Viss (@Viss@mastodon.social)

359d

In an unexpected turn of events, a sensible take on #Crowdstrike from the Orange Site.

Source: https://news.ycombinator.com/item?id=41004184

Screenshot of a Hacker News comment. Text follows:

So CrowdStrike is deployed as third party software into the critical path of mission critical systems and then left to update itself. It's easy to blame CrowdStrike but that seems too easy on both the orgs that do this but also the upstream forces that compel them to do it.
My org which does mission critical healthcare just deployed ZScaler on every computer which is now in the critical path of every computer starting up and then in the critical path of every network connection the computer makes. The risk of ZScaler being a central point of failure is not considered. But - the risk of failing the compliance checkbox it satisfies is paramount.
All over the place I'm seeing checkbox compliance being prioritised above actual real risks from how the compliance is implemented. Orgs are doing this because they are more scared of failing an audit than they are of the consequences failure of the underlying systems the audits are supposed to be protecting. So we need to hold regulatory bodies accountable as well - when they frame regulation such that organisations are cornered into this they get to be part of the culpability here too.

ALT

Edited 356d ago

1 0 6 View Post & Replies See Original

358d

@calamari @Viss

[Orgs] are more scared of failing an audit than they are of the consequences failure of the underlying systems the audits are supposed to be protecting.

100% on the money with that bit.

1 0 0 View Post & Replies See Original

358d

@catsalad @calamari yip. checkboxing is bad practice

0 0 0 View Post & Replies See Original