6 ms·

What a ridiculous take. I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of ti

What a ridiculous take. I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of time and see how long it'll take for someone to brick their entire infrastrucure with ransomware. We live in an immensely networked world built on top of swiss cheese infrastructure (even the latest Windows is riddled with points of attack surface), unless you plan rehaul the underlying infrastructure it's simply not an option to run large scale infra without a protective layer on top.

knallfrosch 2y ago
SpaceX (private) and Tesla (#40) dropped CrowdStrike.
- waihtis 2y ago
  I immensely doubt that actually happened (saw the Musk tweet) - from working with some companies of similar size, EDR rehauls are multi-month projects. Yes they mightve dumped them as a vendor but I'm 100% certain they're not going without an EDR throughout this time. If they are it'll be a fantastic litmus test of my claim.
- abhinavk 2y ago
  They probably bought another similar solution like S1 or Defender. I don’t think they are running without a security solution which was this thread’s discussion point.
ykonstant 2y ago
Do we have available statistics as to how many actual attacks are thwarted by Crowdstrike or similar products (and not by other mitigation strategies -- i.e. all mitigations failed, CS succeeded)?
- FreakLegion 2y ago
  For some definition of "other mitigation strategies", yes. The differences between CrowdStrike's EDR and any of the other top 5-10 products in its category are negligible, for example. But having strong GPO controls and a firewall and an email gateway doesn't absolve you of the need for something on endpoints. "Malware can hide, but it must run", as the old SANS saying goes, and the endpoint is where that happens.
  - sudosysgen 2y ago
    This is an outdated philosophy that should have died long ago, and CrowdStrike's marketing itself agrees. The solution is to have zero-trust endpoints. That's what CrowdStrike claims to be doing, and that's also what it can't do. Having true zero trust endpoints absolves you of the need for something, anything, on the endpoints. It's not even as disruptive as it seems to implement.
    - 0xBDB 2y ago
      Even if, say, banks and insurance companies could move a couple of hundred thousand Windows endpoints to fully functional zero trust tomorrow, they'd still need something on the endpoint, if only for log aggregation and detection. It is certainly awesome if the bad guys can't move laterally but you still want to know they're there.
      - sudosysgen 2y ago
        If you want to harden the endpoints that's fine. But it's not worth doing that if it means that you now have to trust your endpoints. If the choice is between a zero trust architecture or detection, you should take zero trust every time. That said, you don't need to trust the endpoint to harden it. Why does my log aggregation and monitoring tool need to be a kernel driver? Why can't I just use Windows Defender and a network scanner for detection, and netboot the endpoints to make bootkits useless? That would provide just as much in the way of detection, and more in the way of protection, and I still don't need to trust my endpoint, nor any third party. From a security perspective what you're describing is a nice-to-have, and to get it you'd decuple your attack surface by adding a networked, unfirewallable, impossible to remove rootkit-shaped target for every hacker in the world to instantly own your entire network. Banks and insurance companies already have a lot of endpoints with no kernel level EDR, those are their Android and iOS devices. It works just fine and has for a long time.
WorldMaker 2y ago
Windows has Defender built in and most of those companies are presumably already using an SCCM like Software Center. If they upgrade from ancient versions of Software Center (because let's be honest if they are using CrowdStrike they are probably behind the times) to more recent versions of Intune it includes most of the exact same "fleet configuration" and "fleet anti-virus" tools (including ransomware prevention/quarantine) that CrowdStrike ever provided, only this time with stuff the Fortune 100 companies are likely already paying Microsoft for. They are trading one vendor for another, but the new vendor actually owns the Operating System and has a lot more reasons not to break it with bad update deployments. It's not like Microsoft has spent the last few decades entirely ignoring these large scale infrastructure needs, they've just been competing with these bloatware vendors like CrowdStrike with significant marketing arms and incredible sunk cost inertia. (Given most of these companies already pay for things like Intune, it's a weirdly doubled sunk cost inertia, but still a sunk cost inertia.)
- xqt40 2y ago
  What does any of SCCM and Intune has to do with Crowdstrike? Intune is already outdated btw.
  - WorldMaker 2y ago
    CrowdStrike included some basic SCCM/fleet management "compliance checkboxes". That is one of the reasons companies were paying for CrowdStrike is "fleet management" of AV. > Intune is already outdated btw. I do know that part of Microsoft loves to change brand names every quarter for fun and the "parent" organization has changed a few times from different parts of Office and Windows Server to now "Microsoft 365", but as far as I can tell (and I don't keep up with it) Intune is still the active brand name: https://en.wikipedia.org/wiki/Microsoft_Intune https://en.wikipedia.org/wiki/Microsoft_Intune It's because of the merger into Microsoft 365 that I feel confident that most big Enterprises are already paying for Intune even if they aren't using the most up-to-date version and don't know what compliance "checkboxes" it solves versus something like CrowdStrike.
- 0xBDB 2y ago
whalesalad 2y ago
Maybe stop running critical infra on top of Windows? lol. Microsoft is claiming they have zero culpability here but they created this ecosystem and Crowdstrike is just playing around in it. Ancient IT mindset says "me need domain controller. me buy win server." but it does not need to be like this.
- stackskipton 2y ago
  Most companies have 3rd party software they buy which is critical to their and most of that software was designed to run on Windows. Since people are locked into this software, the vendors of said software have little incentive to switch off Windows Server. Exchange Server is prime example of this if everyone hadn't switch to 365. This is the state of modern Enterprises.
jollyllama 2y ago
> I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of time and see how long it'll take for someone to brick their entire infrastrucure with ransomware. I've got two objections to this conventional wisdom: 1) Endpoint protection in particular isn't essential to good infrastructure. It's only a bandaid over bad infrastructure. Perhaps a moot point, given that bad infrastructure is prevalent, but I digress. 2) Every IT director asserting this should be challenged to prove it. Prove that you stopped credible threats equal to X dollars of damage or lost revenue compared to the Y dollars of actual lost revenue due to production outages. And I'm not talking about the inflated threat totals that such systems produce to justify their existance, but actual threats that absent CrowdStrike would have penetrated other defenses. Until this can be done, it's simply a hypothetical vs the actual damages inflicted by the outage.
- ab5tract 2y ago
  For your second point: That line of reasoning has traditionally resulted in underfunding of security. It’s also quite impossible in practice. Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You can make educated guesses in both cases, but they are still strictly in the realm of the hypothetical.
  - jollyllama 2y ago
    >For your second point: That line of reasoning has traditionally resulted in underfunding of security. Underfunding relative to what? Another example I'd cite would be the TSA. How much do we pay it now vs how much would we lose based on what they've truly stopped? >Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You could estimate at an order of magnitude based on the level of access of the user and a model of your infrastructure. For example, if only one machine is compromised, you could estimate order of magnitude based on the value of the data lost, the floor being set at the days of work lost * hourly rate of the user.
0xBDB 2y ago
Agree, but in addition, the situation that created this problem will soon be resolved when eBPF for Windows goes to prod. It won't be possible to bluescreen a Windows box just because EDR has a bad update. The situation(s) that make EDR valuable, however, are not going away. Not just for prevention, but for detection and threat hunt, EDR in general and CrowdStrike in particular have pretty much eaten the market that was once shared by network detection, etc.
- waihtis 2y ago
  EBPF is a good direction although I'm not sure what the maturity of the Windows fork is right now, and how many kernel apis are enabled in it - i.e. how far away are we from having enough capability to run an EDR in it

