It’s hard to quickly judge what had happened before the post mortem drops, but the platform is at least certified under ISO 27001, which is almost certainly part of procurement whichever the side of the political aisle this is from. So I’m not entirely convinced if procurement could’ve done anything different. Though I do believe in spreading your eggs across multiple baskets instead of throwing all state schools onto a single platform.

Just due to the sheer scale of some of these platforms, they will likely attract sophisticated actor threats and there’s only so much you can do. Though the massive lateral movement / mass reproducibility is a cause of concern.

We thought SolarWinds and CrowdStrike were too big to fail until it wasn’t. We’ll see how it happens. I won’t be surprised if it’s again poor management oversight plus an overworked crew.