Is Crowdstrike the Final Straw?
gavinhoward.com
gavinhoward.com
Setting aside for a moment the flagrant hyperbole:
The industry will never do something without government pressure. It's a collective action problem—building reliable software has an enormous cost to it that building unreliable software does not. No company is going to swallow that cost out of the goodness of their hearts, and unless all companies in a sector move at once they can't recoup the cost from the customer.
This is the exact kind of problem that governments exist to solve: without intervention the market is broken and safety will always be sacrificed to undercut on price. Whatever the author feels about regulation, it's inevitable in some form or another. The question isn't whether the industry will get their act together before governments start moving (they most definitely won't), it's whether governments will give the industry a window to self-regulate under direct and explicit threat of intervention or if they'll immediately start writing the regulations themselves.
Yes, it is, and I am all for good regulations.
> The question isn't whether the industry will get their act together before governments start moving (they most definitely won't)
I wrote this post to change this.
> it's whether governments will give the industry a window to self-regulate under direct and explicit threat of intervention or if they'll immediately start writing the regulations themselves.
EU's Cybersecurity Resilience Act shows that they are already doing the latter.
We found that the economic incentives basically work against it. The only practical ways to improve it seemed to be raising awareness and education at the people level (important but not sufficient), and regulation/liability at the corporate level (the only way to really move the needle).
If you work for a company hit by Crowdstrike's failures, and are berated for it, a good move would be to call in the head of Legal and ask why they signed off on this.
[1] https://www.msn.com/en-us/money/insurance/crowdstrikes-terms...
What is "this"?
It is possible to effectively disclaim liability for purely economic loss. For over three decades, we have all read the disclaimers, usually in capitalised text, in source code and "EULAs".
But, generally, it has never been possible to disclaim tort liability for personal injury or damage to "other property". (For the UCC Article 2 scholars, let's assume that the software is service-oriented, not a sale of goods.)
In theory, this exception could include tort liability for injuries caused by software. That is, software developers cannot disclaim liability for personal injuries or damage to other property. (Not to imply anyone could successfully plead such a case.)
For example, the top ranking comments in the another thread on the outage, which is approaching 3500 comments, are about the effects of the outage on people in hospital. Is this physical harm to persons as a result of "security updates".
The blog post mentions the idea of a "standard of care" for software developers. That is an invitation to discuss tort liability for software.
Theories are just that: theories. Tort liabiilty for software is all but nonexistant.
the places where the crowdstrike disaster results in additional regulation will not only be dystopically oppressive as howard predicts; they will also cause themselves additional infosec disasters
george kurtz, ceo and founder of crowdstrike, was the cto of mcafee when they did the exact same thing 14 years ago: https://old.reddit.com/r/sysadmin/comments/1e78l0g/can_crowd... https://en.wikipedia.org/wiki/George_Kurtz
This is laughably wrong. Tech is notoriously under-regulated.
Crowdstrike is caused by bad regulation. Somewhat common, as regulatory bodies are typically not well versed in tech to properly regulate it.
there are a lot of people who think 'tech is under-regulated', which is to say, more regulation would probably overall improve 'tech'. that point of view is implausible in light of regulatorily-induced disasters like this
Extraordinary claims require extraordinary evidence. I know plenty of regulation that has no bad regulation within.
Case in point, I happen to work in the financial sector. The financial sector regulation tends to be, generally speaking, quite good.
> there are a lot of people who think 'tech is under-regulated', which is to say, more regulation would probably overall improve 'tech'. that point of view is implausible in light of regulatorily-induced disasters like this
Tech absolutely should be more regulated, especially given the abuse of all the major players in the field.
Saying that a human activity (regulation) makes a non-zero amount of mistakes hardly seems an extraordinary claim. It is extraordinary to claim that there are zero mistakes in financial regulation. Please supply your proof of the negative.
That was not the claim however. The claim was that "all regulation contain bad regulation", which is a broad unqualified statement aimed at throwing a shadow upon regulation. The kind of bullshit regurgitated by libertarian types that think any regulation is icky.
As for financial regulation, all regulation to ensure that banks have enough liquidity to add robustness to the system are good. Things such as KYC and AML are also generally good (which was my statement by the way). They may over time be improved, but anyone would be hard pressed to argue they should be removed for being bad.
If so you should be grateful for ways to have actual visibility (and possibly blocking) of dangerous activity on the machine. Before EDRs we were blind.
