3 ms·

Well, if you look on all news sites, they put highlight that is a windows issue. I personally think that IT managers should be blamed for the disaster, but in

Well, if you look on all news sites, they put highlight that is a windows issue. I personally think that IT managers should be blamed for the disaster, but in the collective imagination this will e a microsoft/windows problem.

mingus88 2y ago
Blaming IT managers is akin to blaming a bus driver when the bridge collapses. IT managers are required to implement AV for compliance. They'd lose their jobs if they refused to do it and either failed an audit or got hit by common malware. It's ironic to see so much praise this morning for the macOS model for kernel extensions. The fact of the matter is Microsoft allows 3rd party code to do exactly what happened today, and the industry leader in endpoint security completely failed to QA their updates.
- vb-8448 2y ago
  IT managers allowed an external entity to do a massive update on all their devices and servers. I'm not saying to don't install AV or not update it, just first update system-test envs and then roll out patches gradually, not all together.
  - mingus88 2y ago
    Bus drivers allowed themselves to be assigned routes over bridges that were not engineered or built well enough. It's ridiculous to put the blame on IT managers for this. The fact that Microsoft Azure itself has been affected by this shows that this is not a problem that any middle manager at a small firm should have be held responsible for.
    - vb-8448 2y ago
      Are you serious? If I push a code change in production before going through the test environment and this cause trouble, I'll be fired. We already have rules and procedures that work for "normal" software, why they cannot be applied to AV software?
      - mingus88 2y ago
        It's obvious that you have never served in corporate IT management, so this is a pointless conversation. I'll just leave this here for anyone else who may be interested. In many/most orgs, the windows sysadmins and IT management will not have access to the crowdstrike console. The CISO and security teams are completely separate, and operate independently. They will always push for the business need to deploy policy updates at any time, as the threat landscape will not wait for the next patch cycle. And actually, this has been the right call and has objectively prevented compromise many times over. You were so close to getting this right, too. It's crowdstrike that didn't follow proper software deployment practices when they pushed their update to the channel. Where was their QA? They know how many of their customers have auto-updates enabled (every one of them). I once worked in an online cloud environment, and the security team had crowdstrike installed everywhere, with the expressed promise that in production it would always be in monitor mode only. Well, suddenly our monitoring pods began to get SIGKILL'ed before they even could init and it took days of investigation. Root cause? infosec turned on enforcement in crowdstrike, and didn't tell anyone. We didn't have access to their splunk logs, nothing got logged locally, and naturally nobody on my side of the org even knew crowdstrike was running because we had to fight to get SSH access to the k8s nodes. But sure, blame the IT manager who is now desperately trying to bring up their entire AD infra. That's helpful.
        ensignavenger 2y ago
        "IT managers" is an awfully big umbrella term. It can refer to anyone making decisions like this. The CIO, the CSO, the CFO (if over IT as in a lot of organizations) and even the CEO. Responsibility may also extend to other mid and senior level managers within the chain of decision making who didn't speak up, to a lesser extent. In my last company I was an individual contributor, and if some one proposed placing an autoupdating, closed source kernel changing program in my critical path, you can bet I would have loudly spoken out against it.
        vb-8448 2y ago
        You don't like the term "IT managers"? Let's call them "company managers", suits better? You as a company allowed and external entity to push a completely uncontrolled update on all your production envs. What if crowdstrike had been hackered and instead of a BSOD you get a cryptolocker? If you don't realize how crazy is this, then I having nothing to add.
deleted 2y ago
[deleted]

mingus88 2y ago

Blaming IT managers is akin to blaming a bus driver when the bridge collapses. IT managers are required to implement AV for compliance. They'd lose their jobs if they refused to do it and either failed an audit or got hit by common malware. It's ironic to see so much praise this morning for the macOS model for kernel extensions. The fact of the matter is Microsoft allows 3rd party code to do exactly what happened today, and the industry leader in endpoint security completely failed to QA their updates.

vb-8448 2y ago
IT managers allowed an external entity to do a massive update on all their devices and servers. I'm not saying to don't install AV or not update it, just first update system-test envs and then roll out patches gradually, not all together.
- mingus88 2y ago
  Bus drivers allowed themselves to be assigned routes over bridges that were not engineered or built well enough. It's ridiculous to put the blame on IT managers for this. The fact that Microsoft Azure itself has been affected by this shows that this is not a problem that any middle manager at a small firm should have be held responsible for.
  - vb-8448 2y ago
    Are you serious? If I push a code change in production before going through the test environment and this cause trouble, I'll be fired. We already have rules and procedures that work for "normal" software, why they cannot be applied to AV software?
    - mingus88 2y ago
      It's obvious that you have never served in corporate IT management, so this is a pointless conversation. I'll just leave this here for anyone else who may be interested. In many/most orgs, the windows sysadmins and IT management will not have access to the crowdstrike console. The CISO and security teams are completely separate, and operate independently. They will always push for the business need to deploy policy updates at any time, as the threat landscape will not wait for the next patch cycle. And actually, this has been the right call and has objectively prevented compromise many times over. You were so close to getting this right, too. It's crowdstrike that didn't follow proper software deployment practices when they pushed their update to the channel. Where was their QA? They know how many of their customers have auto-updates enabled (every one of them). I once worked in an online cloud environment, and the security team had crowdstrike installed everywhere, with the expressed promise that in production it would always be in monitor mode only. Well, suddenly our monitoring pods began to get SIGKILL'ed before they even could init and it took days of investigation. Root cause? infosec turned on enforcement in crowdstrike, and didn't tell anyone. We didn't have access to their splunk logs, nothing got logged locally, and naturally nobody on my side of the org even knew crowdstrike was running because we had to fight to get SSH access to the k8s nodes. But sure, blame the IT manager who is now desperately trying to bring up their entire AD infra. That's helpful.
      - ensignavenger 2y ago
        "IT managers" is an awfully big umbrella term. It can refer to anyone making decisions like this. The CIO, the CSO, the CFO (if over IT as in a lot of organizations) and even the CEO. Responsibility may also extend to other mid and senior level managers within the chain of decision making who didn't speak up, to a lesser extent. In my last company I was an individual contributor, and if some one proposed placing an autoupdating, closed source kernel changing program in my critical path, you can bet I would have loudly spoken out against it.
      - vb-8448 2y ago
        You don't like the term "IT managers"? Let's call them "company managers", suits better? You as a company allowed and external entity to push a completely uncontrolled update on all your production envs. What if crowdstrike had been hackered and instead of a BSOD you get a cryptolocker? If you don't realize how crazy is this, then I having nothing to add.

deleted 2y ago

[deleted]