CrowdStrike Explains Why Bad Update Was Not Properly Tested

CrowdStrike Explains Why Bad Update Was Not Properly Tested

July 24, 2024 at 07:09AM

CrowdStrike faced a global fallout following a flawed update. The cybersecurity company detailed two types of updates it delivers to clients and explained that a faulty rapid response update led to widespread Windows crashes. CrowdStrike intends to bolster its testing procedures and implement a phased deployment strategy for future updates to prevent similar incidents.

After analyzing the meeting notes, the key takeaways are:

1. CrowdStrike experienced a global incident due to a problematic rapid response content update targeting novel attack techniques, which caused significant outages across sectors such as aviation, financial, healthcare, and education.

2. The update led to roughly 8.5 million devices running the Windows operating system entering a Blue Screen of Death (BSOD) loop, caused by an out-of-bounds memory read triggering an exception.

3. The incident prompted CrowdStrike to improve its rapid response content testing, including implementing local developer testing, content update and rollback testing, stress testing, fuzzing, stability testing, and content interface testing. Furthermore, additional checks will be added to the content validator for rapid response content, and error handling will be enhanced.

4. CrowdStrike is also implementing a staggered deployment strategy for rapid response content and giving customers greater control over the deployment of these updates.

5. CrowdStrike has found a way to speed up the remediation of impacted systems and claims that a significant number of devices have already been restored.

6. The incident prompted US House leaders to request CrowdStrike CEO George Kurtz to testify to Congress about the company’s role in the widespread outage.

7. Organizations and users have been warned about potential threat actor activities leveraging the incident for phishing, scams, and malware delivery.

Additionally, media coverage and further details can be found in SecurityWeek and other sources.

Full Article