The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem.
I am looking for a rule-of-thumb for assessing the risk of not patching a server or hypervisor.
From reading the whitepapers, my understanding is that you definitely need to apply the patch if your machine:
- is a workstation that runs random potentially malicious code - including, it turns out, java script from random websites,
- is a VM that could potentially run malicious code (which essentially becomes the first case).
- is a hypervisor that runs untrusted VMs next to sensitive VMs (which essentially becomes the first case),
My understanding is that the risk is (significantly) lower in the following cases:
- server running on dedicated hardware running a tightly-controlled set of processes in a tightly-controlled network (including not using a web browser to visit untrusted sites)
- VM running a tightly-controlled set of processes on a virtualization stack of other tightly-controlled VMs, all in a tightly-controlled network.
Is that logic sound, or am I missing something?
UPDATE: early adopters of the patch in Azure are reporting no noticeable slowdown, so this may all be moot.
Related question: What are the risks of not patching a workstation OS for Meltdown?