EDRs could be better, cheaper, more integrated (that part is not too bad) but saying that PCI-DSS is the only reason for them is disinformation (or lack of actual experience with SecOps)
I am the first to point to dumb decisions, usually Gartner-based, to buy the "top right quadrant" software when much better is available. However, using them would require knowledge and understanding of your needs and not being backed by an army of consultants.
And then there is the useful software to buy. A good EDR is one of them. You have nothing on the open-source market (which I use a lot, supporting the developers through whatever they put in place) and CS is very good. They fucked up great this time but it is fortunately a reversible fuck-up. Not the one where you need to reinstall or you lost data (the latter is less certain, but at least for end users this is not the case).
People who are bigots of one of the extremes ("open source is not professional software" or "commercial software is a scam") do not work in other's worlds. I can be proud of my home lab (I am) but it will not scale to the 500,000 devices I deal with at work. I know that what I am doing makes sense on my laptop, but this is far, far from being the case with the 60,000 users who do stupid things.
One day in the world of the "enemy" would change a lot of minds.
brando, you've got a lot of nerve touting the superiority of secops and edrs on the day when they caused the worst it outage in history, temporarily crippling the global economy in a way worse than any infosec attack secops has ever stopped
centralizing the security of thousands and thousands of end-user devices in the hands of a small team is a recipe for disaster, even if it didn't come with continuous exfiltration of sensitive data from those devices, and that disaster has finally struck. you, by which i mean secops, have done more damage yesterday than all the attackers in history, and the nature of the disaster demonstrates that it could have been enormously worse — and will be next time. i don't care what makes your job easier. you shouldn't be doing that job at all. it's a worthless, destructive job that makes everyone less secure
this is not monday-morning quarterbacking on my part, either; i happen to have posted this comment 7 days ago (6 days before the disaster) lamenting infosec spending "going to useless or counterproductive measures like crowdstrike" https://news.ycombinator.com/item?id=40951278
Oh cool, I had no idea.
Now to your point: have you ever worked in cybersecurity in large, complex and heterogenous companies? and have an idea about what is required to keep such a company secure within the reality of its business?
If yes - congratulations, you should be nominated as CISO of the century. I would seriously like to learn from you.
If not - well, I can give you a lot of advice about football (which I do not follow but I am a great consultant) or DIY (which I am bad at but I am ready to build an electrical and plumbing installation because I saw that in Youtube and, frankly, it looks easy).
We can troll our way indefinitely - but I have a lot of work related to this CS disaster. I am super glad for CS, though, for the time and stress it saved me in the past.
1. Regulatory capture is not something I want to see happen to IT. The big companies love making rules knowing smaller organizations can't fulfill them.
2. Just because you make some new legally binding principles, doesn't mean that almost any source code in existence will magically meet it, or can ever meet it. That code is not getting rewritten overnight, or possibly, ever. This would make regulatory capture worse than normal, because sloppy code that's impossible to rewrite would be grandfathered in, and only the newer, more innovative, smaller companies would be held to the standard.
Just take Google - they have over 2 billion lines of code. Just attempting to touch it is more dangerous than leaving sleeping dogs lie. Sucks if you're a competitor - writing your own 2 billion lines is going to be almost impossibly harder.
3. In which case, you've raised the ladder while doing very little to prevent a reoccurrence. Countries that are not the US will gain the edge in innovation, research, and development.
Also, edit:
4. The only reason everyone used Cloudstrike is because everyone's trying to do a CYA (Cover Your Ass) move; which is much easier to outsource to someone else. To regulate would further increase this tendency, which is the opposite of what we need right now.
So now, instead of having to think through your threat posture and be smart, you can deploy your magical unicorn AI software and have safe harbor ("I followed the industry best-practices!"). Just ignore the fact that said software is exporting a big juicy attack vector, wherein a third-party randomly dumps kernel-level updates on you, without your oversight, testing or permission.
What could go wrong?
Rules from above and rules by us should be in different galaxies as far as how well they work.
The things I linked to are ideas. Others will have ideas too. Let's come to a consensus about them.
We have to do precisely what we've done because it isn't working?
Civil engineers were not smart. They had licensing and liability imposed on them after bridges fell, dams burst, buildings collapsed, killing many people.
