MAINSAIL Group’s Post

Check out these opportunities in SIG! #sigishiring

CrowdStrike's Global Outage: A Deep Dive into the Technical Failures Warning: IT language to follow In a detailed technical root cause analysis, CrowdStrike has revealed the intricate series of events that led to a significant global outage of its Falcon sensor platform. The incident, which began on July 19, 2024, was traced back to a mismatch in input parameters for a newly introduced Template Type in sensor version 7.11. This Template Type was designed to enhance detection capabilities for advanced attack techniques exploiting Windows interprocess communication (IPC) mechanisms. The crux of the issue lay in the discrepancy between the number of input parameters required and those provided. The new IPC Template Type was defined to require 21 input parameters. However, the integration code erroneously supplied only 20. This mismatch evaded detection through multiple layers of validation and testing, including the sensor release testing process and stress testing of the Template Type. The problem came to a head when new IPC Template Instances were deployed on July 19, 2024. One of these instances introduced a non-wildcard matching criterion for the 21st input parameter, which had not been utilized in previous deployments. This led to the creation of a new version of Channel File 291, which required the sensor to inspect the 21st input parameter. The Content Interpreter, expecting only 20 inputs, attempted to access the 21st value, resulting in an out-of-bounds memory read and subsequent system crashes. CrowdStrike has since implemented several mitigations to *prevent a recurrence* of such issues. These include: Validation at Compile Time: A patch for the Sensor Content Compiler now validates the number of inputs provided by a Template Type at sensor compile time. Runtime Bounds Checks: The Content Interpreter has been updated to include runtime bounds checks to prevent out-of-bounds access. Improved Testing: Automated tests now include non-wildcard matching criteria for each field, and additional scenarios reflecting production usage have been incorporated. Staged Deployment: New Template Instances are now deployed in a staged rollout to mitigate the impact of potential failures. Customer Control: The Falcon platform has been updated to provide customers with increased control over the deployment of Rapid Response Content updates. Additionally, CrowdStrike has engaged independent third-party software security vendors to conduct further reviews of the Falcon sensor code and the end-to-end quality process from development through deployment. This incident underscores the complexity of maintaining robust cybersecurity defenses and the importance of rigorous validation and testing processes. CrowdStrike's swift response and comprehensive mitigations aim to enhance the resilience of its platform and prevent similar issues in the future. Dave Poole Ron Savoia Patrick Garrity 👾🛹💙Matthieu Garin

Must Read 👇 . Please read it below and share it ! DM me or comment below if you have any questions.

Does security still feel slow and hard to implement? If your company neglects security take this first step ↳Implement privacy by design Steps for implementation 🟢 Set Security Objectives Early ↳Start project discussions with clear security goals. ↳Align with overarching project objectives. 🟢 Assign dedicated roles for security ↳Security Architect: ↳Designs secure network and system infrastructure. ↳Security Engineer: ↳Implements and maintains security solutions. ↳Application Security Developer: ↳Ensures secure software applications. Repost ♻️ to Teach your developer network something new! ↳ Follow Džemal Džananović for more tips. #security #coding #softwaredevelopment

Just came across this must-read article detailing the career in Incident Response (IR) within Unit 42. For those curious about what it takes to succeed in IR or looking to advance their career in Unit 42, this piece is packed with invaluable advice and perspectives Palo Alto Networks Unit 42 Palo Alto Networks #lifeatpaloaltonetworks

