CrowdStrike Falcon® Becomes the First Endpoint Security Platform to Integrate Firmware Attack Detection Capability
Millions of endpoints protected by CrowdStrike Falcon® around the world will now benefit from continuous monitoring for firmware attacks
Sunnyvale, CA – May 1, 2019 – CrowdStrike®, Inc., a leader in cloud-delivered endpoint protection, today announced CrowdStrike Falcon® is breaking new ground in providing continuous monitoring that extends to the firmware level.
Modern security tools have focused on detecting attacks at the operating system (OS) level and above, but provide little visibility into lower levels of the modern computing platform. Attackers looking to maintain stealth and persistence have targeted the BIOS to infect it with malicious code that is difficult to detect and can persist despite reboots and reinstallation of the operating system. These malicious firmware updates can be delivered via standard intrusion techniques, such as spear-phishing, or come pre-installed on a machine via attacks on the supply chain, making these threat vectors especially difficult to detect and mitigate. As supply chain attacks from nation-states and other cybercriminals persist in plaguing organizations and government agencies, continuous monitoring and enhanced detection below the OS-level is necessary for improved IT hygiene.
Today, most security products remain blind to attacks that attempt to leverage BIOS firmware to infiltrate endpoints, leaving organizations vulnerable to compromise. CrowdStrike is now changing this paradigm. Falcon will be the first endpoint protection platform to provide visibility into these threats, enabling organizations to thwart BIOS attacks while continuously monitoring endpoints.
Falcon collects details on BIOS images and configuration, and delivers enterprise-wide firmware visibility via the cloud-native Falcon Platform console. In addition, through an integration with Dell SafeBIOS, CrowdStrike enables enhanced detection for BIOS/firmware based threats on Dell systems. CrowdStrike Falcon® improves IT hygiene through visibility over the assets, applications, and accounts being used in an organization’s environment, improving overall security posture and helping businesses take a more proactive stance to security.
“Today’s persistent nation-state actors have already begun migrating to BIOS attacks as their next preferred environment for persistence and malicious control of systems. With security researchers and companies around the world showcasing various attacks against Intel Boot Guard, Secure Boot, Intel CSME, AMD PSP and other core platform security technologies, it’s only a matter of time until such techniques become commoditized by an even wider spectrum of attackers,” said Alex Ionescu, vice president of EDR strategy at CrowdStrike. “As a leading cybersecurity company at the forefront of security research, CrowdStrike remains dedicated to providing our customers both firmware and hardware-level visibility into these vulnerabilities and attacks even before they have a chance to take off – and perhaps to even discover dormant threats that had so far been unseen.”
Furthermore, due to its strong belief in educating the community at large about these threats, CrowdStrike is planning on releasing the results of its research, as well as the unique technology it uses to capture firmware data, at future cybersecurity conferences around the world.
For additional information on this announcement, please visit the CrowdStrike website for a blog from Alex Ionescu, vice president of EDR strategy.
About CrowdStrike®
CrowdStrike is a leader in cloud-delivered endpoint protection. Leveraging artificial intelligence (AI), the CrowdStrike Falcon® platform offers instant visibility and protection across the enterprise and prevents attacks on endpoints on or off the network. CrowdStrike Falcon® deploys in minutes to deliver real-time protection and actionable intelligence from Day One. It seamlessly unifies next-generation AV with best-in-class endpoint detection and response, backed by 24/7 managed hunting. Its cloud infrastructure and single-agent architecture take away complexity and add scalability, manageability, and speed.
CrowdStrike Falcon® protects customers against cyberattacks, using sophisticated signatureless AI and Indicator-of-Attack (IoA) based threat prevention to stop known and unknown threats in real time. Powered by the CrowdStrike Threat Graph™, Falcon correlates over one trillion endpoint-related events a week in real time from across the globe to prevent and detect threats.
There’s much more to the story of how Falcon has redefined endpoint protection but there’s only one thing to remember about CrowdStrike: We stop breaches.
Qualifying organizations can gain full access to Falcon Prevent™ by starting a free trial.
Learn more: https://www.crowdstrike.com/
© 2019 CrowdStrike, Inc. All rights reserved. CrowdStrike®, CrowdStrike Falcon®®, CrowdStrike Threat Graph®, CrowdStrike Falcon® Prevent™, Falcon Prevent™, CrowdStrike Falcon® Insight™, Falcon Insight™, CrowdStrike Falcon® Discover™, Falcon Discover™, CROWDSTRIKE FALCON® INTELLIGENCE™, CrowdStrike Falcon® DNS™, Falcon DNS™, CrowdStrike Falcon® OverWatch™, Falcon OverWatch™, CrowdStrike Falcon® Spotlight™ and Falcon Spotlight™ are among the trademarks of CrowdStrike, Inc. Other brands may be third-party trademarks.
