Video: What Happened At The CrowdStrike Congressional Hearing

just over two months ago many essential functions came to a grinding halt This Global it outage regarded as the largest in history was not due to a malicious Cyber attack but instead a faulty software update pushed out by crowd strike flights were grounded surgeries were cancelled 911 systems were disrupted and stores had to close at the end of the day even the best security product on the market won't do any good if it bricks a customer's operating system although I'd hop to hear from Crown strikes CEO directly I'm grateful for Mr Myers presence a crowd strike our vision is to protect good people from bad things despite our strong track record I'm here today in part because just over two months ago on July 19th we let our customers down Crow strike was in the process of updating our customers on a new threat but released a Content configuration update for the windows sensor that did not work as expected this resulted in Microsoft system crashes for a number of our users on behalf of everyone at crowd strike I want to apologize does we're deeply sorry and we are determined to prevent this from ever happening again I want to underscore that this was not a Cyber attack the incident was caused by a crowdstrike rapid response content update that was focused on addressing new threats crowd strike began working with customers and partners to bring systems online as quickly as possible initially through manual remediation crowd strike then introduced automated techniques to accelerate remediation who made the decision to Launch launched the update did did AI do that AI was not responsible for making any decision in that process it is part of a standard process we release 10 to 12 of these updates content updates every single day the updates were distributed to all customers in one uh session we've since Revis that Mr Myers crowdstrike released its content configuration update into the kernel which is the core part of the operating system where an error will crash the entire system rather than just one single application some competitors of yours have claimed that this kind of Kernel access is dangerous and that a better practice is to deploy such updates directly to the user mode where the impacts would only affect an application can you explain why crowd strike issues updates to the kernel all operating systems have a kernel the kernel is respons responsible for interfacing with all the hardware associated with that operating system or that computer crowd strike is one of the many vendors out there that uses uh the windows kernel architecture which is an open kernel architecture this is a decision that was made by Microsoft to enable the Microsoft operating system to support a vast array of different types of hardware and different systems the kernel driver is a key component of every security product that I could think of to try to secure the operating system without kernel access would be very difficult so is it your assessment then that it's not possible really in in realistic terms to do it outside of the kernel with the current kernel architecture this is the most effective way to get the visibility and to prevent an adversary from tampering with security tools so it's the most effective way but it's not the only way possible it is certainly the industry standard what other modifications has crowd strike made or changes to your internal practices to avert future similar incidents we've uh come up with an entire new mechanism by which we distribute the content updates and making sure that customers have in their control the ability to select when they receive those updates is what will prevent that from happening I'm still trying to figure out exactly how this thing got launched did it test positive and we launched it or did was there did it did it fail and we launched it accidentally yes it tested uh as clean or or good and that's why it was allowed to roll out as we unpack this where exactly did it fail the content validator allowed the content configuration to go out to the sensor and the sensor was not able to find the rule that it was looking for causing the issue if you think about a chess board trying to move a chest piece to someplace where there's no Square that's effectively what happened inside the sensor this was a kind of a perfect storm of issues that resulted in the sensor failure what is the response mechanism in place worst case scenario this happens again this would be detected within crowd strike before it ever made it to the early do now we're doing as it's a code yes okay how does providing customers with control over rapid response content deployments improve overall security so this gives them complete control over where updates go and when they get them although networks are becoming increasingly interconnected government networks should be isolated from commercial ones why were federal agencies impacted by this outage the updates went to Microsoft Windows operating system sensors that crowd strike had deployed so that would have impacted any system that was running Microsoft operating system with that particular version of Crouch dke Falcon that was online during the time period that the channel file was distributed is it just unlucky that this update was a for a Microsoft operating system a lot of businesses rely on Microsoft for their operating systems and I think that's where the number of of uh impacted systems from this update came from my understanding is that Apple's restrictions on kernel access might have prevented a similar incident from taking place on Mac systems do you view Apple's restrictions on kernel access to be beneficial or do they negatively impact the effectiveness of security software like yours we have security products that work on Windows systems Apple systems and Linux systems as well they have pros and cons for each and we leverage everything in order to have the most effective security solution for those platforms there's different features of each kernel would you agree though that if something crashes in the app space it's limited in its effect to the app whereas if something crashes with the kernel in Microsoft it could crash the whole system yes

This transcript was generated automatically from the video's captions and may contain errors.