The security world is buzzing about two serious vulnerabilities that impact nearly every modern processor since 1995. With such a widespread impact, these vulnerabilities are a clear reminder of the benefits of utilizing a vulnerability management solution that works around the clock to alert you of known flaws—before you have to read about them in a news article (or a blog like this one).
The hardware vulnerabilities, dubbed Meltdown and Spectre, exploit a feature in chips known as "speculative execution” that’s used to optimize performance in most modern CPUs. These vulnerabilities are being addressed in a vendor-by-vendor manner, meaning that Microsoft, Red Hat, Apple, etc. have patches of their own. So far, patches or updates have been announced for Windows, Apple, Linux, Google, Mozilla and Android—but with more vendors coming out with fixes every day and many more forthcoming in the next week or so, it can be difficult to keep up with patching those vulnerabilities.
The good news is, if you have a vulnerability management system like Nodeware you can be alerted of new patches and updates, and immediately have access to the steps to remediate them. And since users are alerted when the patch is missing, they don’t have to read about it online, or worse, wait for that vulnerability to be exploited.
Nodeware is unique among other vulnerability management technologies in that it monitors around the clock, not only alerting you of vulnerabilities, but providing steps to immediately remediate them. If you aren’t utilizing vulnerability management as part of your cybersecurity strategy, start by performing the latest updates that you see available so you don't fall victim to these large exploits when they do occur.
The situation with these specific vulnerabilities is still fluid, since the responsible disclosure date was the 9th and therefore many vendors were not ready with their fixes when the news leaked early. Because the root cause lies in the hardware design, the forthcoming software patches will only mitigate, not remediate the underlying issues and often affect performance.
Once each vendor releases the list of affected hardware and software, detection of these vulnerabilities will be more exact. Until then, it should be assumed all computers and mobile devices are affected—so keep an eye out for relevant patches and updates.
To speak with one of IGI’s security experts about your current state of security, or to learn more about Nodeware vulnerability management, contact us today.