A lot of companies install it for compliance checkboxing.
Apart from fjordbasa’s caveat RE “ubiquity” above, this is probably the most succinct answer 😐
It kinda is top of its class in endpoint detection and response software. A lot of cyber security insurance policies will demand you have some kind of EDR to be covered and seeing as Crowdstrike is one of the biggest names they get a lot of buyin from institutions and governments.
Or in other words, everyone else is complete shit.
No, but yes.
Crowdstrike was one of the first companies doing EDR, and have a first mover advantage they have held onto. Lots of other companies offer good solutions now, but crowdstrike is still considered the gold standard, and they have worked hard to become the “default” for their market segment.
Also thanks to ebpf it’s now very easy to implement EDR without a full blown rootkit in Linux and anyone on the bleeding edge is moving away from this kind of solution
What CrowdStrike is actually selling, is someone who actually looks at the system logs and who pushes a button when something pops up. Roughly.
There are better solutions on the market. Unfortunately CrowdStrike has the more aggressive sales team.
For those wondering, I’m referring to *nix based solutions like SElinux, appArmor, iptables, nftables, cgroups, … But you need to monitor your logs if you want to take appropriate action.
No, it’s not a binary thing. There are other EDR products but they are the largest.
Crowdstrike marketed to c-suites better than the others.
It’s not so much that it’s ubiquitous so much as the customers that DID use it were very large and their going down was very noticeable.
Basically, drivers can launch code all the way up to ring 0, the highest level a code can access to. This mean it runs its code with the same priviledges as the kernel itself. The anti-malware solution CrowdStrike makes use of this access to determine what could be going wrong, and deploy solutions accordingly.
If a code running in that level crashes, Windows will rightfully assume there’s something really fucked up is going on, and give out a BSOD.
When an operating system allows a single misbehaving program to take down the whole computer and leave it unbootable. I thought we left that behind with Windows 95.
Drivers usually run in kernel space, where a crash can bring the whole system down. This is not exclusive to Windows
That has been a thing forever. I doubt it will ever go away.
https://youtu.be/4yDm6xNeYas?si=0VzBxIuPEHC4SMaa
This fireship video is a good, short explanation.
BTW, if Windows had been an immutable OS the case would not have been so dire.
Probably it runs with privileges of the OS level, what applications should not do. The second problem is monoculture. To run the same software of a single company an all machines is easy, but…
It literally has to run at that level to do it’s job.
Companies wouldn’t mind having an OS level code run on their PCs if its meant to help secure their computers. A malware infecting their computers could result in way more damages after all.
I’m not so sure what is worse. I wish we wouldn’t reimplement statist practices in computers, as it often not goes well in our physical world, and invent more resources into OS/network security, compartmentalization and privilege separation. But yeah, the reality is it’s easier to put a god-like “trusted” agent in a system. Well, the police need have guns, read all private chats, place security cameras with face recognition everywhere… to do their jobs. Otherwise terrorist attacks or whatever could result in way more damages after all. The same story every time.