Software developers will not be smart either. They will cry about not wanting liability and make accusations of gatekeeping until something bad enough happens (Crowdstrike isn't it; not enough people died as a direct consequence) and licensing and liability is forced on developers.
And, to echo sentiments voiced by other replies, the anti-government hyperbole is more kooky than persuasive.
> And, to echo sentiments voiced by other replies, the anti-government hyperbole is more kooky than persuasive.
I am serious about it, not hyberbolic, but I will plan to leave it out of future stuff about this.
I mean...maybe you're suggesting that Crowdstrike should have followed some as-yet-unknown standard for deploying software. But if so, it's the same problem -- we'll have butt-covering compliance checklists for software development now, applied thoughtlessly by consultants promising safe harbor. Turtles all the way down.
There are already other, non-regulatory, systems in place to deal with issues like this. Market forces and law suits spring to mind immediately.
Those things don't seem to be working.
And it isn't a future armed standoff that I am warning about. It is a future where any protest is impossible.
You're assuming two things:
1. Regulation will decrease the likelihood of a failure (debatable - Boeing is certainly heavily regulated)
2. Cloudstrike will survive unscathed; when this very well could be a long-term corporate extinction event.
On that note, let's say you discover a small security bug. If your small security fix takes 7 layers of auditing and 20 lawyers to get fixed to satisfy your guild rules, you're not going to bother. Multiply this by hundreds of little bugs that are "out of scope" or "too small to worry about"; and you're Microsoft right now, a national security hazard, and you have no idea what combination of little bugs got you here.
The most incompetent and untrustworthy developers and admins have resumes full of certifications.
Any professional certification you create will be a target for "gaming" by people who view it as a ticket to a sweet gig.
Trust in "professionals" has almost totally collapsed in the U.S. anyway. Doctors and lawyers no longer have the trust of the public. I don't see how professional societies and ethics review boards have helped them be more trusted by the average citizen.
The cure to current IT social issues is FLOSS, desktop centered computing, but it's unachievable without a mass understanding of the role of IT. Even if ALL modern cars stop suddenly, all payment systems collapse for a week people will not learn because they do not want to.
I suspect any "civilization" can only change after major disruptions like a war, not "the old one", but new generations born after the war. There will always be some who foresee the needs of a radical change, the opportunity of a revolution and so on, but they regularly remain too few to steer the society...
Maybe insurance company and lawsuits are the next good answer. If people start mass sueing company X, the lawsuit cost should persuade the owners to at least do something a bit different.
We've been nuts to run any systems based on Ambient Authority outside of a 1980s college classroom environment. Connecting everything via the Internet deranged us into a hellscape just waiting to emerge, as it does periodically.
You can't enumerate badness, as virus scanners try to do. Thus you have to TRUST all the code you run, which is nuts. Operating Systems should NEVER require that you trust code, especially mobile code (stuff that came from outside your 1980s college classroom).
We have fuses and circuit breakers, and all sorts of ways to limit the damage a short circuit can do, but no such analogs for limiting the scope of damage a chunk of code can do to the world. This is insane.
It's not the users, system admins, Microsoft, or anyone else. It's the security model underlying the OS. This problem was solved in the 1970s, for f*cks sake!
We have the exact thing for that. They're called virtual machines and containers where you have absolute control over the networking and disk access. You practically have to be a software developer to use them, but they exist. Most of us exchange convenience for security, however, so here we are.
[Edit:] I have no financial (or otherwise) interest in CrowdStrike or any related product or vendor. My point here is that by failing to practice the most fundamental QA in their release process, CrowdStrike directly caused a global IT infrastructure meltdown--which is, of course, what other product is supposed to prevent.
The "punishment" needs to be extinction. Only when that happens will other firms like this, along with the brain-dead lemmings who make most enterprise IT purchasing decisions, start acting responsibly.
Add: I think this is related to the failure of the USSR. And by definition that was government everywhere.
I am talking to both. Programmers should set the rules and impose them on their empoyers or the "tech industrialists" won't accept them.
But now that you mention it... if software companies were more densely unionized in more of the developed world, especially in the US; and if those would be independent and membership-controlled unions, more like the IWW and less like UAW, SEIU and such - then maybe that would have been more realistically possible and not in some far away future.
How else do you wield control and influence?
The next one will be we-cant-withdraw-money-from-atm-or-teller level of failure
If you are paid 7 digits a year to ignore and not do your job isn't that essentially being bought?