CrowdStrike Windows Outage — What Happens and What To Do Next

Key Points:

• Impact: The outage disrupted operations at airports, banks, businesses, and broadcasters. Planes in the U.S. and trains in the U.K. were notably affected.
• Response: CrowdStrike engineers are working on resolving the issue, which has been isolated and fixed.
• Workaround: Users can manually delete a specific file in Safe Mode to restore functionality, though this isn’t scalable for larger organizations.
• Microsoft’s Role: Microsoft is also taking mitigation actions and investigating related issues with its cloud.

Recommendations:

• Follow the steps provided by CrowdStrike to manually fix affected systems.
• Ensure communication with CrowdStrike representatives through official channels for updates.

Caution About Malware Exploitation:

• Increased Risk: Lowered security system sensitivity can be exploited by malware, posing a critical risk as cybercriminals may take advantage of reduced defenses.
• Preventive Measures: Remain vigilant, monitor for unusual activities, and ensure robust security protocols. Incorporating prevention-first security strategies like Automated Moving Target Defense (AMTD) can help mitigate the exploitation of vulnerabilities by constantly changing the attack surface, making it more difficult for malware to find and exploit weaknesses.

The Problem With Signatures and Updates in Cybersecurity Software:

The recent CrowdStrike incident underscores the inherent flaws in traditional detection methods, which rely heavily on updates. These approaches are vulnerable to failures and can lead to widespread disruptions. Automated Moving Target Defense (AMTD), offered by Morphisec, stands out as the only viable alternative, offering robust protection by continuously changing the attack surface and making it significantly harder for malware to exploit vulnerabilities. With AMTD, organizations can avoid the pitfalls of static detection methods and ensure a higher level of security and resilience.”

Michael Gorelik | CTO Morphisec

Conclusion:

About the author

Brad LaPorte

Chief Marketing Officer

Brad LaPorte is a seasoned cybersecurity expert and former military officer specializing in cybersecurity and military intelligence for the United States military and allied forces. With a distinguished career at Gartner as a top-rated research analyst, Brad was instrumental in establishing key industry categories such as Attack Surface Management (ASM), Extended Detection & Response (XDR), Digital Risk Protection (DRP), and the foundational elements of Continuous Threat Exposure Management (CTEM). His forward-thinking approach led to the inception of Secureworks’ MDR service and the EDR product Red Cloak—industry firsts. At IBM, he spearheaded the creation of the Endpoint Security Portfolio, as well as MDR, Vulnerability Management, Threat Intelligence, and Managed SIEM offerings, further solidifying his reputation as a visionary in cybersecurity solutions years ahead of its time.