This is an unpopular opinion, and I get why – people crave a scapegoat. CrowdStrike undeniably pushed a faulty update demanding a low-level fix (booting into recovery). However, this incident lays bare the fragility of corporate IT, particularly for companies entrusted with vast amounts of sensitive personal information.
Robust disaster recovery plans, including automated processes to remotely reboot and remediate thousands of machines, aren’t revolutionary. They’re basic hygiene, especially when considering the potential consequences of a breach. Yet, this incident highlights a systemic failure across many organizations. While CrowdStrike erred, the real culprit is a culture of shortcuts and misplaced priorities within corporate IT.
Too often, companies throw millions at vendor contracts, lured by flashy promises and neglecting the due diligence necessary to ensure those solutions truly fit their needs. This is exacerbated by a corporate culture where CEOs, vice presidents, and managers are often more easily swayed by vendor kickbacks, gifts, and lavish trips than by investing in innovative ideas with measurable outcomes.
This misguided approach not only results in bloated IT budgets but also leaves companies vulnerable to precisely the kind of disruptions caused by the CrowdStrike incident. When decision-makers prioritize personal gain over the long-term health and security of their IT infrastructure, it’s ultimately the customers and their data that suffer.
Yep - it’s a CIO/CTO/HR issue.
Those of us designing and managing systems yell till we’re blue in the face, and CIO just doesn’t listen.
HR is why they use crap like CrowdStrike. The funny thing is, by recording all this stuff, they become legally liable for it. So if an employee intimates they’re going to do something illegal, and the company misses is, but it’s in the database, they can be held liable in a civil case for not doing something to prevent it.
The huge companies I’ve worked at were smart enough to not backup any comms besides email. All messaging systems data were ephemeral.
That is a damned good point and kind of hilarious. Thanks for the meaningful input (and not just being another Internet Reply Guy like some others on here).
I’m currently working for a place that has had recent entanglements with the govt for serious misconduct that hurt consumers. They have multiple policies with language in it to reduce documentation that could get them in trouble again. But minimal attention paid to the actual issues that got them in trouble.
They are more worried about having documented evidence of bad behavior than they are of it occurring.
I’m certain this is not unique to this company.