3 ms·

> The hospitals, airlines, police, etc. that bought into CrowdStrike should have primary responsibility This is ridiculous. None of these business can (or sho

by smt88 2y ago

> The hospitals, airlines, police, etc. that bought into CrowdStrike should have primary responsibility This is ridiculous. None of these business can (or should) handle all of their infosec internally. They must use vendors. And because they don't have infosec expertise, they have no way to verify that a vendor has good quality control. You're essentially arguing that a hospital should also be responsible if people die because they bought the wrong MRI machine brand or one of their trucking suppliers had a crash and couldn't bring them enough of a certain drug. There is no universe where vendors shouldn't be responsible for failing to deliver a safety-critical service that they 100% guaranteed they could deliver. There was nothing in the CrowdStrike contract that said, "Updates may inadvertently disable all systems that receive them," because that would mean no one should ever use it.

prepend 2y ago
Hospitals shouldn’t use vendors like this. They need to be able to audit and understand what they’re doing and not allow. Hospitals have CIOs and CMIOs and CHIOs to make these kinds of decisions.
- guenthert 2y ago
  Computer security is clearly not the core competency of hospitals, nor should it need to be. I'd argue, putting Internet connected systems running MS Windows in the critical path was already setting them up for failure.
  - figassis 2y ago
    I would say every company of a certain size or criticality should have a proper IT team. It does not even need to be large, but they need to have the expertise and authority to veto certain decisions. I often see vendor deals being made solely for the discount and other marketing crap, like getting another piece of service free as a bonus. IT then gets silenced because number goes up. I have seen situations where leaderhsip keeps asking IT/Engineering the same question "But why can't we just do this?" in different ways and dissecting the answers, asking for reports, and proof, and what not, so that IT is forced to make a bulletproof case against it. It then appears that IT has a personal thing against the vendor. So IT gives up. System is up. Often, part of the problem is the vendor buying lunch to key decision makers and being pals.
- smt88 2y ago
  So what should have told those CIOs not to use Crowdstrike? Who should they have used instead?

by smt88 2y ago

prepend 2y ago

Hospitals shouldn’t use vendors like this. They need to be able to audit and understand what they’re doing and not allow. Hospitals have CIOs and CMIOs and CHIOs to make these kinds of decisions.

guenthert 2y ago
Computer security is clearly not the core competency of hospitals, nor should it need to be. I'd argue, putting Internet connected systems running MS Windows in the critical path was already setting them up for failure.
- figassis 2y ago
  I would say every company of a certain size or criticality should have a proper IT team. It does not even need to be large, but they need to have the expertise and authority to veto certain decisions. I often see vendor deals being made solely for the discount and other marketing crap, like getting another piece of service free as a bonus. IT then gets silenced because number goes up. I have seen situations where leaderhsip keeps asking IT/Engineering the same question "But why can't we just do this?" in different ways and dissecting the answers, asking for reports, and proof, and what not, so that IT is forced to make a bulletproof case against it. It then appears that IT has a personal thing against the vendor. So IT gives up. System is up. Often, part of the problem is the vendor buying lunch to key decision makers and being pals.
smt88 2y ago
So what should have told those CIOs not to use Crowdstrike? Who should they have used instead?