Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

CrowdStrike Outage - How did Quality Assurance Fail?

27 Jul 2024 · 1 min

Watch on YouTube

0:59

In this segment of the YouTube video, the speaker critiques CrowdStrike's quality assurance practices that led to a major outage affecting Windows clients. He explains that the root cause was the insufficient testing of "template instances," which are low‑level data structures that direct sensor behavior. The content validator within CrowdStrike's content configuration system failed to detect a flawed template instance, and the client‑side content interpreter—supposed to gracefully handle exceptions—did not do so, resulting in Windows clients being disabled. The speaker argues that CrowdStrike must rigorously test every piece of code sent to client machines to prevent such failures.

Chapters

—what they don't test rigorously before sending out, according to the PR, are the template instances, which represent the low-level data that instructs what the sensor should be doing. So in this game of CrowdStrike Clue, the culprit was the content validator as part of the content configuration system, which failed to adequately test the flawed template instance that killed the Windows clients on the internet. It appears that CrowdStrike was okay with the lax testing because they believed their content interpreter, which resides on the client system as part of their software, would, and I quote, gracefully handle exceptions from potentially problematic content. They were wrong. CrowdStrike should be properly testing every piece of code that is sent to client machines.