knallfrosch 2y ago

SpaceX (private) and Tesla (#40) dropped CrowdStrike.

waihtis 2y ago
I immensely doubt that actually happened (saw the Musk tweet) - from working with some companies of similar size, EDR rehauls are multi-month projects. Yes they mightve dumped them as a vendor but I'm 100% certain they're not going without an EDR throughout this time. If they are it'll be a fantastic litmus test of my claim.
abhinavk 2y ago
They probably bought another similar solution like S1 or Defender. I don’t think they are running without a security solution which was this thread’s discussion point.

ykonstant 2y ago

Do we have available statistics as to how many actual attacks are thwarted by Crowdstrike or similar products (and not by other mitigation strategies -- i.e. all mitigations failed, CS succeeded)?

FreakLegion 2y ago
For some definition of "other mitigation strategies", yes. The differences between CrowdStrike's EDR and any of the other top 5-10 products in its category are negligible, for example. But having strong GPO controls and a firewall and an email gateway doesn't absolve you of the need for something on endpoints. "Malware can hide, but it must run", as the old SANS saying goes, and the endpoint is where that happens.
- sudosysgen 2y ago
  This is an outdated philosophy that should have died long ago, and CrowdStrike's marketing itself agrees. The solution is to have zero-trust endpoints. That's what CrowdStrike claims to be doing, and that's also what it can't do. Having true zero trust endpoints absolves you of the need for something, anything, on the endpoints. It's not even as disruptive as it seems to implement.
  - 0xBDB 2y ago
    Even if, say, banks and insurance companies could move a couple of hundred thousand Windows endpoints to fully functional zero trust tomorrow, they'd still need something on the endpoint, if only for log aggregation and detection. It is certainly awesome if the bad guys can't move laterally but you still want to know they're there.
    - sudosysgen 2y ago
      If you want to harden the endpoints that's fine. But it's not worth doing that if it means that you now have to trust your endpoints. If the choice is between a zero trust architecture or detection, you should take zero trust every time. That said, you don't need to trust the endpoint to harden it. Why does my log aggregation and monitoring tool need to be a kernel driver? Why can't I just use Windows Defender and a network scanner for detection, and netboot the endpoints to make bootkits useless? That would provide just as much in the way of detection, and more in the way of protection, and I still don't need to trust my endpoint, nor any third party. From a security perspective what you're describing is a nice-to-have, and to get it you'd decuple your attack surface by adding a networked, unfirewallable, impossible to remove rootkit-shaped target for every hacker in the world to instantly own your entire network. Banks and insurance companies already have a lot of endpoints with no kernel level EDR, those are their Android and iOS devices. It works just fine and has for a long time.

