7 ms·
The correct lesson is to stop introducing more vulns into your systems by running "security" products. Crowdstrike was just an outage but could have just has ea
by jpgvm 2y ago
The correct lesson is to stop introducing more vulns into your systems by running "security" products. Crowdstrike was just an outage but could have just has easily been Solarwinds 2.0.
Crowdstrike is probably less bad than the alternatives that I have run into that are largely developed by very low cost engineers cough TrendMicro cough but even so, they aren't NT kernel engineers nor do they have the NT kernel release process.
Companies need to find ways to live without this crap or this will keep happening and it will be a lot worse one day. Self-compromising your own systems with RATs/MDMs/EDR/XDR/whatever other acronym soup needed to please the satanic CISSPs are just terrible ideas in general.
- ravenstine 2y agoThe difference between a vulnerability and a bug is slim. This is why I don't immediately install every single software update; official code is more likely to cut me off from my livelihood than an actual exploit taking place.
- patrakov 2y agoI think that Russians are now in a unique position, having learned this lesson almost universally due to sanctions. Any foreign vendor of self-updating software can, in theory, be ordered to kill your system remotely or to deliberately introduce a backdoor. P.S. I do realize that the same applies to domestic products, especially to the ones mandatory to install, like Russian software that is required to be present on new smartphones sold in Russia. But my point is about people learning a lesson.
- M95D 2y agoYou completely missed the point in the article. The correct lesson is to not use what everybody else uses. That way it won't fail the same way, at the same time.
- Semaphor 2y agoFrom many of the comments I read, the reason is often regulation.
- r0ks0n 2y agoguess who's lobbying for that regulation
- fuzzfactor 2y agoMisguided regulations are more common than not, that's the real damaging kind. Probably more likely with tech when regulators are more tech-illiterate than the situation requires. All kinds of other regulations can be misguided for other reasons too, lobbyists' jobs are primarily there to do the misguiding.
- deleted 2y ago[deleted]
- jpgvm 2y agoThe regulation doesn't mandate these systems. The regulation requires controls, there are usually lots of ways of implementing those controls. However more often than not the people buying these piles of goop are more interested in the cheapest/fastest/neatest way of satisfying those controls, actual security be damned. So when vendor comes a long and says "our product meets those controls! all you need to do is tell the auditor you use product $X and you are done!" well that is an awfully compelling argument when those are your priorities. Of course every security minded person dies a little inside but that is just how the world works for now, no-one has been sufficiently punished for these bad decisions yet but it will happen. Not a question of if, just when. The lobbying does matter though as they lobby for increasingly useless controls that are harder and harder to satisfy with actual security (read least privilege design, capabilities, sandboxing, etc) and audit logging and become increasingly about "how big is your ruleset in your SIEM or equivalent and does it contain a specific rule that we can show auditor for control $Y" (yay Splunk/SumoLogic lobbyists) etc. Not to mention stuff like pushing for TLS MITM boxes (self-compromising all your outgoing encrypted sessions is beyond insane) etc. The modern "security" industry is an embarrassment sigh.
- ykonstant 2y agoI am very interested in alternative ways of implementing controls to satisfy regulations; especially in ways that reduce, rather than increase, attack surface. I'd love if you could elaborate here, but links to documentation/technical articles are also welcome!
- aiisjustanif 2y agoThis completely ignores security incident response entirely. I don’t think removing the tools that slow or prevent a hack is the answer. I think it is unfair to call it crap if you have not dealt with security incidents. Of all the lessons that could be learned from this, I think this not the best one. We don’t call for everyone to go back to having their own datacenter because AWS had a massive outage.
- jjk166 2y agoIf you run a hospital and find yourself unable to treat patients during an AWS outage, that should probably be a wake up call.
- groestl 2y ago> We don’t call for everyone to go back to having their own datacenter because AWS had a massive outage. We don't? Okay, well, probably not everyone.
- soraminazuki 2y ago> I don’t think removing the tools that slow or prevent a hack is the answer. No one ever said that. It's about removing tools that introduce a huge security risk for abysmal gain. Antiviruses are there for compliance and are detrimental to actual security as explained by GP.
- Khaine 2y agoCrowdStrike isn't just an anti-virus/malware solution. It also provides observability into the running processes. It integrates into threat intelligence so you can take hashes of known bad processes and see if it exists across your fleet of devices. It can isolate devices from a network and only allow the SOC access to investigate.
- waihtis 2y agoWhat a ridiculous take. I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of time and see how long it'll take for someone to brick their entire infrastrucure with ransomware. We live in an immensely networked world built on top of swiss cheese infrastructure (even the latest Windows is riddled with points of attack surface), unless you plan rehaul the underlying infrastructure it's simply not an option to run large scale infra without a protective layer on top.
- knallfrosch 2y agoSpaceX (private) and Tesla (#40) dropped CrowdStrike.
- waihtis 2y agoI immensely doubt that actually happened (saw the Musk tweet) - from working with some companies of similar size, EDR rehauls are multi-month projects. Yes they mightve dumped them as a vendor but I'm 100% certain they're not going without an EDR throughout this time. If they are it'll be a fantastic litmus test of my claim.
- abhinavk 2y agoThey probably bought another similar solution like S1 or Defender. I don’t think they are running without a security solution which was this thread’s discussion point.
- ykonstant 2y agoDo we have available statistics as to how many actual attacks are thwarted by Crowdstrike or similar products (and not by other mitigation strategies -- i.e. all mitigations failed, CS succeeded)?
- FreakLegion 2y agoFor some definition of "other mitigation strategies", yes. The differences between CrowdStrike's EDR and any of the other top 5-10 products in its category are negligible, for example. But having strong GPO controls and a firewall and an email gateway doesn't absolve you of the need for something on endpoints. "Malware can hide, but it must run", as the old SANS saying goes, and the endpoint is where that happens.
- NikkiA 2y agoCrowdstrike probably will be solarwinds 2.0, because last week demonstrated to certain nation states just how lucrative a vector it can be for them.
- xeonmc 2y agoHow likely do you think the next big one would be caused by mandatory bootkit anticheats?