Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Organizations today battle an ever-evolving cyber threat landscape, yet many security teams struggle to keep pace due to a critical skills gap and limited access to high-quality training. As teams are expected to do more with fewer resources, cybersecurity education is essential. At CrowdStrike, we’re committed to breaking down these barriers.

As a part of our ongoing work to secure cloud computing infrastructure, we delved into the inner workings of some popular Kubernetes add-ons. Our first subject of research was Istio, a popular service mesh add-on. Istio is an open-source service mesh for Kubernetes that manages communication between microservices. It provides traffic management, security, and observability features without requiring code changes.

Early in the cyberattack kill chain, reconnaissance enables attackers to assemble critical network information to plan a tailored attack strategy. In this phase, adversaries aim to map out networks and their users, and locate system vulnerabilities, without setting off alarms. Proactive monitoring and early detection of this activity can disrupt attackers in their tracks and lower the risk of a breach.

Each year, Data Protection Day marks an opportunity to assess the state of privacy and security in the midst of technological innovation. This year’s inflection point follows a robust dialogue on AI from last week’s World Economic Forum Annual Meeting in Davos. As CrowdStrike participated in these discussions, we emphasized the importance of leveraging AI to defend against ever-evolving cyber threats and protect the very data and workloads used to power AI.

In the 2024 SE Labs Enterprise Advanced Security (EDR) Ransomware Test, the CrowdStrike Falcon platform achieved a perfect score of 100% in detection, protection, and accuracy, earning the prestigious AAA Award for Advanced Security EDR Protection for the third time in a row. The Falcon platform detected and blocked 100% of ransomware files and protected endpoints across multiple stages during all simulated ransomware attacks.

Kubernetes has become the cornerstone of modern DevOps, empowering teams to quickly deploy, manage, and scale containerized applications. However, many struggle to navigate Kubernetes' complexity while operating across hybrid and multi-cloud environments. Red Hat OpenShift builds on Kubernetes by providing a consistent, enterprise-grade platform that abstracts the intricacies of the underlying infrastructure. It’s trusted by customers across industries and around the globe.

The process of crafting new malware detection features is usually time-consuming and requires extensive domain knowledge outside the expertise of many machine learning practitioners. These factors make it especially difficult to keep up with a constantly evolving threat landscape. To mitigate these challenges, the CrowdStrike Data Science team explored the use of deep learning to automatically generate features for novel malware families.

As more organizations move to software-as-a-service (SaaS), remote access to applications and data is concentrated among a smaller set of identity providers. These identity providers, such as Okta, must absorb growing volumes of credential-based attacks. Okta consistently reports high volumes of credential stuffing, password spraying and phishing attacks against its customers. Additionally, red teams are discovering new patterns of abuse relevant to Okta products.

CrowdStrike recently announced FedRAMP authorization for CrowdStrike Falcon Data Protection, now available to government entities requiring Federal Risk and Authorization Management Program (FedRAMP) Moderate authorization, enabling them to secure assets through the CrowdStrike Falcon Platform in GovCloud. This advancement supports compliance efforts and adoption of Zero Trust frameworks across government environments.

Identity-based attacks are surging across today’s threat landscape as adversaries target identities in on-premises, cloud and SaaS applications. They aren’t breaking in — they’re logging in. Organizations must respond to these threats in real time to stop breaches, but traditional security approaches consisting of siloed tools often create visibility gaps and hinder efficiency.