The Ministry of Public Administration and Security, which oversees the management of central government departments and local government information systems, has launched a special investigation into the entire server operated by the government in relation to CPU security flaws. Based on the results of the survey, we plan to provide comprehensive follow up on the national information technology (IT) infrastructure. Security experts advise that CPU performance is inevitable, but there is no obvious way to prevent further damage in addition to patch updates. Because it is a design flaw in the hardware, not the software, it is not enough to do the follow-up action.

According to the related organizations on January 7, the National Intelligence Service of the National Intelligence Service (formerly the Ministry of Information and Communication) is conducting security verification work on 20,000 servers in Daejeon and Gwangju Centers.

"We have been working on regular security patches, but we have been working on establishing a special verification plan by recognizing the seriousness of this incident, and we have 20,000 verification servers, I`m working on a 1, 2, In addition to the information systems of central administrative agencies such as the Board of Audit and Inspection, the Ministry of Science and Technology, the Ministry of Land, Information and Financial Services, and other related services, It has been operating non-stop. Therefore, it is necessary to protect cyber threats and various obstacles.

The Korea Regional Information Development Institute, which operates administrative information systems and information systems for local autonomous entities, also conducts special checks on cooperation with the Ministry of Foreign Affairs and Trade and 30,000 servers. The development agency first notified all the local governments of CPU security vulnerability through the in-house cyber infringement response system and completed the latest update patch.

An expert of the Agency for Local Information Development said, "We are doing security checks on all systems including cleaning and reuse information systems."

Both organizations plan to complete the verification work as soon as possible and follow up. However, it is noticed that there is no proper countermeasure besides security enhancement by applying the SW patch. It is noticed how the solution can be found.

Meltdown and specter can be exploited as a way to steal important information that the CPU processes. Meltdown has been found on Intel CPUs as a vulnerability that allows hackers to penetrate hardware barriers and penetrate computer memory and steal personal information such as login passwords. Intel is not a design flaw. Specter is a security vulnerability in Intel, AMD and ARM Holdings, which exploits a bug in several commands in the CPU.

The corresponding security patch blocks the vulnerability by disabling functions that access the CPU`s critical memory area.

However, after patching, CPU performance is reported to be reduced by up to 30%, especially organizations and companies that process large amounts of data are inevitably hit.

"This vulnerability is a kind of pathway to access important information such as passwords that are automatically saved in a web browser, which can be solved with a patch," said Hauri. "Even if you update a patch, We need to watch it. "

Intel has been concerned that updating the patch will reduce CPU performance, and that the performance impact of the update will depend on workload, so it will not be a big deal for regular PC users and can be eased. Korea Internet & Security Agency (KISA) also recommends updating the patches (fixes), saying that the damage to ordinary PC users may not be immediate. KISA has informed Korean companies about patch updates.

The vulnerability has not yet been exploited, so security experts point out that even if the damage is not immediate, the information may leak from the CPU.

By Lee Gyung Tak ？ Lim Seong Yeop kt87@


[ copyright ⓒ The Digitaltimes ]