This is an unpopular opinion, and I get why – people crave a scapegoat. CrowdStrike undeniably pushed a faulty update demanding a low-level fix (booting into recovery). However, this incident lays bare the fragility of corporate IT, particularly for companies entrusted with vast amounts of sensitive personal information.
Robust disaster recovery plans, including automated processes to remotely reboot and remediate thousands of machines, aren’t revolutionary. They’re basic hygiene, especially when considering the potential consequences of a breach. Yet, this incident highlights a systemic failure across many organizations. While CrowdStrike erred, the real culprit is a culture of shortcuts and misplaced priorities within corporate IT.
Too often, companies throw millions at vendor contracts, lured by flashy promises and neglecting the due diligence necessary to ensure those solutions truly fit their needs. This is exacerbated by a corporate culture where CEOs, vice presidents, and managers are often more easily swayed by vendor kickbacks, gifts, and lavish trips than by investing in innovative ideas with measurable outcomes.
This misguided approach not only results in bloated IT budgets but also leaves companies vulnerable to precisely the kind of disruptions caused by the CrowdStrike incident. When decision-makers prioritize personal gain over the long-term health and security of their IT infrastructure, it’s ultimately the customers and their data that suffer.
I’ve worked in various and sundry IT jobs for over 35 years. In every job, they paid a lot of lip service and performed a lot box-checking towards cybersecurity, disaster recovery, and business continuity.
But, as important as those things are, they are not profitable in the minds of a board of directors. Nor are they sexy to a sales and marketing team. They get taken for granted as “just getting done behind the scenes”.
Meanwhile, everyone’s real time, budget, energy, and attention is almost always focused on the next big release, or bug fixes in app code, and/or routine desktop support issues.
It’s a huge problem. Unfortunately it’s how the moden management “style” and late stage capitalism operates. Make a fuss over these things, and you’re flagged as a problem, a human obstacle to be run over.
Yep - it’s a CIO/CTO/HR issue.
Those of us designing and managing systems yell till we’re blue in the face, and CIO just doesn’t listen.
HR is why they use crap like CrowdStrike. The funny thing is, by recording all this stuff, they become legally liable for it. So if an employee intimates they’re going to do something illegal, and the company misses is, but it’s in the database, they can be held liable in a civil case for not doing something to prevent it.
The huge companies I’ve worked at were smart enough to not backup any comms besides email. All messaging systems data were ephemeral.
That is a damned good point and kind of hilarious. Thanks for the meaningful input (and not just being another Internet Reply Guy like some others on here).
I’m currently working for a place that has had recent entanglements with the govt for serious misconduct that hurt consumers. They have multiple policies with language in it to reduce documentation that could get them in trouble again. But minimal attention paid to the actual issues that got them in trouble.
They are more worried about having documented evidence of bad behavior than they are of it occurring.
I’m certain this is not unique to this company.
FTFY.
Where you spend more time talking about what you’re going to do, than ever actually doing it.
Where when you ask for a mirror of production to test in, you’re told that Bob was working on that (Bob left 5 years ago).