IT administrators are struggling to deal with the ongoing fallout from the faulty CrowdStrike update. One spoke to The Register to share what it is like at the coalface.
Speaking on condition of anonymity, the administrator, who is responsible for a fleet of devices, many of which are used within warehouses, told us: “It is very disturbing that a single AV update can take down more machines than a global denial of service attack. I know some businesses that have hundreds of machines down. For me, it was about 25 percent of our PCs and 10 percent of servers.”
He isn’t alone. An administrator on Reddit said 40 percent of servers were affected, along with 70 percent of client computers stuck in a bootloop, or approximately 1,000 endpoints.
Sadly, for our administrator, things are less than ideal.
Another Redditor posted: "They sent us a patch but it required we boot into safe mode.
"We can’t boot into safe mode because our BitLocker keys are stored inside of a service that we can’t login to because our AD is down.
Lol, can you imagine? It empathetically hurts me even thinking of this situation. Enter that brave hero who kept the fileshare decryption key in a local keepass :D
That’s why the 3-2-1 rule exists:
For something like keys, that means:
Any IT pro should be aware of this “rule.” Oh, and periodically test restoring from a backup to make sure the backup actually works.
We have a cron job that once a quarter files a ticket with whoever is on-call that week to test all our documented emergency access procedures to ensure they’re all working, accessible, up-to-date etc.
Are you hiring!?
Seems like an argument for a heterogeneous environment, perhaps a solid and secure Linux server to host important keys like that.
Linux can shit the bed too. You need to maintain a physical copy.
Their point is not that linux can’t fail, it’s that a mix of windows and linux is better than just one. That’s what “heterogeneous environment” means.
You should think of your network environment like an ecosystem; monocultures are vulnerable to systemic failure. Diverse ecosystems are more resilient.
Sure but the chances of your Windows and Linux machines shitting the bed at the same time is less than if everything is running Windows. It’s exactly the same reason you keep a physical copy (which after all can break/burn down etc.) - more baskets to spread your eggs across.
Very few businesses are going to spend the money running redundant infrastructure on two different operating systems. Most of them won’t even spend the money on a proper DR plan.
Then they get to suffer the consequences when shit like this happens
Oh, they are.
Hey Ralph can you get that post-it from the bottom of your keyboard?