IT and cybersecurity professionals were greeted with a horrible 2018 New Year’s surprise when they returned to work after the holidays. Intel, the world’s largest supplier of Central Processor Unit (CPU) Chips, announced their hardware had two significant security flaws. These security flaws potentially affect over 80% of IT systems globally and has been referred to as Meltdown and Spectre.
There are only two options to protect your servers, workstations and other IT appliances from these Intel CPU security flaws:
- Replace your hardware with updated Intel CPU chips
- Patch the software and firmware that drive your systems.
Obviously, option #1 is not a feasible course of action for most organizations. Thus, many have been building plans to execute option #2 and patch their firmware and software as the main effort to mitigate these vulnerabilities.
However, a significant delay has developed, hampering everyone globally in getting their systems fully patched to protect against these two vulnerabilities. Intel pulled back the initial technical information they provided to their vendors (both hardware and software) because the fixes failed to address Spectre properly. This has caused all hardware vendors to pull back their firmware patches for the Intel CPUs as well as many software vendors to recall their operating system security patches. The IT community will not be able to fully patch until Intel can provide new technical data to the hardware and software vendors to ensure the patches fully address the Spectre vulnerability.
There is some breaking news today that malware vendors are starting to find malware samples with attempts to leverage these vulnerabilities. However, these early attempts to “weaponize” the exploit are still not viewed by the cybersecurity industry to be effective. So, the risk is still relatively low until a widely available, effect exploit is introduced into the wild.
To get continual updates on both the Metldown and Spectre vulnerabilities, visit our FAQ pages: