CrowdStrike Implements Changes Following July Outage Incident

CrowdStrike is set to implement significant process changes in the wake of a July incident that resulted in widespread outages, affecting thousands of critical systems globally. Adam Meyers, the company’s senior vice president, informed a House subcommittee on Tuesday that customers will now have the option to either receive updates promptly as early adopters or defer them for later installation.

This update comes after a faulty configuration update disabled over 8.5 million Windows devices, impacting various sectors including airlines, hospitals, and banks that rely on CrowdStrike’s Falcon endpoint protection. Meyers acknowledged that previous validators failed to detect the problematic update, which he clarified was not treated as code but rather as configuration information.

Following the incident on 19 July, CrowdStrike has revised its approach, now classifying content updates as code. This shift entails a more rigorous verification process, referred to as “dogfooding,” which includes extensive quality assurance before updates are internally tested and eventually rolled out to customers.

The subcommittee also raised concerns about CrowdStrike’s kernel-level access to Windows systems. Meyers defended this necessity, explaining that such access is essential for providing comprehensive security, allowing the software to interface effectively with the hardware and defend against potential threats.

In response to the outage, which has cost Fortune 500 companies an estimated $5.4 billion, CrowdStrike faces scrutiny from investors and legal threats from affected clients, including Delta Airlines, which reported losses exceeding $500 million. The company has yet to disclose plans for compensating businesses impacted by the incident, as questions about further investigations remain unanswered.