5 ms·

Here's an interesting question that I haven't seen anyone really engage with yet: If the nigh monoculture of CrowdStrike didn't exist, and malicious behavior p

by Bjartr 2y ago

Here's an interesting question that I haven't seen anyone really engage with yet: If the nigh monoculture of CrowdStrike didn't exist, and malicious behavior protection wasn't as consistent as a result, would the aggregate harm of multiple smaller bad events occurring over years be above or below the one-shot harm of CrowdStrike's screwup? Maybe the answer is obvious if you have more context than I do, but to me it doesn't seem so obvious it can be taken for granted one way or the other.

techostritch 2y ago
It is an interesting question. I think most people have an intuitive belief/understanding that say AWS is more resilient than home grown services but it’s very high profile when AWS goes down. That being said it is probably better for say 1 hospital in a city to go down every month rather than all 10 hospitals in a city to go down at the same time once a year.
transpute 2y ago
> would the aggregate harm of multiple smaller bad events occurring over years be above or below the one-shot harm of CrowdStrike's screwup? See US federal and state separation of powers as a laboratory for policy. The harm is only "aggregate" if nothing is learned from each event. If lessons are rapidly learned and diffused from each event, then multiple smaller events can reduce local blast radius, immunize others against known failure categories, and increase global resilience.
- tedunangst 2y ago
  The only lesson ever learned from small events is "that would never happen here". Until it does.
  - transpute 2y ago
    Maybe smaller events can be tracked with an incident ID and analysis to forestall bigger events. https://news.ycombinator.com/item?id=41018029 https://news.ycombinator.com/item?id=41018029
gruez 2y ago
>If the nigh monoculture of CrowdStrike didn't exist What "monoculture"? They're allegedly the #1 provider in the EDR space and they only control 17.7% of the market. https://www.crowdstrike.com/resources/reports/idc-worldwide-modern-endpoint-security-market-share-report/ https://www.crowdstrike.com/resources/reports/idc-worldwide-...
- pxc 2y ago
  Not speaking for GP or the way they meant to use the language, but a monoculture doesn't have to be a monopoly. It just has to be the only crop you grow on a given field, or in this case, the only EDR tool in use at a given company. The fact that this took out whole clusters at some companies, or nearly all DCs at some companies, is part of what made it so hard to recover from for companies hit by it. That is the metaphorical 'monoculture', not CrowdStrike's market position.
belter 2y ago
The answer is clear, as many companies don't run CrowdStrike :-)
zifpanachr23 2y ago
Good question. Its difficult to answer because without EDR solutions, I think there would probably be more motivation to make it such that the compromise of a single endpoint couldn't ransomware your whole company. Aka real "zero trust" architecture rather than the buzzword. But I've heard the other side of the story from sysadmins that say this is wishful thinking and that it would take enormous amounts of effort to achieve that. I think if you are a small company or a new company with a disproportionate amount of technically skilled employees and without a lot of legacy active directory and shared drive stuff going on, it's probably a net positive not to have an EDR and to properly secure everything instead. That isn't most companies though. So I guess my answer to your question is "I don't know" and sysadmins seem to be in major disagreement about this, with Windows focused admins tending to be more favorable to EDR (for easily explainable reasons) and Linux folks being especially opposed. Given Linux admins tend to have less interaction with the lowest common denominator end user, I'm actually tending towards believing the Windows admins have a point that a lot of us on HackerNews maybe don't have the experience to understand. I realize your question was about Crowdstrike in particular, but I think it's a question that might apply to EDR software in general.

by Bjartr 2y ago

techostritch 2y ago

It is an interesting question. I think most people have an intuitive belief/understanding that say AWS is more resilient than home grown services but it’s very high profile when AWS goes down. That being said it is probably better for say 1 hospital in a city to go down every month rather than all 10 hospitals in a city to go down at the same time once a year.

transpute 2y ago

> would the aggregate harm of multiple smaller bad events occurring over years be above or below the one-shot harm of CrowdStrike's screwup? See US federal and state separation of powers as a laboratory for policy. The harm is only "aggregate" if nothing is learned from each event. If lessons are rapidly learned and diffused from each event, then multiple smaller events can reduce local blast radius, immunize others against known failure categories, and increase global resilience.

tedunangst 2y ago
The only lesson ever learned from small events is "that would never happen here". Until it does.
- transpute 2y ago
  Maybe smaller events can be tracked with an incident ID and analysis to forestall bigger events. https://news.ycombinator.com/item?id=41018029 https://news.ycombinator.com/item?id=41018029

gruez 2y ago

>If the nigh monoculture of CrowdStrike didn't exist What "monoculture"? They're allegedly the #1 provider in the EDR space and they only control 17.7% of the market. https://www.crowdstrike.com/resources/reports/idc-worldwide-modern-endpoint-security-market-share-report/ https://www.crowdstrike.com/resources/reports/idc-worldwide-...

pxc 2y ago
Not speaking for GP or the way they meant to use the language, but a monoculture doesn't have to be a monopoly. It just has to be the only crop you grow on a given field, or in this case, the only EDR tool in use at a given company. The fact that this took out whole clusters at some companies, or nearly all DCs at some companies, is part of what made it so hard to recover from for companies hit by it. That is the metaphorical 'monoculture', not CrowdStrike's market position.

belter 2y ago

The answer is clear, as many companies don't run CrowdStrike :-)

zifpanachr23 2y ago

Good question. Its difficult to answer because without EDR solutions, I think there would probably be more motivation to make it such that the compromise of a single endpoint couldn't ransomware your whole company. Aka real "zero trust" architecture rather than the buzzword. But I've heard the other side of the story from sysadmins that say this is wishful thinking and that it would take enormous amounts of effort to achieve that. I think if you are a small company or a new company with a disproportionate amount of technically skilled employees and without a lot of legacy active directory and shared drive stuff going on, it's probably a net positive not to have an EDR and to properly secure everything instead. That isn't most companies though. So I guess my answer to your question is "I don't know" and sysadmins seem to be in major disagreement about this, with Windows focused admins tending to be more favorable to EDR (for easily explainable reasons) and Linux folks being especially opposed. Given Linux admins tend to have less interaction with the lowest common denominator end user, I'm actually tending towards believing the Windows admins have a point that a lot of us on HackerNews maybe don't have the experience to understand. I realize your question was about Crowdstrike in particular, but I think it's a question that might apply to EDR software in general.