CrowdStrike ex-employees: 'Quality control was not part of our process'

Re:CrowdStrike ex-employees: 'Quality control was not part o... by notepad0x90 on Saturday September 14, 2024 @01:08AM (#41537611)

Thank you, that's a sound perspective, but it is the responsibility of the security staff who deploy EDRs like Crowdstrike to scrub any data at ingestion time into their SIEM. but within CS's platform, it makes little sense to talk about scrubbing, since CS doesn't know what you want scrubbed unless it is standardized data forms (like SSNs,credit cards,etc..).

Another way to look at it is, the CS cloud environment is effectively part of your environment. the secrets can get scrubbed, but CS still has access to your devices, they can remotely access them and get those secrets at any time without your knowledge. that is the product. The security boundary of OP's mac is inclusive of the CS cloud.

[ Parent | on HN ]

Re:CrowdStrike ex-employees: 'Quality control was not part o... by st3fan on Saturday September 14, 2024 @07:31AM (#41539103)

Unfortunately the software doesn’t allow for scrubbing or redacting to be configured. Those features simply do not exist.

[ Parent | on HN ]

Re:CrowdStrike ex-employees: 'Quality control was not part o... by notepad0x90 on Saturday September 14, 2024 @06:28PM (#41543557)

for their own cloud, yeah, you basically accept their cloud as an extension of your devices. but the back-end they use(d?), Splunk, does have scrubbing capability they can expose to customers, if actual customers requested it.

In reality, you can take steps to prevent PII from being logged by Crowdstrike, but credentials are too non-standard to meaningfully scrub. It would be an exercise in futility. If you trust them to have unrestricted access to the credential, the fact that they're inadvertently logging it because of the way your applications work should not be considered an increase in risk.

[ Parent | on HN ]