Roughly a week after the update was released, many machines still lack the fix for the critical CPU vulnerabilities.
Building a slide deck, pitch, or presentation? Here are the big takeaways:
- 26% of organizations have no Windows machines with the patches for the Meltdown and Spectre flaws. — Barkly, 2018
- 80% of IT and security pros said the update process for Meltdown and Spectre is unclear, and that they still have lingering questions. — Barkly, 2018
A week after the Windows update patching Meltdown and Spectre was made available, 26% of organizations still have not updated any of their machines, according to a survey of IT and security pros from Barkly.
For those unfamiliar, Meltdown and Spectre are two CPU flaws affecting Intel, AMD, and ARM processors. Essentially, the flaws allow applications to read kernel memory, and the fixes so far have caused slowdowns, random reboots, and a host of other problems.
The survey data from Barkly shows that patches aren't a magic bullet—there are many more steps involved in properly securing a fleet of enterprise devices following the discovery of a critical vulnerability. With the growth of such high-profile vulnerabilities and attacks, such as WannaCry and Petya, business must consider adopting a new patch strategy or system update policy, or updating their current approach.
SEE: System update policy (Tech Pro Research)
When surveyed about what number of machines they had running the update, as noted, 26% claimed to have none. Additionally, 25% said that fewer than a quarter of their devices were running the update, and 16% were unsure. Only 4% said that all of their devices were running it.
One of the initial issues was that the patch was incompatible with certain PCs, and with PCs running certain antivirus software. It also required the use of a registry key to work with some antivirus vendors, Barkly noted.
However, 46% of the respondents had no idea that a registry key was even needed, the report found. But 42% said their vendor had reached out regarding the patch's compatibility, and 64% said they were able to determine if they were compatible or not.
To help users figure out if they're actually running the properly updated version, Microsoft released a PowerShell script for admins to determine which of their users is running what version. But only 41% of those surveyed said they knew about the script, and only 19% had used it to determine their OS version. Overall, 80% said the update process to address the vulnerabilities was unclear, the report found.
To further address the flaws, Microsoft released an additional update on Wednesday that aims to prevent AMD devices from falling into an unbootable state after updating. More information on that is available here.
- IT pro's guide to effective patch management (free PDF) (TechRepublic)
- Meltdown-Spectre: Intel says newer chips also hit by unwanted reboots after patch (ZDNet)
- Windows 10 Creators Update: The smart person's guide (TechRepublic)
- Windows Meltdown-Spectre: Watch out for fake patches that spread malware (ZDNet)
- Meltdown-Spectre patch: Watch out for random reboots warns Intel (TechRepublic)