3 ms·

I just interviewed an MSP (managed service provider) to take a contact at our company. I turned them down after they told me they use CrowdStrike and SolarWinds

I just interviewed an MSP (managed service provider) to take a contact at our company. I turned them down after they told me they use CrowdStrike and SolarWinds exclusively with no other options. I laughed outright because I initially thought they were joking. The “grey beard” they brought on as their head tech assured me basically that it was OK they both suffered global breaches , that “they can’t be hacked again!”… Not surprised to see SW or N-Able or whatever change hands. Another company I manage dropped N-Able this year, they saw it coming too.

Centigonal 2y ago
I'm not disagreeing with your overall point, but I think it's important to clarify that Crowdstrike did not experience a breach -- rather, they pushed a bad software update to their global customer base, resulting in widespread chaos. The cause was an internal mistake, not a threat actor.
- nilamo 2y ago
  Right, that's much worse.
- 0xy 2y ago
  Internal mistake seems to be underplaying it. They do not follow modern SDLC practices, have no mechanism for testing, are unable to rollback effectively etc. The bad software update was a mistake made a global catastrophe due to deliberately bad practices. No tests is not a mistake, they simply did not give a damn.
- chii 2y ago
  With such an internal mistake so easily deployed, i would argue that a breach might've already happened that's a lot more sophisticated and was not detected at all.
- ThePowerOfFuet 2y ago
  That their shitty internal processes permitted such a thing to happen indicates that they _were_ the threat actor.