|
Ordinarily, mega computer-security conferences like this week’s Black Hat are where cybersecurity leaders like CrowdStrike shine the brightest.
Black Hat’s focus is fresh security research, some of which is also presented at the less expensive and wilder Def Con hacking conference that follows it in — where else? — Las Vegas.
For years, CrowdStrike was most widely known for its deep analysis of the worst hacking attacks, which included attributing notorious hacks like those of the Democratic National Committee and Sony Corp. to teams working for the governments of Russia and North Korea, respectively.
But these days, CrowdStrike is best known for causing worldwide disruption of air travel, financial markets and corporate life as we know it on July 19.
That’s when a faulty update to the CrowdStrike security sensors embedded deep within Windows computers malfunctioned so badly that it triggered the dreaded “Blue Screen of Death” on more than 8 million devices. Most of them needed one human being to talk another through multiple steps to get rebooted and start functioning again.
With damage estimates exceeding $1 billion and very visibly impacted victim Delta Air Lines threatening to sue the company for half of that, CrowdStrike knows it will be a major topic of conversation as its security-savvy customers and rivals get together Wednesday in Sin City.
That’s why the company has been scrambling to deal with the fallout in the past few days.
Before other customers decide to follow Delta’s example, CrowdStrike sent a defiant letter to the airline Sunday, claiming CrowdStrike’s contract left it on the hook for just a few million dollars.
In addition, CrowdStrike’s attorney wrote, a court fight would force Delta to explain “Why Delta’s competitors, facing similar challenges, all restored operations much faster. … Why Delta turned down free onsite help from CrowdStrike professionals who assisted many other customers …[and] the design and operational resiliency capabilities of Delta’s IT infrastructure.”
Alongside that hard line, though, CrowdStrike on Tuesday released a detailed “root cause analysis” explaining exactly where it went wrong and spelling out what it would do differently in the future. It also said it had hired outside security experts to weigh in on its procedures.
That transparency was generally welcomed by security professionals.
“They identified the mistake, they owned the mistake, they did everything they could to fix it right away,” one wrote on social networking service Mastodon. “They then did a write up of exactly how they dropped the ball.”
CrowdStrike chief executive George Kurtz, already in Vegas on Tuesday for more exclusive industry briefings, took the opportunity on a private panel about start-up strategy to apologize again for the blunder.
“George’s comments were brief but well said,” an expert in the audience said. They got a warm reception, “which surprised me, given how critical the security community can be.”
Kurtz’s mission for the rest of the week will require more of the kind of humility that goes with a 40 percent stock price drop, along with practical insight on how to improve the industry, which is already something of a punching bag for allowing continued hacks.
“The software industry can learn a lot about quality engineering practices from the CrowdStrike update incident,” said Kymberlee Price, CEO of Zatik Security, expressing approval for the company’s new commitment to better quality assurance and gradual update rollouts.
“CrowdStrike’s focus continues to be on using the lessons learned from this incident to better serve our customers,” CrowdStrike spokesperson Kevin Benacci wrote in an email. “Our interactions have focused on greater collaboration and how we can work together as an industry to build more resilient systems.”
That includes working more closely with Microsoft, which competes with CrowdStrike’s security offerings but integrates so closely with them that it let its own customers down.
In his own deep analysis of what went wrong, Microsoft security executive David Weston wrote that the company planned to cut back on the need for kernel drivers like CrowdStrike’s to access sensitive security data. Weston also said new and coming Microsoft technology will give customers more flexibility to limit the reach of third-party software.
CrowdStrike, which had been among Microsoft’s fiercest critics before the outage, offered no objections.
“Our industry partners, including Microsoft, have been incredibly supportive and helpful,” Benacci wrote.
|
Email
