Inc., a leader in cloud-delivered endpoint protection, today
announced CrowdStrike Falcon is breaking new ground in providing
continuous monitoring that extends to the firmware level.
Modern security tools have focused on detecting attacks at the operating
system (OS) level and above, but provide little visibility into lower
levels of the modern computing platform. Attackers looking to maintain
stealth and persistence have targeted the BIOS to infect it with
malicious code that is difficult to detect and can persist despite
reboots and reinstallation of the operating system. These malicious
firmware updates can be delivered via standard intrusion techniques,
such as spear-phishing, or come pre-installed on a machine via attacks
on the supply chain, making these threat vectors especially difficult to
detect and mitigate. As supply chain attacks from nation-states and
other cybercriminals persist in plaguing organizations and government
agencies, continuous monitoring and enhanced detection below the
OS-level is necessary for improved IT hygiene.
Today, most security products remain blind to attacks that attempt to
leverage BIOS firmware to infiltrate endpoints, leaving organizations
vulnerable to compromise. CrowdStrike is now changing this paradigm.
Falcon will be the first endpoint protection platform to provide
visibility into these threats, enabling organizations to thwart BIOS
attacks while continuously monitoring endpoints.
Falcon collects details on BIOS images and configuration, and delivers
enterprise-wide firmware visibility via the cloud-native Falcon Platform
console. In addition, through an integration with Dell SafeBIOS,
CrowdStrike enables enhanced detection for BIOS/firmware based threats
on Dell systems. CrowdStrike Falcon improves IT hygiene through
visibility over the assets, applications, and accounts being used in an
organization’s environment, improving overall security posture and
helping businesses take a more proactive stance to security.
“Today’s persistent nation-state actors have already begun migrating to
BIOS attacks as their next preferred environment for persistence and
malicious control of systems. With security researchers and companies
around the world showcasing various attacks against Intel Boot Guard,
Secure Boot, Intel CSME, AMD PSP and other core platform security
technologies, it’s only a matter of time until such techniques become
commoditized by an even wider spectrum of attackers,” said Alex Ionescu,
vice president of EDR strategy at CrowdStrike. “As a leading
cybersecurity company at the forefront of security research, CrowdStrike
remains dedicated to providing our customers both firmware and
hardware-level visibility into these vulnerabilities and attacks even
before they have a chance to take off – and perhaps to even discover
dormant threats that had so far been unseen.”
Furthermore, due to its strong belief in educating the community at
large about these threats, CrowdStrike is planning on releasing the
results of its research, as well as the unique technology it uses to
capture firmware data, at future cybersecurity conferences around the
For additional information on this announcement, please visit the CrowdStrike
website for a blog from Alex Ionescu, vice president of EDR strategy.
CrowdStrike is a leader in cloud-delivered endpoint protection.
Leveraging artificial intelligence (AI), the CrowdStrike Falcon®
platform offers instant visibility and protection across the enterprise
and prevents attacks on endpoints on or off the network. CrowdStrike
Falcon deploys in minutes to deliver real-time protection and actionable
intelligence from Day One. It seamlessly unifies next-generation AV with
best-in-class endpoint detection and response, backed by 24/7 managed
hunting. Its cloud infrastructure and single-agent architecture take
away complexity and add scalability, manageability, and speed.
CrowdStrike Falcon protects customers against cyberattacks, using
sophisticated signatureless AI and Indicator-of-Attack (IoA) based
threat prevention to stop known and unknown threats in real time.
Powered by the CrowdStrike Threat Graph™, Falcon correlates over one
trillion endpoint-related events a week in real time from across the
globe to prevent and detect threats.
There’s much more to the story of how Falcon has redefined endpoint
protection but there’s only one thing to remember about CrowdStrike: We
Qualifying organizations can gain full access to Falcon Prevent™ by
starting a free
Learn more: https://www.crowdstrike.com/
© 2019 CrowdStrike, Inc. All rights reserved. CrowdStrike®,
CrowdStrike Falcon®, CrowdStrike Threat Graph®,
CrowdStrike Falcon Prevent™, Falcon Prevent™, CrowdStrike Falcon
Insight™, Falcon Insight™, CrowdStrike Falcon Discover™, Falcon
Discover™, Falcon X™, CrowdStrike Falcon DNS™, Falcon DNS™, CrowdStrike
Falcon OverWatch™, Falcon OverWatch™, CrowdStrike Falcon Spotlight™ and
Falcon Spotlight™ are among the trademarks of CrowdStrike, Inc. Other
brands may be third-party trademarks.