Gregory's Server@calamari What's interesting about this is that best practice is to be on n-2, or two versions behind on driver updates. Which we are. But this was a policy update, or a channel update where they modified modified the detections such that it borked ALL versions of the driver. TL,DR senior leadership assumed we would be covered to prevent this, but n-2 doesn't mean what everyone thought it meant.
|
8 comments
@LogicalApex @calamari. It's just wild that Crowdstrike pushes that apparently untested definition file globally, and was able to hit hundreds of millions of endpoints before anyone saw it was literally breaking every computer it touched? I mean... WFT @LogicalApex @calamari also, quoth the vendor, "There is no way at this time" to turn off channel updates... SLT is gonna love that.  @hudsoncress @LogicalApex @calamari Because if not, if it were malware, there would be at least hope that the responsible would be prosecuted at some point. @yacc143 @hudsoncress @calamari Companies put boiler plate language in their contracts. They either absolve themselves of any liability for damages or limit their liability to your license fee. Probably also includes a mandatory arbitration clause to further limit liability fallout. I bet that’s the case here too. 😬 @LogicalApex @yacc143 @calamari what’s interesting is how we all assumed n-2 would save us from this but nobody was clear beforehand that the real risk was a policy update, not a driver version. @LogicalApex @hudsoncress @calamari Interestingly, so they sell you a product that does something, on most days what the sales prospectus says, and on some days destroys your IT, and say enjoy, you cannot sue us, and the IT crime laws don't apply to us, as you voluntary provided us with access to all your IT. Now purely as the IT guy, that is GREAT. @LogicalApex @hudsoncress @calamari Admittedly he crossed out this paragraph when I explained to him the issues ;) |
@hudsoncress @calamari They don’t like to be behind on security updates though. These were definition files so being n-2 would mean exposure to 1 and 2 day critical security vulnerabilities.
This isn’t the first major crisis caused by rapid fire security updates. It won’t be the last.