Insight from Gartner for IT Analyst Jeremy D'Hoinne on today's Crowdstrike outage ⬇️
Advising CISOs - Security Analyst - Investigating the intersection of cybersecurity and AI
Today's Crowdstrike outage has created an enormous amount of stress. There is no time to think twice. Attackers are opportunistic. They take advantage of urgent stressful situations. The current incident is one of those opportunities. Your employees may be unwilling to wait an hour in the queue for IT support, and they will try to find a solution themselves. Self-service remediation creates opportunities for attackers, who will send an email, text message or social media post with links to "remediation steps" or "automated recovery scripts" that actually point to malicious content. These links may show up in search as well. I recommend that you: 1. Publish "official guidance and links" internally quickly 2. Use crisis communication channels to ensure everyone knows what the right process is and where the trustful content is 3. Warn them about the existence of these attacks 4. Get your security operation teams to monitor for unusual activities, and to be prepare to investigate these activities later, when the malicious sites are identified
