CrowdStrike accepting the PwnieAwards for "most epic fail" at defcon

Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by maccard on Sunday August 11, 2024 @06:41PM (#41219807)

I completely agree. When I've negotiated contracts for my workplace, and we explicitly write in the contract that the vendor is responsible for XYZ, it is my understanding (and confirmed by legal, multiple times) that this means in case of XYZ going wrong, they are liable for up to the amount in the SLA, however that isn't a cap on liability in extenuating circumstances.

If this all gets brushed away, it significantly devalues the "well we pay $VENDOR to manage our user data, it's on them if they store it incorrectly" proposition, which would absolutely cause us to renegotiate.

[ Parent | on HN ]

Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by cqqxo4zV46cp on Sunday August 11, 2024 @07:32PM (#41219991)

You aren’t showing us the specific language that you’re referring to, nor do we know what a typical CrowdStrike contract looks like. You could be talking about apples and oranges here. I’ve seen both.

[ Parent | on HN ]

Re:CrowdStrike accepting the PwnieAwards for "most epic fail... by maccard on Monday August 12, 2024 @05:00AM (#41222525)

I was pretty sure that someone was going to "ackshually" me here, and here we are. The specific wording doesn't matter.

I've negotioated dozens of these contracts and the value add of a vendor managing the data is liability. If they aren't liable for data mis-management, then their managed service is only worth the infra costs + a haircut on top, and we'll renegotiate with this in mind.

[ Parent | on HN ]