Cybersecurity Industry's Rapid Response and Challenges

CrowdStrike's support advice to reboot up to 15 times is just one of many recovery procedures in the cybersecurity industry.

### Cybersecurity Expert Steve Grobman Discusses the SolarWinds Hack
* 🔒  McAfee's Steve Grobman, a cybersecurity expert, is focusing on helping customers **navigate the aftermath of the SolarWinds hack**.
* 📧  CrowdStrike's support email advising customers to "**Reboot up to 15 times**" is just one of many potential recovery procedures, reflecting the **complexity of the situation**.
* 🛡️  Grobman emphasizes the **continuous evolution of cybersecurity defense**, with bad actors constantly **innovating new attacks**.
* 🚗  He compares the cybersecurity industry to auto safety, acknowledging that incidents will occur but stressing the importance of **ongoing improvements**.
* 🤔  When asked how things could have been done differently, Grobman suggests a **phased rollout of security updates** as a best practice.
* 📞  McAfee is also dealing with scammers trying to exploit the situation, highlighting the need for **consumer education in a complex digital world**.

CrowdStrike, founded in 2012 by alumni, essentially as the current form of your business, has a complicated history of its own. To start with, has anyone from CrowdStrike phoned you or asked you guys for help or advice on what's going on? Yeah, you know, I know the CrowdStrike team well. The cybersecurity industry is a close-knit bunch. They're running the response on this. You know, we're really focused on making sure that our customers are well-informed. You know, McAfee is now a pure-play consumer company where we're protecting consumers, and we're making sure that they understand that even though their devices are protected by McAfee, if they're using services from organizations or businesses that depend on CrowdStrike, and we're impacted by this event, that they might see things like banks or transportation having degraded service. And that's really where we're trying to

play a role here is to help our
customers, our consumers, the industry navigate this.
Steve, a few people in the technology industry shared with me an email that
CrowdStrike support sent them, and I'm summarizing a paraphrasing, but the
email basically says, Reboot up to 15 times, and that should do the trick.
What do you make of that? You know, when there are issues
putting together procedures to get organizations back in business, and you
can have many different forms. I think one of the things that I'd
caution is my understanding in this particular case, there are a wide range
of situations that an organization might be in with a wide range of recovery
procedures. The one that you're outlining is
certainly plausible, that is one of the scenarios.
But what I would say is, you know, we as an industry will learn from this.
We always do. If I reflect back to WannaCry back in
2017, you know, coming out of that, we

changed the way that we secured our
networks. We changed the way that we secured our environments, and we learned,
you know, back into the nineties when we had some of the big worms. We learned.
So it's going to happen again. I really stress that cybersecurity
defense is a very different industry than most other technology in that bad
actors are innovating every single day, creating new attacks every single day,
and making it such that in order to defend environments, whether it's McAfee
defending consumers or CrowdStrike defending enterprises, requires a very
rapid deployment of new technology to stay one step ahead of those bad actors.
So, you know, while we're going to absolutely learn from this, I do think
it's important that part of it is due to the nature of the business.
So basically, get used to it is kind of what you're telling us, Steve.
And I'm wondering whether this, as Clarissa just told us of sales, will say
this is inevitable.

How often is this going to happen to us?
Yeah, I don't know that I would say it's inevitable.
I do think that there are some unique characteristics.
I put it this way. If we're going to drive cars at 70 miles per hour on
roads, we know that people are going to get injured.
And that doesn't mean that we shouldn't focus on auto safety.
I think we're in the exact same world here.
There are technologies like A.I. that bad actors are using to create more
and more lethal attacks. And the cyber defense industry is going
to rapidly be releasing new capabilities to mitigate those.
Part of that means we're moving very quickly, and we need to learn how to do
that with the minimal risk possible of introducing technology defects that
cause the issue that we saw, like that, like that, that we saw today.
But but I'd be careful to predict that this is inevitable.
Okay, then how could we have done this

differently?
What do you think? Will the learnings ultimately be about
how with speed you can update on better security without taking down global
industry? So even if you're moving fast, it
doesn't mean that you need to do everything all at once.
So when organizations roll out protection, doing it in a phased
fashion, I know that that's generally the best known practice.
But but some of the underlying details of exactly how that's done, those are
things that the industry is going to learn, Polish, you know, create some new
procedures. I do think it's important that we don't
overreact to this, where if if we start putting too many controls on the ability
to rapidly mitigate defenses and attacks, we could be in a
much worse situation. So on a positive side, we understand
this issue very well. We understand the guidance that
organizations can have to get back in business.
And we also understand even some of the

residual impacts.
You know, one of the things that McAfee is seeing is scammers are taking
advantage of the news cycle to try to scam consumers.
We're getting calls into our help center where we're getting reports that our
customers are getting reports from people pretending to be their bank,
trying to trick them into giving them a password or other sensitive data.
So it's even those angles that we need to educate the world that in in a
complex digital world, we really need to be on our guard across the spectrum of
enterprise and consumer.

McAfee EVP: Our Industry Will Learn From This Outage

Welcome to the Bloomberg Technology YouTube channel. Subscribe for original series and mini-docs on game-changing technologies, profiles on innovators, live conversations with experts, and breaking technology news & analysis from Bloomberg TV.

Bloomberg Technology

CrowdStrike, founded in 2012, is currently running the response on a certain event in the cybersecurity industry.

McAfee, now a consumer company, is focused on helping its customers navigate the impact of this event, especially if they rely on CrowdStrike.

CrowdStrike support's email advising to reboot up to 15 times has been shared, but different recovery procedures may be needed for the wide range of situations in this event, with the industry expected to learn from it, similar to the WannaCry incident in 2017.

The Ever-Changing Nature of Cybersecurity Defense

Cybersecurity defense is constantly evolving due to the innovative tactics of bad actors, requiring rapid deployment of new technology.

The industry's nature makes it essential to stay ahead of cyber threats, similar to the constant development of auto safety measures.

Despite the rapid pace of change, it's not certain that cyber attacks are inevitable, emphasizing the need for proactive defense measures.

Efficiently Updating Global Security Measures

Updating security measures with speed is crucial for the global industry, but it can be done in a phased fashion.

Overreacting and putting too many controls in place could lead to a worse situation, so it's important to find a balance.

The focus is on learning new procedures and guidance to rapidly improve defenses and get businesses back in operation.

Scammers Exploiting the News Cycle for Fraud

McAfee is observing scammers using current news to target consumers and posing as their banks to obtain sensitive information.

The company is receiving reports of customers being tricked into giving away passwords and other confidential data.

It is crucial to educate both enterprises and consumers about staying vigilant in the digital world to combat these tactics.