<story><title>CrowdStrike Official RCA is now out [pdf]</title><url>https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf</url></story><parent_chain></parent_chain><comment><author>Ukv</author><text>&amp;gt; In summary, it was the confluence of these issues that resulted in a system crash: [...] the lack of a specific test for non-wildcard matching criteria in the 21st field.&lt;p&gt;I feel they focus a lot on their content validator lacking a check to catch this specific error (probably since that sounds like a more understandable oversight) when the more glaring issue is that they didn&amp;#x27;t try actually running this template instance on even a single machine, which would&amp;#x27;ve instantly revealed the issue.&lt;p&gt;Even for amateur software with no unit&amp;#x2F;integration tests, the developer will still have typically ran it on their own machine to see it working. Here CrowdStrike seem to have been flying blind, just praying new template instances work if they pass the validation checks.&lt;p&gt;They do at least promise to &amp;quot;ensure that every new Template Instance is tested&amp;quot; further down.</text></comment>
<story><title>CrowdStrike Official RCA is now out [pdf]</title><url>https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf</url></story><parent_chain></parent_chain><comment><author>teyc</author><text>It doesn&amp;#x27;t even cover the barest of organisational root cause. How are they planning to do defense in depth and prevent any internal threat actor from wedging every machine in the world?</text></comment>