Crowdstrike's outage report
4TL;DR: “We’re going to start doing testing and staged deploys, just like they teach in school.”
https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/
- 2 comments, 2 replies
- Comment
TL;DR: “We’re going to start doing testing and staged deploys, just like they teach in school.”
https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/
EULA rewrite to include authorization for any user system to be employed for “wide beta” in 3…2…1…
My favorite thought on Crowdstrike’s disaster: The client apparently does no checking on the update files.
How hard would it be to feed it a malicious update, not just a buggy one?
@blaineg push a bios update that reboots itself before it finished?
Hypothetically if you had a malicious actor in your midst (a disgruntled former employee), they could push a site wide malware file that gets loaded with the update (presuming they know the directory the update is going to be in)
The Crowdstrike method is fairly secure, but as a client you give up a lot of autonomy when you trust them as a more hands-on service.
TL;DR - if other security services are more like having Glenn on tape delay so he doesn’t have a wardrobe malfunction on a live feed, having CS being the security service is like having another arm within Glenn; in theory Meh’s arm doesn’t have to work so hard, but it does feel crowded.