#𝐌𝐞𝐞𝐭𝐓𝐡𝐞𝐄𝐱𝐩𝐞𝐫𝐭𝐒𝐲𝐬𝐭𝐞𝐦𝐬𝐄𝐧𝐠𝐢𝐧𝐞𝐞𝐫 A systems engineer is a professional responsible for designing and managing complex systems over their entire life cycle. Their role encompasses a broad range of tasks, including planning, implementing, maintaining, and troubleshooting various systems. Here are some key responsibilities and tasks typically associated with systems engineers: System Design: Develop and design system architecture based on specified requirements. Create detailed plans and documentation for system implementation. Implementation: Oversee the installation and configuration of hardware and software components. Ensure seamless integration of different subsystems within the overall system. Testing and Evaluation: Conduct thorough testing of systems to identify and address any issues or vulnerabilities. Evaluate system performance and recommend improvements or optimizations. Maintenance and Support: Provide ongoing maintenance and support for existing systems. Troubleshoot and resolve technical issues as they arise. Security Implementation: Implement security measures to protect systems from unauthorized access or cyber threats. Stay updated on cybersecurity best practices and integrate them into system designs. Collaboration: Work closely with cross-functional teams, including software developers, hardware engineers, and project managers. Collaborate with stakeholders to understand and incorporate their requirements. Documentation: Create comprehensive documentation for systems, including design specifications, operating procedures, and troubleshooting guides. System Optimization: Identify opportunities for system improvement, optimization, or upgrading. Implement changes to enhance system performance and efficiency. Risk Management: Assess potential risks associated with system designs and propose mitigation strategies. Plan for system recovery in the event of failures or disruptions. Lifecycle Management: Oversee the entire lifecycle of a system, from conception to decommissioning. Plan for system upgrades and replacements as technology evolves. Compliance and Standards: Ensure that systems adhere to industry standards, regulations, and compliance requirements. Stay informed about changes in technology and standards relevant to the field. In summary, a systems engineer plays a crucial role in designing, implementing, and maintaining complex systems, ensuring they operate efficiently, securely, and by organizational needs and industry standards. Meet our very own Chester as he walks us through what he does: https://lnkd.in/gM6UskPc #SystemsEngineer #VA #VirtualAssistant #24x7Direct #VirtualStaffing

As an infrastructure analyst/tech support engineer, one of the greatest disappointments in work is being unable to resolve a users' IT issue that stops them from continuing their work at first level. Clients who have important meetings/work to do soon will be easily frustrated by such unexpected issues. In these situations, the role of a support engineer becomes critical. Analysts should try all possible ways to find some backup option for users to continue some work.(For e.g.: If a company laptop is dead, help them setup teams/outlook on their phone/other devices so that they can attend important meetings or view important emails). Once escalation is done, proper communication should be given to next level teams handling the issue to make things faster if the user needs a fix ASAP. Some users might be annoyed by the fact that they need to contact their manager to inform them about these unable to work IT issues. In this situation, too, the analyst can become helpful by sending a short email to their manager giving them a very brief idea about the issue the user is facing, the present status of the case and steps taken to fix the problem soon. #customersatisfaction #supportengineer

I had seen comments from "security professionals" who never once in their life built actual software or pushed something to production commenting on how Crowdstrike had no testing of any type, using fancy technical words that they dont actually know what they mean and how there are cheaper alternatives... technical report about what happened is out https://lnkd.in/dv4iy7UW 1 - Its very detailed, they explain what happened (hint: ofc they had tests but they also did have a bug - thats the interesting part of building software, its hard). 2 - Crowdstrike product isn't just one component, its a highly complex software with multiple components that get shipped multiple times per day - if u think they do this without a lot of testing and validation... I dont even know what to tell you, try shipping something that is actually used by others and not just some pythong scripts that run locally and I bet you'll crash some stuff as well. (Software is hard) 3 - They need to do even better, and they admit it and write down how they are going to improve. I said before, will say it again - Crowdstrike is still the best EDR on 🌎 - the team made a big mistake but then immediately jumped into action and 4 days later a large majority of clients are restored (not all) how many companies would we trust to be able to do the same? - they made a mistake, admitted it, and came out with a good, transparent report on what happened. Make no mistake, Im not trying to absolve Crowdstrike from their mistake, they made one, a big one - but so do many others with much worse transparency and a lack of bias to action when it comes to customer support and restoration.