Anatomy of an Incident
summary
CrowdStrike’s Falcon update ships a bad config that overflows a C++ driver and blue‑screens Windows, causing a roughly 1.5 hour outage across airlines, rail, Sky News and others. Free Market FX activates a Slack incident workflow, spins an incident channel, uses a prebuilt spreadsheet of critical/secondary systems (DORA mapping) and phone contacts, and sends customer templates by 9:15 after discovery at 07:40. Third parties show mixed recovery—Octopus rebuilds VMs quickly while a banking partner degraded—so rehearsal, named contacts, and an isolation plan prove decisive.
AI-written summary · about
chapters (13)
- 0:00Incident management intro
- 1:59Defining an incident
- 3:22Importance of incident plan
- 6:10Rehearsing incident response
- 14:40High-profile cyberattacks impact
- 17:10CrowdStrike incident timeline
- 21:25Supplier-affected incidents handling
- 23:12Real-time CrowdStrike response
- 28:58Critical systems prioritization
- 35:50Customer communications during incidents
- 41:05Resolution and post-analysis
- 44:37Key takeaways and best practices
- 46:44Q&A
related talks
48mAnatomy of an Incident
51mReal World Stories of Incident Response and Threat Intelligence
58mOutpacing threats w/ CrowdStrike, Anthropic Claude & Amazon Bedrock
43mClouds in the forecast: CrowdStrike cloud risk report
22mNavigating a cybersecurity event in real time
31mHard Problems We Handle in Incidents but Aren't Recognized
01h 33mInnovate with Resilience!
49mEnhance container security with CrowdStrike Falcon Cloud Security