News and Events Meltdown and Spectre In the first Security update of 2018, Tom Crumpton will provide information on what the NREN global security community has on their agenda. Welcome to the first Security update of 2018 from our Head of Security, Tom Crumpton. Tom's updates will provide information on what the NREN global security community has on their agenda and any topical security stories.Meltdown and SpectreIt has been a busy start to 2018. Information regarding two new security vulnerabilities was publicly released on 3rd January 2018, “Meltdown” and “Spectre”. Whilst they were released recently to the public some organisations such as Intel, Google, Apple, Microsoft have known about them for months and have been releasing patches to prevent exploitation.Over the coming weeks and months, the Meltdown and Spectre vulnerabilities will likely evolve and software providers will release patches to counter these new threats. Therefore, it is an important time to check that patching processes are operating effectively and all security patches have been applied. Ensuring two factor authentication is enabled for all publicly facing services will help lower the risk of any attack.Further details on Meltdown and Spectre and the latest advice can be found on CERTNZs website.Global threat response exerciseWorking with 12 other national research and education network (NREN) partners around the world REANNZ participated in a global threat response exercise earlier this week.The paper based exercise simulated a threat, verified by national intelligence agencies of a major, multi-homed, multi-day DDoS attack on research infrastructure that is expected to occur within two hours. The source of the threat and also the target were unknown so the exercise focussed on planning and preparing for an imminent threat.The exercise helped us as an NREN community improve international working links and communication so that in a real-life event we can quickly react and target the source of a DDoS to protect our networks. This activity aligns with the DDoS proof of concept trial nearing completion with a subset of our membership. To learn more about the trial please contact Tom Crumpton.Further global threat exercises will be run periodically by the global NREN security working group, to ensure we are prepared for potential attacks.
