5 ms·

Windows updates are also cybersecurity, but the customer has (had?) a choice to how to roll those out (with Intune nowadays?). The customer should decide when t

Windows updates are also cybersecurity, but the customer has (had?) a choice to how to roll those out (with Intune nowadays?). The customer should decide when to update, they own the fleet not the vendor! You do not know if a content update will screw you over and mark all the files of your company as malware. The "It should never happen" situations are the thing you need to prepare for, the reason we talk about security as an onion, the reason we still do staggered production releases with baking times even after tests and QA have passed... "But it's cybersecurity" is not a justification. I know that security departments and IT departments and companies in general love dropping the "responsibility" part on someone else, but in the end of the day the thing getting screwed over is the company fleet. You should retain control and make sure things work properly, the fact those billion dollar revenue companies are unable to do so is a joke. A terrible one, since IT underpins everything nowadays.

chrisjj 2y ago
> The customer should decide when to update, they own the fleet not the vendor! The CS customer has decided to update whenever 24/7 CS says. The alternative is to arrive on Monday morning to an infected fleet.
- chronid 2y ago
  Sorry, this is untrue. Enterprises have SOCs and oncalls, if there is a high risk they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate) and then fleet rollout. It would have been rolled out by Friday evening in this case without crashing hundred of thousands of servers. The CS customer has decided to offload the responsibility of its fleet to CS. In my opinion that's bullshit and negligence (it doesn't mean I don't understand why they did it), particularly at the scale of some of the customers :)
  - chrisjj 2y ago
    > they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate) Incorrect, I believe, given they did not and could not get advance sight of the offending forced update.
    - Kwpolska 2y ago
      I doubt CrowdStrike had done any testing of the update.
  - chrisjj 2y ago
    > they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate) Incorrect, I believe, given they could and did not get advance sight of the offending forced update.
d1sxeyes 2y ago
It is a justification, just not necessarily one you agree with. Companies choose to work with Crowdstrike. One of the reasons they do that is ‘hands-off’ administration-let a trusted partner do it for you. There are absolutely risks of doing it this way. But there are also risks of doing it the other way. The difference is, if you hand over to Crowdstrike, you’re not on your own if something goes wrong. If you manage it yourself, you’ve only got yourself working on the problem if something goes wrong. Or worse, something goes wrong and your vendor says “yes, we knew about this issue and released the fix in the patch last Tuesday. Only 5% of your fleet took the patch? Oh. Sounds like your IT guys have got a lot of work on their hands to fix the remaining 95% then!”.

chrisjj 2y ago

> The customer should decide when to update, they own the fleet not the vendor! The CS customer has decided to update whenever 24/7 CS says. The alternative is to arrive on Monday morning to an infected fleet.

chronid 2y ago
Sorry, this is untrue. Enterprises have SOCs and oncalls, if there is a high risk they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate) and then fleet rollout. It would have been rolled out by Friday evening in this case without crashing hundred of thousands of servers. The CS customer has decided to offload the responsibility of its fleet to CS. In my opinion that's bullshit and negligence (it doesn't mean I don't understand why they did it), particularly at the scale of some of the customers :)
- chrisjj 2y ago
  > they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate) Incorrect, I believe, given they did not and could not get advance sight of the offending forced update.
  - Kwpolska 2y ago
    I doubt CrowdStrike had done any testing of the update.
- chrisjj 2y ago
  > they can do at least minimal testing (which would have found this issue as it has a 100% bsod rate) Incorrect, I believe, given they could and did not get advance sight of the offending forced update.

d1sxeyes 2y ago

It is a justification, just not necessarily one you agree with. Companies choose to work with Crowdstrike. One of the reasons they do that is ‘hands-off’ administration-let a trusted partner do it for you. There are absolutely risks of doing it this way. But there are also risks of doing it the other way. The difference is, if you hand over to Crowdstrike, you’re not on your own if something goes wrong. If you manage it yourself, you’ve only got yourself working on the problem if something goes wrong. Or worse, something goes wrong and your vendor says “yes, we knew about this issue and released the fix in the patch last Tuesday. Only 5% of your fleet took the patch? Oh. Sounds like your IT guys have got a lot of work on their hands to fix the remaining 95% then!”.