Sign In

Ccsp Prabh Nair

CISSP - CCSP - CSSLP - CRISC - CISM - CISA - CGEIT - CIPM - CDPSE - CCISO - GCA - AWS SEC - AZ500 - OPSE - CASP - TOGAF -

Ccsp Prabh Nair is a seasoned professional with extensive experience in the Information security sector, having worked on numerous short-term assignments for over a hundred organizations worldwide in more than twenty countries.

His expertise includes application security, vulnerability assessment, penetration testing, and security solutions in governance, as well as risk and compliance.

Nair is driven by the mission to contribute to society, leading him to become an author and an Instructor to many IT professionals.

He pursued his Bachelor's degree at Delhi University and has held key roles such as Founder at Azpirantz Technologies LLP, Co-Founder & CISO at Infosec Train, Senior IT Auditor at Allianz, and Information Security Consultant / SME at Koenig Solutions Pvt. Ltd.

Highlights

Jul 19 · linkedin

In this video, I delve into the recent CrowdStrike update and its unforeseen negative impacts on organizational operations. I explain these issues in simpler terms so that everyone can understand the potential risks and what it means for your cybersecurity strategy. For more information Join my Instagram channel https://lnkd.in/gkjb56ZW #crowdstrike

Jul 19 · linkedin

Again Every posting news but not telling what happened same story :) 𝐖𝐡𝐚𝐭 𝐢𝐬 𝐂𝐫𝐨𝐰𝐝𝐒𝐭𝐫𝐢𝐤𝐞'𝐬 𝐅𝐚𝐥𝐜𝐨𝐧 𝐩𝐥𝐚𝐭𝐟𝐨𝐫𝐦 CrowdStrike's Falcon platform offers endpoint detection and response (EDR) capabilities, which means it can detect threats and take immediate action to stop them. Unlike traditional systems that merely alert users, Falcon can actively intervene. 𝐖𝐡𝐚𝐭 𝐇𝐚𝐩𝐩𝐞𝐧𝐞𝐝 𝐢𝐧 𝐂𝐫𝐨𝐰𝐝𝐬𝐭𝐫𝐢𝐤𝐞  CrowdStrike develops and distributes Falcon Sensor, a cybersecurity application that runs on Windows with deep integration. All of this resulted from a faulty update of CrowdStrike’s Falcon Sensor, a core component of their cybersecurity suite, which triggered a compatibility issue with Windows , leading to system instability and BSODs. The driver file update was severely bugged and led to end user system crashes during bootup. This was causing a boot loop and the fix required a manual workaround (booting into safe mode and deleting the problematic file). Here below a car analogy for laypeople: 𝐈𝐧𝐭𝐞𝐠𝐫𝐚𝐭𝐢𝐨𝐧 

  1. Microsoft is responsible for the car's overall performance and safety.
  2. CrowdStrike is responsible for the functionality and compatibility of the alarm system of the car. 3)The BSOD incident is akin to the alarm system malfunctioning and causing the car to stall. 𝐀𝐜𝐜𝐞𝐩𝐭 𝐭𝐡𝐞 𝐅𝐚𝐜𝐭 𝐨𝐟 𝐂𝐫𝐨𝐰𝐝𝐬𝐭𝐫𝐢𝐤 
  3. Software update exposing a major single point of failure and triggering outages of essential and important services!
  4. More than half the world is down, airplanes grounded, banking systems. 
  5. Most concerning is that a rollback is not possible (the serious issue is that we cannot push an update) 
  6. Batch Operation to correct the issue not possible, Manual intervention is necessary to boot into safe mode and delete the update file on each affected instance.
  7. But they have provide timely update response

𝐋𝐞𝐬𝐬𝐨𝐧 𝐟𝐨𝐫 𝐂𝐈𝐒𝐎

  1. Think about High Availability (Redundant servers) technologies stacks to #Rollback. 
  2. Restrict dynamic updates if possible
  3. Prepare and practice PR with Incidence Response (IR) and Disaster recovery (DR) to manage “Customer Trust” during such outages :)
  4. Technology stacks needs to be tested and maintained with solid Availability metrics especially for updates.
  5. Think of investing in SCA Tools
  6. Don’t panic and wait for formal vendor response, here from CrowdStrike and Microsoft, for a formal fix 
  7. Make sure the vendor fix is well tested before batch deployment.
  8. Rebuilding user trust and learning from the incident to prevent similar future crisis are key.
  9. Must have patches introduce in Phases
Ccsp Prabh Nair
Add to my network

Location

Thiruvananthapuram, Kerala, India