The new year is scarcely four days old, but corporate enterprises already face one of the biggest security risks not only of recent times but possibly of the last decade: the “Meltdown” and “Spectre” critical vulnerabilities in central processing units that by all accounts affect chips from most major manufacturers.

Those vulnerabilities, if exploited, give malicious actors access to data running through the CPU itself, meaning that potentially any data on an unpatched device is at risk.

Although some patches have been forthcoming, such as an urgent release from Microsoft Corp., other devices remain open to attack. So what should enterprise users do to prepare for Meltdown and Spectre attacks?

Ben Carr, vice president of strategy at Cyberbit Ltd., told SiliconANGLE that vulnerabilities such as Meltdown only highlight the breadth of the potential issues organizations face no matter the investment. “In the cybersecurity industry, we must realize that we have maxed out on our ability to lock down systems and networks,” Carr said. So it’s now critical that enterprises look to ways not only to prevent attacks but to defend against them.

“A strong cyberdefense starts with the realization from the analyst to the board that we should all assume that we will be compromised at some point, the key is in how you respond,” Carr said. “Instrumenting and monitoring your network so you have the information and evidence to respond is your best investment toward recovery.”

Carr recommends that organizations take active steps such as developing their own internal programs for active defense and that they should not look at their security operations centers as part of their defense strategy.

“Along with the SOC comes the need for some sort of incident response capability,” Carr said. “You can’t rely on the belief that it won’t be your organization that gets hacked.”

Carr noted that “many organizations that don’t have the expertise internally are looking toward the growing number of managed security service providers offering these services, but make sure you do your due diligence and work with an MSSP that has the ability and solid reputation.”

Carl Wright, chief revenue officer at AttackIQ Inc. added that with 2018 off to an unfortunate start, he expects these types of threats to escalate throughout the year.

“Never more than today has there been a need for security organizations to continuously validate their security controls and posture in near-real-time,” Wright said. “Spectre and Meltdown are just the latest examples of vulnerabilities that allow attackers to gain privileged access with little effort.”

Wright added that “organizations must assume attackers will gain an initial foothold into the network and subsequently, be prepared to exercise incident response and compensating controls.”

Photo: wiredforsound23/Flickr