Vulnerabilities / Threats //

Vulnerability Management

1/4/2019
03:35 PM

How Intel Has Responded to Spectre and Meltdown

In a newly published editorial and video, Intel details what specific actions it has taken in the wake of the discovery of the CPU vulnerabilities.
2 of 7

The Intel Product Assurance and Security (IPAS) Group
One of Intel's first public statements after the disclosure was its statement of a Security First Pledge. One of the ways in which it brought that pledge into the real world was through the creation of the Intel Product Assurance and Security Group.
In the statement announcing the creation of the group, its general manager, Leslie Culbertson, wrote, 'IPAS is designed to serve as a center of security excellence -- a sort of mission control -- that looks across all of Intel. Beyond addressing the security issues of today, we are looking longer-term at the evolving threat landscape and continuously improving product security in the years ahead.'
In its response to the speculative execution vulnerabilities, Intel has also increased its emphasis on security across all its product lines. It has created groups like STORM - the strategic offensive research and mitigation group, to conduct research on security across its chips and systems. In conducting its own offensive research, Intel is trying to move beyond points like those raised by Richard Ford, chief scientist at Forcepoint, who said that Intel (and other vendors) had found themselves creating ad hoc, point mitigations rather than long-term fixes. They were, he said, '...waiting until a researcher comes up with a new vulnerability of this type and responding to it, rather than trying to put an end to the entire line of vulnerabilities.'
(Image: Bru-n0 VIA Pixabay)

The Intel Product Assurance and Security (IPAS) Group

One of Intel's first public statements after the disclosure was its statement of a Security First Pledge. One of the ways in which it brought that pledge into the real world was through the creation of the Intel Product Assurance and Security Group.

In the statement announcing the creation of the group, its general manager, Leslie Culbertson, wrote, "IPAS is designed to serve as a center of security excellence - a sort of mission control - that looks across all of Intel. Beyond addressing the security issues of today, we are looking longer-term at the evolving threat landscape and continuously improving product security in the years ahead."

In its response to the speculative execution vulnerabilities, Intel has also increased its emphasis on security across all its product lines. It has created groups like STORM the strategic offensive research and mitigation group, to conduct research on security across its chips and systems. In conducting its own offensive research, Intel is trying to move beyond points like those raised by Richard Ford, chief scientist at Forcepoint, who said that Intel (and other vendors) had found themselves creating ad hoc, point mitigations rather than long-term fixes. They were, he said, "waiting until a researcher comes up with a new vulnerability of this type and responding to it, rather than trying to put an end to the entire line of vulnerabilities."

(Image: Bru-n0 VIA Pixabay)

2 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6455
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a double-free problem in the function rec_mset_elem_destroy() in the file rec-mset.c.
CVE-2019-6456
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the file rec-fex.c of librec.a.
CVE-2019-6457
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_aggregate_reg_new in rec-aggregate.c in librec.a.
CVE-2019-6458
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_buf_new in rec-buf.c when called from rec_parse_rset in rec-parser.c in librec.a.
CVE-2019-6459
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_extract_type in rec-utils.c in librec.a.