How Law Firms and Legal Departments Can Protect Against Meltdown and Spectre

Meltdown and Spectre are hardware vulnerabilities that hackers could use to steal information from computer memory. A very serious exploit could result in a compromise or theft of sensitive personal data, such as passwords or banking information. Not only is Meltdown and Spectre having a widespread impact on many systems and devices, the “fixes” for the devices will impact the speed and productivity of the machines themselves. Therefore, the “cure” for Meltdown and Spectre may be difficult to implement. Unfortunately, Microsoft has also stated that if a computer is using older Intel processors (e.g., Windows 8), end users will likely notice a decrease in system performance after installing the patch.

What are the most important steps law firms and legal departments can take to protect themselves from these vulnerabilities?

Despite reservations about the difficult cure, it is critical that legal departments and law firms follow the recommended steps to address both Meltdown and Spectre across their affected devices and systems. To accomplish this, organizations must use their most rigorous efforts to follow advice and guidance as it becomes available from their technology vendors. Unfortunately, this advice is currently quite limited, and is still changing rapidly.

That said, some immediate actions that organizations can take to help shore up their systems are to make sure that their operating systems and browsers have the latest updates, and to look for guidance from vendors with BIOS updates for their motherboards.

Though it can be time consuming and expensive to uncover which vulnerabilities exist, the risk of losing sensitive proprietary and client data is so high — making it critical that all devices and systems be appropriately protected. Specifically, be sure to read the guidance from your firm, company or department's various vendors. For example, Microsoft provides guidance with its latest Windows Server updates, so make sure to update your anti-virus software before applying the patch to your device.

Whose responsibility is it to ensure the company's hardware, devices and software programs are protected from vulnerabilities like Meltdown and Spectre?

It is the IT department's responsibility to ensure the company's hardware, devices and software programs are all protected and have the appropriate patches applied. The security team should also provide guidance. As an IT professional, it's important to ensure your organization is constantly monitoring for notices and bulletins of vulnerabilities through systems like the NIST's National Vulnerabilities Database.

Is there any way for companies to completely prevent Meltdown and Spectre from affecting their Windows systems?

The short answer, unfortunately, is no. It appears that all systems with affected hardware could be vulnerable to Meltdown and Spectre. That said, if you apply the appropriate patches to all devices and systems, you may be able to protect your data, albeit with potential performance issues.

If one of these vulnerabilities is discovered in a company's system, what actions should be taken, both short- and long-term?

At its core, Meltdown allows hackers to gain access to unpatched systems. If you assume that the attacker is already inside (which is best practice for a strong security program regardless), you may be able to reduce significant damages through vigilant monitoring of unauthorized privilege elevation of your IT systems. Vulnerabilities such as Meltdown will enable attackers, but they are only a means to an end. Your goal should be to minimize the attacker's time within your network, which reduces the time they can spend searching for valuable, private data and information.

What are a few cybersecurity best practices to protect systems and prevent instances like these vulnerabilities from having a widespread impact on them?

Always assume that the attacker is already inside of your devices or systems. Don't waste time waiting for evidence that they are there — assume they already have access, and instead, spend your time ensuring you have a constant program in place to manage and monitor for unexpected behaviors. At the same time, make sure that your users have the least privilege possible that is required for them to do their jobs, and monitor and recertify this regularly. Don't just patch your systems on a scheduled basis; adjust your habits regularly to ensure that attackers won't be able to anticipate your patch plans and work around you. Finally, don't protect your systems against only headline news grabbing vulnerabilities, such as Meltdown and Spectre. Security patching should always be a top priority — no matter what's going on in the news.

*****
Adam Schlagman is the Editor-in-Chief of Cybersecurity Law & Strategy.