If so, you might be curious how PCIC has responded to them. If not, it may be time to learn how your organization could have been affected, and what you can do to protect yourself against future software vulnerabilities.
Potential damage – Is your device at risk? (Hint: Probably)
Last month, two security issues, dubbed “Spectre” and “Meltdown,” were publicly released regarding vulnerabilities with central processing units. Their potential impact was great – not only were personal devices vulnerable, but also cloud computing machines hosted by Google, AWS, and Microsoft Azure. These and many others make up the backbone of the IoT (internet of things).
Here’s a little background on central processing units (CPUs) that may help paint a picture of the damage potential. CPUs are the silicon and circuitry filled chips in our favorite devices that make our lives easier (most of the time). These devices include: desktops, laptops, servers, tablets, smartphones. The function of these chips is to carry out commands from software programs. They frequently process sensitive information, and Spectre and Meltdown bypass security measures that could allow an unauthorized user to access that sensitive information.
Meltdown and Spectre: How they work
Both vulnerabilities manipulate a feature built into your CPU. This feature is called “Speculative Execution” and essentially guesses what operation the processor will perform next. The reason it does this is to improve the speed of the processor. Faster processing means faster programs, which is something we all want. The designers of this feature had no idea this may cause issues down the road. The main problem with speculative execution is that information is running in parallel to each other in high speed memory. This can allow side-channel vulnerabilities from an unprivileged user.
Meltdown gains access to sensitive information stored in the kernel memory. The kernel is the bottom layer of a machine's operating system such as Windows, macOS and Linux. This means all operating systems can be victims. Meltdown affects Intel chips built between 1995 and now.
Spectre also provides an avenue for attackers to access information residing in the cached (temporarily saved) files of running programs. Security experts are reporting Spectre can be harder to exploit than Meltdown, which likely means it will be more difficult to mitigate. Devices using Intel, AMD and ARM processors are vulnerable.
How did this affect PCIC?PCIC has taken all necessary measures to patch (fix) these vulnerabilities, allowing us to successfully mitigate potential attacks. Because we process large quantities of sensitive data, this was of paramount importance. Patches are continuing to be released by operating systems and CPU vendors.
Vulnerabilities need to be patched quickly, but it's effect must be tested prior to being pushed onto an entire server farm. First, our development machines were patched and then tested. Then followed single machines in an availability set. Then finally our isolated back end environment where our sensitive data is housed. While this was occurring, Azure infrastructure was patched at the hypervisor level.
4 easy steps you can take to protect against mal-ware:Thankfully, the vulnerabilities were disclosed to some of the major corporations in the tech industry months earlier under a non-disclosure agreement. This gave them some time to prepare fixes or mitigations, so users can now install updates to protect their devices. Please find a list of best practices below:
1. Install the latest patches on all devices, personal and work.2. Keep all your programs up to date including your preferred browser.
3. Practice good email hygiene.
4. Install anti-virus and malware software on your machine. Scan often.
