Vulnerabilities / Threats //

Vulnerability Management

1/4/2019
03:35 PM

How Intel Has Responded to Spectre and Meltdown

In a newly published editorial and video, Intel details what specific actions it has taken in the wake of the discovery of the CPU vulnerabilities.
2 of 7

The Intel Product Assurance and Security (IPAS) Group
One of Intel's first public statements after the disclosure was its statement of a Security First Pledge. One of the ways in which it brought that pledge into the real world was through the creation of the Intel Product Assurance and Security Group.
In the statement announcing the creation of the group, its general manager, Leslie Culbertson, wrote, 'IPAS is designed to serve as a center of security excellence -- a sort of mission control -- that looks across all of Intel. Beyond addressing the security issues of today, we are looking longer-term at the evolving threat landscape and continuously improving product security in the years ahead.'
In its response to the speculative execution vulnerabilities, Intel has also increased its emphasis on security across all its product lines. It has created groups like STORM - the strategic offensive research and mitigation group, to conduct research on security across its chips and systems. In conducting its own offensive research, Intel is trying to move beyond points like those raised by Richard Ford, chief scientist at Forcepoint, who said that Intel (and other vendors) had found themselves creating ad hoc, point mitigations rather than long-term fixes. They were, he said, '...waiting until a researcher comes up with a new vulnerability of this type and responding to it, rather than trying to put an end to the entire line of vulnerabilities.'
(Image: Bru-n0 VIA Pixabay)

The Intel Product Assurance and Security (IPAS) Group

One of Intel's first public statements after the disclosure was its statement of a Security First Pledge. One of the ways in which it brought that pledge into the real world was through the creation of the Intel Product Assurance and Security Group.

In the statement announcing the creation of the group, its general manager, Leslie Culbertson, wrote, "IPAS is designed to serve as a center of security excellence - a sort of mission control - that looks across all of Intel. Beyond addressing the security issues of today, we are looking longer-term at the evolving threat landscape and continuously improving product security in the years ahead."

In its response to the speculative execution vulnerabilities, Intel has also increased its emphasis on security across all its product lines. It has created groups like STORM the strategic offensive research and mitigation group, to conduct research on security across its chips and systems. In conducting its own offensive research, Intel is trying to move beyond points like those raised by Richard Ford, chief scientist at Forcepoint, who said that Intel (and other vendors) had found themselves creating ad hoc, point mitigations rather than long-term fixes. They were, he said, "waiting until a researcher comes up with a new vulnerability of this type and responding to it, rather than trying to put an end to the entire line of vulnerabilities."

(Image: Bru-n0 VIA Pixabay)

2 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10014
PUBLISHED: 2019-03-24
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
CVE-2019-10015
PUBLISHED: 2019-03-24
baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.
CVE-2019-10017
PUBLISHED: 2019-03-24
CMS Made Simple 2.2.10 has XSS via the advanced_search.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
CVE-2019-10010
PUBLISHED: 2019-03-24
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.
CVE-2019-9978
PUBLISHED: 2019-03-24
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.