Infrastructure security lessons from Meltdown

Most of us would have heard of Meltdown, a major security flaw that made the news in January this year. What exactly is Meltdown, and what are the implications to CIOs and IT and system managers? Even more importantly, what are the infrastructure security lessons that we can learn from it?

In a nutshell, Meltdown is a hardware vulnerability that affects various modern microprocessors, including those from chip maker Intel. A design weakness in components intended to help the processor deliver better performance has enabled the contents of protected memory to be inferred by analysing various system parameters.

What it means is that rogue software can be used to access privileged data and gain control of the system, effectively sidestepping various security mechanisms and policies implemented by the operating system. Indeed, this “melting” of traditional security boundaries normally enforced by the processor hardware is the main reason behind its name.

For now, security patches have been made available in varying degrees on different operating systems, which work by blocking some of the attack avenues. Despite some complaints of slowdown in certain scenarios, the severity of the problem means that it is essential that systems be patched. This is especially the case as a Meltdown attack cannot be detected, and hence cannot be stopped on a vulnerable system.

If there is one lesson that the industry can learn from Meltdown, it would be how perfect security is an elusive target. Security flaws exist in both software and hardware systems and is often a matter of time before they are discovered by security experts or hackers. Meltdown, for instance, has existed for years before its discovery at around the same time by three independent groups of researchers.

Within the data centre, the awareness that no one security system is infallible is the reason behind the multiple levels of security implemented within data centres. While the combination of an authorised ID and fingerprint scanners work well enough, modern data centres typically employ up to eight levels of security including different types of biometric scanners. Iris and palm-print readers could be installed at key intersections for a start, while round-the-clock video surveillance offers the ability to audit security incidents and identify root causes.

And at a time of heightened concerns over terrorism and an increase in the strategic value of digital infrastructure, modern data centres have also started incorporating additional defences against forcible entry. Strengthened gates can typically withstand the impact of a ramming truck, while anti-climbing walls and photovoltaic sensors keep intruders away. At Singtel, armed security patrols also act as another level of deterrent.

While Meltdown was found in processors made by more than one chip maker, there is no question that Intel’s x86 processor family was the most heavily impacted. Indeed, reports indicate that at least one cloud provider may consider looking to Intel’s rivals in the wake of the revelation. Though the considerations behind a switch are myriad and complex, it does underscore the intrinsic value of not putting all your eggs in one basket.

For CIOs, this could be another argument against a pure cloud approach. While Meltdown can certainly allow hackers to compromise on-premises workloads, Meltdown opens the Pandora’s box to a nightmare scenario where attackers could potentially exploit hardware flaws to rummage through the memory of a shared virtual machine on a public cloud. A hybrid deployment could hence ensure that risks are spread out across both on-premises and public cloud infrastructures.

Notably, a hybrid cloud deployment consisting of public cloud and on-premises infrastructure does offer several advantages by itself – the former offers benefits such as rapid deployment times and elasticity, while the latter affords greater control and can be more cost-effective when running intensive workloads.

Ultimately, security is not a destination, but a journey that organisations need to continually monitor, and invest into.