4 ms·

Realistically what is the alternative if you are running servers that could seriously be the target of an attack? I will give you that I highly doubt that a la

Realistically what is the alternative if you are running servers that could seriously be the target of an attack? I will give you that I highly doubt that a large number of these machines are anywhere near that critical nature, but there are some that will fall within that much risk. What do you do, just not update to handle new risks? A lot of systems going down is really bad, don't get me wrong. But is it worse that you could be breached depending on the data (and other services) those systems may have access too? To me this is a flaw in Crowdstrike but also Windows that this could happen in the first place, and a serious flaw on Crowdstrike's side that this somehow got out. And yes I do acknowledge that much of this is security theatre, but I also would not be surprised if it does sometimes work.

averageRoyalty 2y ago
To be clear, you blame CrowdStrike, Windows (??) but not the companies who picked this software, configured it and wrote their own internal risk policies around a kernel level piece of software?
- nerdjon 2y ago
  Most of the blame here falls on Crowdstrike. Both from a software standpoint that it can cause a BSOD so easily and not be able to handle something like this happening. But also whatever failure happened to let that file get out. Some, minor, blame falls on Windows due to its ability to BSOD as easily as it does. As far as the companies, it is a tricky situation. Many of the companies have Crowdstrike enabled and automatic updates turned on to check some audit box. They have to keep the updates going out regularly. We are well past the point in tech that a company is solely responsible for their systems with external dependencies being the norm. Either with the shared security model with cloud services like AWS or a reliance on external API's and servers. You have to trust the vendor you are working with for whatever critically important system is going to do their job. Could you look back and say that maybe you chose the wrong vendor for a specific piece of software, but this could have happened to other vendors. Something that I am not entirely sure of is for those audit, compliance, etc requirements can they use an alternative update method. And this is something that would be different based on each compliance, but to the best of my knowledge for security software most want you to have automatic updates. If this was the case of all of these servers going down because of a major AWS outage would you really be saying the companies are to blame?
  - belter 2y ago
    > You have to trust the vendor you are working with for whatever critically important system is going to do their job This is an absurd take, specially after an outage who took down 911 response centers, hospitals and has millions of passengers still stranded. You trust no vendor and assume everything fails all the time.
    - nerdjon 2y ago
      At some point you have too, you will never control 100% of the system between your servers and whoever or whatever will be interacting with it, and between your servers and whatever other services you have to work with. There might be smaller parts of your system you could say this, but unless your system is 100% airgapped, and all of the wiring, servers, etc are all put down by you and you are working with a LAN. There are not many systems that fall within that definition. As soon as you hit using the internet for communication you are reliant on your ISP working. Maybe you can have a redundant connection, but then you have to assume both of those will do their job and that they don't have a dependency that could bring them both down. So no, it's not absurd unless you are never going to the internet. You have to make the decisions on what your system relies on and what it can handle. I fully understand what this brought down, but again there are plenty of other instances where you assume an outside company is going to do their job. Looking back and saying, well maybe this was a bad idea because its an external dependency isn't helpful when we can point to any number of other external dependencies that may not have brought down as many systems but can just as easily bring down critical systems.
      - belter 2y ago
        I still don't see your point. I am responsible for my systems not other vendors. - You need more than one ISP - You need diverse Operating Systems and Databases - You deploy in phases with canary releases - You don't deploy on Fridays.... How difficult can it be?
        nerdjon 2y ago

averageRoyalty 2y ago

To be clear, you blame CrowdStrike, Windows (??) but not the companies who picked this software, configured it and wrote their own internal risk policies around a kernel level piece of software?

nerdjon 2y ago
Most of the blame here falls on Crowdstrike. Both from a software standpoint that it can cause a BSOD so easily and not be able to handle something like this happening. But also whatever failure happened to let that file get out. Some, minor, blame falls on Windows due to its ability to BSOD as easily as it does. As far as the companies, it is a tricky situation. Many of the companies have Crowdstrike enabled and automatic updates turned on to check some audit box. They have to keep the updates going out regularly. We are well past the point in tech that a company is solely responsible for their systems with external dependencies being the norm. Either with the shared security model with cloud services like AWS or a reliance on external API's and servers. You have to trust the vendor you are working with for whatever critically important system is going to do their job. Could you look back and say that maybe you chose the wrong vendor for a specific piece of software, but this could have happened to other vendors. Something that I am not entirely sure of is for those audit, compliance, etc requirements can they use an alternative update method. And this is something that would be different based on each compliance, but to the best of my knowledge for security software most want you to have automatic updates. If this was the case of all of these servers going down because of a major AWS outage would you really be saying the companies are to blame?
- belter 2y ago
  > You have to trust the vendor you are working with for whatever critically important system is going to do their job This is an absurd take, specially after an outage who took down 911 response centers, hospitals and has millions of passengers still stranded. You trust no vendor and assume everything fails all the time.
  - nerdjon 2y ago
    At some point you have too, you will never control 100% of the system between your servers and whoever or whatever will be interacting with it, and between your servers and whatever other services you have to work with. There might be smaller parts of your system you could say this, but unless your system is 100% airgapped, and all of the wiring, servers, etc are all put down by you and you are working with a LAN. There are not many systems that fall within that definition. As soon as you hit using the internet for communication you are reliant on your ISP working. Maybe you can have a redundant connection, but then you have to assume both of those will do their job and that they don't have a dependency that could bring them both down. So no, it's not absurd unless you are never going to the internet. You have to make the decisions on what your system relies on and what it can handle. I fully understand what this brought down, but again there are plenty of other instances where you assume an outside company is going to do their job. Looking back and saying, well maybe this was a bad idea because its an external dependency isn't helpful when we can point to any number of other external dependencies that may not have brought down as many systems but can just as easily bring down critical systems.
    - belter 2y ago
      I still don't see your point. I am responsible for my systems not other vendors. - You need more than one ISP - You need diverse Operating Systems and Databases - You deploy in phases with canary releases - You don't deploy on Fridays.... How difficult can it be?
      - nerdjon 2y ago