CrowdStrike and the Standards We Rely On
You can’t compliance your way to good processes, security, and reliability.
Everyone knows about the CrowdStrike incident: A developer made a change and everything went down. It was bad.
I have a lot of sympathy for the developer who wrote that code. My mistakes don’t affect millions of computer systems globally, and I couldn’t do a fraction of the damage even if I wanted to. Working on big, important systems means you can make big, important mistakes.1
Mistakes don’t occur in a vacuum, either. People write bad code all the time, and our systems need to be robust to that. If an out-of-bounds memory read can result in a catastrophe so bad that the US president needs to be briefed on the situation, something is badly broken on a much grander scale.
But when I try to place my finger on that broken thing that allowed this to happen, I find that I can’t. It seems that CrowdStrike was in line with industry standards, and their customers were perfectly reasonable for trusting them as a vendor. If we’re going to avoid these incidents in the future, it might be time to realize that our industry standards can't keep us safe.
Standards and Certification
CrowdStrike isn’t some cowboy organization that YOLOs code into prod and walks away. They have a long list of certifications, including ISO27001 and SOC2, attesting to their seriousness as a vendor. CrowdStrike has proven to external auditors that they conform to standards containing controls related to testing, change management, and risk mitigation.
On the customer side, it is perfectly normal to rely on those types of certifications as evidence that a vendor has their operations in order. Of course, customers still send out lengthy vendor questionnaires of their own, but that’s less about assessing the suitability of a vendor and more about binding the vendor to certain legal representations. When a vendor asks if all data is encrypted in transit and at rest, it’s like US Immigration asking whether you are part of a terrorist organization. They know the answer, but they want you to say it so they can later use it against you if they need to. In terms of assessing whether CrowdStrike is a trustworthy vendor, it’s the certifications that carry the weight.
In other words, things worked the way they were supposed to. CrowdStrike had crossed their Ts and dotted their Is, and in doing so earned the trust of some major, systematically important companies.
A Skill Issue
Running a complex software product with massive distribution and aggressive permissions is hard, and it requires a ton of skill to do it right. There is no generic playbook that you can follow. CrowdStrike clearly messed up by not having the right processes in place to prevent this, but there’s no standard that defines what those processes should have been. I’m certainly not going to attempt to tell CrowdStrike what they “should have done”.
My advice to customers isn’t especially helpful either. The next major incident is unlikely to look like the last, so setting up measures that would have prevented this specific problem (insofar as that is even possible) probably won’t get you very far.2 And more to the point, asking your most critical vendors to have certifications like ISO27001 and SOC2 is still a good idea. Those standards might not be enough to prevent disasters like this one, but that doesn’t mean they’re pointless.
But there is one takeaway that I think is useful, albeit a bit abstract: You can’t compliance your way to good processes, security, and reliability. Good engineering isn’t a checkbox. Standards and certifications won’t stop you from bringing your company to its knees, so that job falls on you.
One time I took down Dagbladet, Norway’s second largest news site, during the biggest news event in the history of digital media in Norway.↩
With that said, a coworker pointed out how as an industry we’ve only just recently started to recognize the importance of automatic updates, and therefore it makes sense that we also haven’t fully grappled with the implications of that, and how to handle that in a good and safe way. It is likely worth your time to read up on best practices around automated updates.↩
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.
Continue reading
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
