So whats the alternative? Have no endpoint protection? Have nothing in place to warn you when malware ends up in your system?
(Just playing devils advocate. I hate Crowdstrike as much as anyone here :)
(Just playing devils advocate. I hate Crowdstrike as much as anyone here :)
I think it's more like, security is heavily check mark based. Crowdstrike and friends have managed to get "endpoint security"[1] added as a "standard security best practice" which every CSO knows they must follow or get labeled incompetent. Therefore "endpoint security" must be installed everywhere with no real proof that it makes things more secure, an arguable case that it makes things less secure, and an undeniable case that it makes things less reliable.
[1] I also never understood how "endpoints" somehow are defined as "any computer connected to any network." I tried to fight security against installing this crap on our database servers with the argument that they are not endpoints. Did not work.
People and companies that hide behind this bullshit don’t deserve to be in leadership positions. Cowards
[1] https://www.datacenterdynamics.com/en/news/cloudflare-claims...
Note how the intrusion detection system here only needs to do offline scans that are unaffected by security updates.
Page 53: “The evaluator will conduct penetration testing, based on the identified potential vulnerabilities, to determine that the OS is resistant to attacks performed by an attacker possessing Basic attack potential.”
That is the lowest level of security certification outlined in the standard. The elementary school diploma of security.
To see what that means, here is a sample of the certification report [3].
Page 14: “The evaluator has performed a search of public sources to discover known vulnerabilities of the TOE.
Using the obtained results, the evaluator has performed a sampling approach to verify if exists applicable public exploits for any of the identified public vulnerabilities and verify whether the security updates published by the vendor are effective. The evaluator has ensured that for all the public vulnerabilities identified in vulnerability assessment report belonging to the period from June 8, 2021 to July 12, 2022, the vendor has published the corresponding update fixing the vulnerabilities.“
The "hardcore" certification process they subject themselves to is effectively doing a Google search for: “Windows vulnerabilities” and checking all the public ones have fixes. That is all the security they promise you in their headline, mandatory security certification that is the only general security certification listed and advertised on their official security page.
When a company puts their elementary school diploma on their resume for “highest education received”, you should listen.
That is not to say any of the names in general purpose operating systems such as MacOS, Linux, Android, etc. are meaningfully better. They are all inadequate for the task of protecting against moderately skilled commercially minded attackers. None of them have been able to achieve levels of certification that provide confidence against such attackers.
This is actually a good sign, because those systems are objectively and experimentally incapable of reaching that standard of security. That they have been unable to force a false-positive certification that incorrectly states they have reached that standard demonstrates the certification at least has a low false-positive rate.
All of the standard stuff is inadequate in much the same way that all known materials are inadequate for making a space elevator. None of it works, so if you do want to use it, you must assume they are deficient and work around it. That or you could use the actual high quality stuff.
[1] https://learn.microsoft.com/en-us/windows/security/security-...
[2] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4....
[3] https://download.microsoft.com/download/6/9/1/69101f35-1373-...
And whether you can see it or not, they're all still some form of dumpster fire, be it security, usability, price.
allow nothing and then gradually allow some activities that are deemed safe
do not allow software to be installed from arbitrary locations
app sandboxing and third-party vendors cannot break their sandbox
basically, iOS, Android, ChromeOS
50% of the people impacted today probably only need a browser