3 ms·
Well kernel agents and drivers are not uncommon, however anyone doing anything at scale where there is anything touching a kernel is typically well understood i
by neom 2y ago
Well kernel agents and drivers are not uncommon, however anyone doing anything at scale where there is anything touching a kernel is typically well understood in the system you're implementing it on. That aside, I gather from skimming around (so might be wrong here) - seems people were specifically implementing this because of a business case not a technical case, I read it's mostly used to create compliance (I think via shifted liability) - so I think it was probably too easy to happen and so it happened - in that - someone in the bizniz dept said "if we run this software we are compliant with whatever, enabling XYZ multiple of new revenue, clear business case!!!" and the tech people probably went "bizniz people want this, bizniz case is clear, this seems like a relatively advanced business who know what they're doing, it doesn't really do much on my system and I'm mostly deploying it to innocuous edge user systems, so seems fine shrug" - and then a bad push happened and lots and lots of IT departments had had the same convo aforementioned.
Could be wrong here so if anyone knows better and can correct me...plz do!
- hello_moto 2y agoA lot of people, especially the non cybersecurity ones, are way off the mark so you're not the only one.
- lyu07282 2y ago> implementing this because of a business case not a technical case there are some certification requirements to do pentests/red teaming and then those security folk will all tell them to install an EDR so they picked crowdstrike, but the security people have a very valid technical case for that recommendation. it doesn't shift liability to crowdstrike, thats not how this works. In this specific case they are very likely liable due to gross negligence, but that is different