3 ms·

> I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of time and see how long it

> I'd love to see any one of the 70 Fortune 100 companies that are Crowdstrike customers turn off Crowdstrike for an extended period of time and see how long it'll take for someone to brick their entire infrastrucure with ransomware. I've got two objections to this conventional wisdom: 1) Endpoint protection in particular isn't essential to good infrastructure. It's only a bandaid over bad infrastructure. Perhaps a moot point, given that bad infrastructure is prevalent, but I digress. 2) Every IT director asserting this should be challenged to prove it. Prove that you stopped credible threats equal to X dollars of damage or lost revenue compared to the Y dollars of actual lost revenue due to production outages. And I'm not talking about the inflated threat totals that such systems produce to justify their existance, but actual threats that absent CrowdStrike would have penetrated other defenses. Until this can be done, it's simply a hypothetical vs the actual damages inflicted by the outage.

ab5tract 2y ago
For your second point: That line of reasoning has traditionally resulted in underfunding of security. It’s also quite impossible in practice. Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You can make educated guesses in both cases, but they are still strictly in the realm of the hypothetical.
- jollyllama 2y ago
  >For your second point: That line of reasoning has traditionally resulted in underfunding of security. Underfunding relative to what? Another example I'd cite would be the TSA. How much do we pay it now vs how much would we lose based on what they've truly stopped? >Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You could estimate at an order of magnitude based on the level of access of the user and a model of your infrastructure. For example, if only one machine is compromised, you could estimate order of magnitude based on the value of the data lost, the floor being set at the days of work lost * hourly rate of the user.
  - watwut 2y ago
    Underfunding in the sense that extremely preventable real world hacks and breaches happened, with loss of customer private data. And underfunding because those companies had documented IT asking to be allowed to do exactly things that would prevent the attack. If you want proof that real world attack would be stopped by measure, then you will leave the system vulnerable to everything your internal people were not able to exploit.

ab5tract 2y ago

For your second point: That line of reasoning has traditionally resulted in underfunding of security. It’s also quite impossible in practice. Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You can make educated guesses in both cases, but they are still strictly in the realm of the hypothetical.

jollyllama 2y ago
>For your second point: That line of reasoning has traditionally resulted in underfunding of security. Underfunding relative to what? Another example I'd cite would be the TSA. How much do we pay it now vs how much would we lose based on what they've truly stopped? >Say that you know for a fact that CrowdStrike prevented a ransomware attack. How can you accurately assess the money saved by prevention if you don’t know what the ransom would have been set at? How can you accurately assess the value of the data loss from not paying the ransom? You could estimate at an order of magnitude based on the level of access of the user and a model of your infrastructure. For example, if only one machine is compromised, you could estimate order of magnitude based on the value of the data lost, the floor being set at the days of work lost * hourly rate of the user.
- watwut 2y ago
  Underfunding in the sense that extremely preventable real world hacks and breaches happened, with loss of customer private data. And underfunding because those companies had documented IT asking to be allowed to do exactly things that would prevent the attack. If you want proof that real world attack would be stopped by measure, then you will leave the system vulnerable to everything your internal people were not able to exploit.