The recent CrowdStrike outage serves as a reminder for cybersecurity defenders about the importance of robust testing and incident response strategies. As practitioners, our role is to anticipate, mitigate, and manage the impacts of such disruptions. Here are important actions and considerations drawn from the CrowdStrike incident and similar events, such as the Microsoft Windows 10 October 2018 Update.
CrowdStrike’s outage was caused by a bug in the Memory Scanning prevention policy that led to widespread performance issues across systems running the Falcon sensor for Windows. This bug, which resulted in the sensor consuming 100% of a CPU core, was not caught during standard testing procedures. The incident underscores the necessity for comprehensive testing and the critical need for rapid and effective incident response mechanisms.
Immediate actions to take
Long-term strategies
Follow-on threats
After major incidents like the CrowdStrike outage, it’s common to see a rise in follow-on threats. Attackers often exploit the confusion and urgency created by the initial disruption to launch secondary attacks.
These follow-on threats can include phishing and social engineering attacks, where criminals pose as support personnel from the affected company, attempting to trick users into providing sensitive information or installing malware. For example, after the Microsoft 2018 update incident, there were numerous reports of phishing emails and tech support scams. Another threat involves fake update notifications, where users might receive prompts to download "urgent" updates that are actually malware. It’s crucial to ensure that users only download updates from official sources. Additionally, attackers may increase their scanning activity to identify systems that are still vulnerable or improperly patched.
Drawing parallels from the Microsoft 2018 incident, we can expect CrowdStrike to face significant reputational damage and customer trust issues. Microsoft had to halt the rollout and work extensively to fix the problems, which included restoring lost files for some users. Similarly, CrowdStrike will need to dedicate substantial resources to remediation and rebuilding trust.
The CrowdStrike outage reminds us of the complexities and challenges in cybersecurity. By adopting comprehensive testing practices, diversifying vendor dependencies, maintaining clear communication, and enhancing social engineering defenses, practitioners can better prepare for and respond to such incidents. Continuous improvement and vigilance are vital to minimizing the impact of inevitable disruptions in our increasingly interconnected digital ecosystem.
Callie Guenther, senior manager, cyber threat research, Critical Start
