CrowdStrike Falcon Frequently Asked Questions (FAQs)

CrowdStrike Falcon is a new endpoint detection and response (EDR) system that protects computing devices from viruses, malware, and ever-evolving new security threats, such as ransomware.  CrowdStrike Falcon replaces Cylance offering around-the-clock security monitoring and response.

SUNY is adopting CrowdStrike as its preferred endpoint detection and response system for all SUNY campuses.  In addition to it's advanced threat detection, CrowdStrike offers security monitoring and response at all hours of the day, seven days a week (24x7). 

In an age where security threats affect many college institutions, 24-hour, 7-days-a-week monitoring has become essential. CrowdStrike gives SUNY Oswego this added monitoring to help reduce the impact of security threats that could drastically disrupt the university's business. 

The migration will take place in two phases.  One phase will install CrowdStrike Falcon in a "learning" mode on devices.  This phase started July 8. The second phase will disable Cylance and fully activate CrowdStrike Falcon. Due to the CrowdStrike global outage, this phase was temporarily postponed until devices affected by the outage had been repaired. With all devices repaired, Phase 2 will start Aug 12. More information is on the CrowdStrike Falcon service page.

During Phase 1 when the application is installed, there will be no noticeable impact to computers and a reboot will not be required. On Mac devices, there will be a new application listed under your "Apps" called "Falcon." On PC devices, there will be a new icon that shows in the system tray (lower right corner) called "CrowdStrike Falcon Sensor."  

During Phase 2, when Cylance is disabled and CrowdStrike Falcon activated, there should be no noticeable notifications or service impacts during this change.

Campus Technology Services (CTS) will push the software remotely to managed Macs and PCs.  Please see the next question if you are unsure if your computer is managed.

• For Macs, the installation will take place whether the device is physically on-campus or off. 
• For PCs, the installation will take place the next time the device is connected to the campus network (either physically on-campus or via the VPN).
• New computers will have the software already installed.

All college-owned computers need to be managed to ensure the best security for SUNY Oswego.  Managing devices allows CTS to quickly react to any type of security threat, to remotely update software, and to add software for new digital initiatives.  It is a requirement that college-owned devices be managed.

For Macs:

1. Go to the Applications folder
2. Look for an app called "CTS App Store." If that is there, your device is managed.
   

For PCs:

1. Click on the Windows start icon 
2. Look for an app called "Software Center."  If that is there, your device is managed.
   

If your device is not managed or you are unsure if your device is managed, please contact CTS.   

For Phase 1 and 2, there is nothing that is needed on your part.  Macs should receive the update regardless of whether the device is on campus or off.  PCs will receive the software the next time they connect to the campus network (either physically on-campus or via the VPN).

On Macs, go to your Apps and look for an app called "Falcon." The icon for it will be a red background with a white colored Falcon bird.  It will look similar to the following.

On PCs, there will be a new icon in the system tray (lower right corner) with a white background and picture of a black colored falcon bird.  Hovering over that icon will show "CrowdStrike Falcon Sensor: Running." It looks similar to the following:

Yes, the installation is required for all college-owned devices.  In today's world, everyone has a shared responsibility in protecting university data whether that's personally identifiable data, research data, or data on shared systems.  CrowdStrike Falcon is a necessary tool in our security toolkit to help protect that data and help prevent any business disruption.