Behind a massive IT failure that grounded flights, upended markets and disrupted the operations of corporations around the world is one cybersecurity company: Austin-based CrowdStrike Holdings Inc.
Known as a dominant supplier of software that protects businesses from ransomware attacks, CrowdStrike was thrust into the spotlight on Friday as it struggled to fix a faulty patch that led to cascading, system-wide failures, paralyzing the operations of clients ranging from banks to global retail giants to health-care systems on Friday.
CrowdStrike was founded by former executives of antivirus pioneer McAfee Inc. and has grown into the leading maker of a relatively new type of security software that’s considered among the best defenses against ransomware and other hacking threats. It controls what market research firm IDC estimates is nearly 18 percent of the $8.6 billion global market for so-called “modern” endpoint protection software, just ahead of archrival Microsoft.
CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not impacted. This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed. We…
— George Kurtz (@George_Kurtz) July 19, 2024
The type of software CrowdStrike supplies is separate and distinct from older, more limited types of security software. Traditional antivirus software was useful in the early days of computing and the internet for its ability to hunt for signs of known malware, but it has fallen out of favor as attacks have become more sophisticated. Now, products known as “endpoint detection and response” software that CrowdStrike develops do far more, continually scanning machines for any signs of suspicious activities and automating a response.
But to do this, these programs have to be given access to inspect the very core of the computers’ operating systems for security defects. This access gives them the ability to take disrupt the very systems they are trying to protect. And it is how Microsoft Windows systems came into play in Friday’s outage.
Representatives for CrowdStrike confirmed online reports that a glitch in the company’s Falcon software was responsible for disabling potentially millions of corporate and government Windows computers around the world and causing the dreaded “blue screen of death.”
The company pegged the incident to “a defect found in a single content update for Windows hosts,” in a statement on Friday and said the outage wasn’t down to a cyberattack or security breach. Anyone using a Mac or Linux machine isn’t impacted, the company said, adding that “a fix has been deployed.”
An apparently separate incident involving Microsoft Corp.’s Azure cloud services also caused widespread disruption on Friday.
While cybersecurity professionals say CrowdStrike’s technology is a strong way to defend against ransomware, its cost — which in some cases can be more than $50 per machine — means that most organizations don’t install it on all of their computers. What that means, however, is that the computers that have the software installed on them are among the most important to protect, and if they go down, key services can fall with them.
One outstanding question is whether CrowdStrike’s software fix can be rolled out automatically or manually.
“You’ll have men in white vans going around to try manually fix this problem even when they put out a fix,” said Alan Woodward, professor of cybersecurity at the University of Surrey, in an interview with Bloomberg News. “To use the laptops, they’ll have to manually intervene — that is a big job.”
There’s also the question of how the bad rollout happened to begin with.
“CrowdStrike is meant to keep these machines safe,” Woodward said. “This is the sort of thing ransomware would do, but imagine ransomware simultaneously hitting the biggest organizations in the world — container ports in the Baltics, hospitals, railway stations, they’ve all been hit at once because of this one little file.”
CrowdStrike’s customer base comprises large organizations that have a large number of remote machines to manage, he added. “The economic impact is going to be huge.”
- Jordan Robertson and Shona Ghosh for Bloomberg
