Hacker News new | ask | show | jobs
by averageRoyalty 706 days ago
"Immediate across the fleet" and "Entirely manual process" are not the only two options. HN rules say we must assume good faith, but there are obviously options in between, and all of them stop the issue that happened on Friday.
1 comments
mewpmewp2 706 days ago
What option would you pick if Crowdstrike found a vulnerability that could affect everyone involved?
link
averageRoyalty 706 days ago
Your argument is the 0.01% of cases should dictate the other 99.99%s actions?

I would pick automated testing and spread fleet deploys. There's no reason in any enterprise this should take more than 1-2 hours, which is a perfectly acceptable window of risk.

link
mewpmewp2 706 days ago
I'm not fully sure what you mean by 0.01% cases? Where did you get those percentages?

Businesses are under a constant barrage of cyber attacks, with goals to steal the data, encrypt it and then blackmail or sell all the data. Ransomware payouts exceeded $1 bil last year. And that doesn't include all the damage done besides the payouts.

Edit: Supposedly global cost of cybercrime is expected to reach $20 trillion+ by 2027.

link
averageRoyalty 705 days ago
How often do you think RCE vulerabilities are dropping on enterprise machines that already have vectors for security (firewalls, password policy, software install policy, etc)?

I understand cybercrime is real, however I highly doubt the amount of real time RCE exploits leaked into the wild executed within 2 hours is > 0.01% of the updates pushed by CrowdStrike.

link
mewpmewp2 705 days ago
This would require a deep dive into analyzing the importance of that specific update and all the other updates they do and at which frequencies and for which reasons. 2 leading causes for ransomware are social engineering and unpatched software which something like CrowdStrike should be able to secure against.

If there's a new pattern of social engineering/phishing attack it might be a question of hours to be able to respond to that and identify those specific patterns. Or just every minute will mean that more companies and machines will be compromised if there's a mass phishing campaign going on.

link