmware patch process are presented as the basis for answering those questions quickly.

The middle of the talk covers coordination. Response needs a clear owner, a notification plan with secondary contacts, and input from legal, privacy, PR and vendor management, since some disclosures carry statutory deadlines. Tabletop exercises are recommended to expose gaps in call trees and decision-making under pressure, and to set update expectations for leadership and analysts. The speakers recount how Heartbleed's first fix was incomplete, and how Log4j exploitation attempts reached a large share of one vendor's customers, with most blocked by virtual patching far from the vulnerable code. Board conversations should be framed around business risk rather than technical detail.

The closing guidance is practical: document the process, rehearse it against past incidents, pull best-practice wording from NIST publications, join industry ISACs, and build a cross-functional internal group before the next disclosure. Transparency with customers and regulators is presented as the stronger long-term position.