Worth the read, but I take issue with the article's assertion:
"It’s pretty neat, and Crowdstrike’s Falcon has been instrumental in blunting the efforts of cyber-meanies for over a decade… but to do what it needs to get done, it requires deeper/more privileged access to the operating system than most programs would need, so when something does go wrong, boy can it go wrong!"
Whether you worship at the altar of "least privilege," "Zero Trust," or elsewhere, you should cringe at this statement. The core problem is that Crowdstrike tries to make chicken salad out of someone else's chicken poop and to do that, yes, it needs kernel-type access. This is the model that infests corporate IT. Rather than starting with secure systems, configured securely, and used in a secure manner, we ignore those things and purchase "magic bullet" software meant to compensate. Sometimes that magic bullet is really good, but we end up spending a lot of money and building a massive single points of failure because we are not doing the necessary work at the purchasing and provisioning stage. Failure is not only an option, it is inevitable. Yet with every passing year, we heighten the stakes of failure. Crowdstrike today, AI tomorrow, etc. We either refuse to follow what we already know, or, more likely, we fail to communicate that knowledge to decision-makers.
