First Point Group’s Post

In light of the lasting effects CrowdStrike had on Microsoft 10 days ago. Microsoft now wants to re-open conversations around restricting the Kernel-level of access CrowdStrike’s falcon software has inside Windows.   Microsoft has announced several measures to improve system resilience: - They are emphasising the use of Virtualisation-Based Security (VBS) enclaves to enhance security without needing extensive kernel access. - They have released a recovery tool to automate the removal of the problematic CrowdStrike driver.    Overall, this has prompted Microsoft to rethink its security strategies, aiming to create a more robust and resilient Windows. Where does this affect other vendors who offer similar solutions? https://lnkd.in/ePWnWHKH

🚨CrowdStrike revealed that the global IT outage that impacted transport, finance, and medical industries around the world was caused by a sensor configuration update for Windows gone wrong🚨 //CrowdStrike's Falcon Sensor software is designed to enhance cybersecurity by updating threat defenses. However, a faulty code in the recent update led to widespread crashes of Windows systems, known as the BSOD. // The support from Microsoft(fixed): 🛠️ https://lnkd.in/gDD3-EdG Ref: 🔗https://lnkd.in/gNpADvRN 🔗https://lnkd.in/gGAXYKea 🔗 https://lnkd.in/giR8RRiH #microsoft #crowdstrike #globalitoutage #2024 #BSOD #falconsensor #ms365 #azure #aws #cisa #cybersecurity #flights #healthcare #windows #resolution #restore

#Thankyou #Microsoft, always professionalism and transparency transpire, great blog post providing details on they what, why happened with the #CrowdStrike outage recently experienced by many companies Worldwide, worth read it #MicrosoftPartner Synergy Advisors LLC Synergy Advisors LLC - USA

Wise words. Microsoft Windows success is due to it’s openness to third party integration. Finding ways to minimise the security risks that this approach brings is an art which is always in motion.

"In this blog post, we examine the recent CrowdStrike outage and provide a technical overview of the root cause. We also explain why security products use kernel-mode drivers today and the safety measures Windows provides for third-party solutions. In addition, we share how customers and security vendors can better leverage the integrated security capabilities of Windows" #Windows #security

I'm glad these changes are being made - Microsoft is now making Windows Recall an opt-in feature, will encrypt its search index database, and will require Windows Hello authentication / proof of presence to view the resulting timeline. So much angst could have been avoided if this had been the plan all along, as seems so obvious it should have been. But it's great to see the changes. More details available here: https://lnkd.in/difKRx9d

A great memory analysis (also called memory forensics by non system developers) by David Weston with detailed questions and answers on the CrowdStrike kernel incident. This post really shows how powerful knowing how to use WinDbg is and a great reminder of the top key anti-malware features that are already part of Windows such as VBS and HVCI.

My new blog - featuring: a technical overview of the CrowdStrike incident, why security products use kernel mode, and what this means for the future of Windows. Shout outs to my Microsoft and non-Microsoft friends who gave me input and technical editing, appreciate you!

The detailed forensics report….

Microsoft have published how they’re going to help prevent the next ‘CrowdStrike incident’, and they have the balance just right! Writing code is hard, and when you’re operating at a low level (inside the gizzards of an OS), it’s dangerous. I spent years whilst at Microsoft teaching developers how to use Windows safely. David Weston has written an excellent piece on the capabilities within Windows, which if used correctly, and combined with good development practices can all but eliminate the risks with Kernel level integrations. I love the blended approach to this which Microsoft are taking, not locking people out, but supporting their vendors and leaning in, helping with advice, guidance and building features which will allow vendors to do what they need to do even more safely. Closing the ecosystem down, would not work, embracing it and leaning in will. Good work here Microsoft, I’m sure there were many knee jerk reactions which could have been taken, this is the right balance. #security #crowdstrike #dev