WorldMaker 2y ago

Windows has Defender built in and most of those companies are presumably already using an SCCM like Software Center. If they upgrade from ancient versions of Software Center (because let's be honest if they are using CrowdStrike they are probably behind the times) to more recent versions of Intune it includes most of the exact same "fleet configuration" and "fleet anti-virus" tools (including ransomware prevention/quarantine) that CrowdStrike ever provided, only this time with stuff the Fortune 100 companies are likely already paying Microsoft for. They are trading one vendor for another, but the new vendor actually owns the Operating System and has a lot more reasons not to break it with bad update deployments. It's not like Microsoft has spent the last few decades entirely ignoring these large scale infrastructure needs, they've just been competing with these bloatware vendors like CrowdStrike with significant marketing arms and incredible sunk cost inertia. (Given most of these companies already pay for things like Intune, it's a weirdly doubled sunk cost inertia, but still a sunk cost inertia.)

xqt40 2y ago
What does any of SCCM and Intune has to do with Crowdstrike? Intune is already outdated btw.
- WorldMaker 2y ago
  CrowdStrike included some basic SCCM/fleet management "compliance checkboxes". That is one of the reasons companies were paying for CrowdStrike is "fleet management" of AV. > Intune is already outdated btw. I do know that part of Microsoft loves to change brand names every quarter for fun and the "parent" organization has changed a few times from different parts of Office and Windows Server to now "Microsoft 365", but as far as I can tell (and I don't keep up with it) Intune is still the active brand name: https://en.wikipedia.org/wiki/Microsoft_Intune https://en.wikipedia.org/wiki/Microsoft_Intune It's because of the merger into Microsoft 365 that I feel confident that most big Enterprises are already paying for Intune even if they aren't using the most up-to-date version and don't know what compliance "checkboxes" it solves versus something like CrowdStrike.
0xBDB 2y ago

whalesalad 2y ago

Maybe stop running critical infra on top of Windows? lol. Microsoft is claiming they have zero culpability here but they created this ecosystem and Crowdstrike is just playing around in it. Ancient IT mindset says "me need domain controller. me buy win server." but it does not need to be like this.

stackskipton 2y ago
Most companies have 3rd party software they buy which is critical to their and most of that software was designed to run on Windows. Since people are locked into this software, the vendors of said software have little incentive to switch off Windows Server. Exchange Server is prime example of this if everyone hadn't switch to 365. This is the state of modern Enterprises.

jollyllama 2y ago

> I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of time and see how long it'll take for someone to brick their entire infrastrucure with ransomware. I've got two objections to this conventional wisdom: 1) Endpoint protection in particular isn't essential to good infrastructure. It's only a bandaid over bad infrastructure. Perhaps a moot point, given that bad infrastructure is prevalent, but I digress. 2) Every IT director asserting this should be challenged to prove it. Prove that you stopped credible threats equal to X dollars of damage or lost revenue compared to the Y dollars of actual lost revenue due to production outages. And I'm not talking about the inflated threat totals that such systems produce to justify their existance, but actual threats that absent CrowdStrike would have penetrated other defenses. Until this can be done, it's simply a hypothetical vs the actual damages inflicted by the outage.

ab5tract 2y ago
For your second point: That line of reasoning has traditionally resulted in underfunding of security. It’s also quite impossible in practice. Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You can make educated guesses in both cases, but they are still strictly in the realm of the hypothetical.
- jollyllama 2y ago
  >For your second point: That line of reasoning has traditionally resulted in underfunding of security. Underfunding relative to what? Another example I'd cite would be the TSA. How much do we pay it now vs how much would we lose based on what they've truly stopped? >Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You could estimate at an order of magnitude based on the level of access of the user and a model of your infrastructure. For example, if only one machine is compromised, you could estimate order of magnitude based on the value of the data lost, the floor being set at the days of work lost * hourly rate of the user.

0xBDB 2y ago

Agree, but in addition, the situation that created this problem will soon be resolved when eBPF for Windows goes to prod. It won't be possible to bluescreen a Windows box just because EDR has a bad update. The situation(s) that make EDR valuable, however, are not going away. Not just for prevention, but for detection and threat hunt, EDR in general and CrowdStrike in particular have pretty much eaten the market that was once shared by network detection, etc.

waihtis 2y ago
EBPF is a good direction although I'm not sure what the maturity of the Windows fork is right now, and how many kernel apis are enabled in it - i.e. how far away are we from having enough capability to run an EDR in it