How has a CrowdStrike update impacted so many companies and services?

It all started with a software update.

Microsoft’s “Blue Screen of Death” disrupted government services and businesses across the country on Friday, paralyzing emergency call centers, banks, airlines and hospitals.

While Microsoft blamed a faulty software update from US cybersecurity company CrowdStrike for the serious IT outage, the incident drew attention to how large the market shares of both companies are in their respective sectors.

“If we keep using the same vendors, these things can be even more obvious when they happen,” says Dominic Sellitto, clinical assistant professor of management science and systems at the University at Buffalo School of Management in New York.

Why did CrowdStrike go down?

In a statement, CrowdStrike said the outage was caused by a defect in a content update of its Falcon cybersecurity software for Windows hosts.

Computers running Mac and Linux operating systems were not affected and CrowdStrike said the incident was not caused by a cyberattack.

When introducing new software, there is always the possibility of bugs or errors, but most of the time they are so small that the end user doesn’t notice them, says Tim Ehrenkaufer, assistant professor of aeronautical sciences at Embry-Riddle Aeronautical University in Florida.

The nation was certainly aware of the outage on Friday – the outage brought down everything from 911 calls to Starbucks’ mobile app.

“As companies around the world, as well as governments, agencies and institutions, rely on single technology platforms, such events are becoming increasingly painful,” said Sellitto of the University at Buffalo.

Market share of CrowdStrike and Microsoft

It is claimed that CrowdStrike is used by more than half of the Fortune 500 companies.

Microsoft Windows is now one of the most popular operating systems in the world, and the company provides an estimated 85 percent of the productivity software used by the federal government, according to testimony last month by Democratic Rep. Bennie Thompson of Mississippi before the House Homeland Security Committee.

“The problem we face is that the world is complex and interdependent, and the technology we use is global,” said Scott White, associate professor and director of the cybersecurity program and cyber academy at George Washington University in Washington, D.C. “We have become dependent on organizations like (Microsoft).”

CrowdStrike outage:Global technology failure affects airlines, banks, healthcare and public transport

Does Congress need to intervene?

Within hours of the outage, some lawmakers and cybersecurity experts were debating whether Congress — or the Biden administration and the Department of Homeland Security — needed to put in place further regulatory guardrails to ensure an outage of this magnitude does not happen again.

Paul Rosenzweig, a former assistant secretary of state for policy at DHS, said the best response to Friday’s outage would be to require businesses and governments to have redundant systems so they have a backup in case of system failures.

Requiring companies to do this themselves would be prohibitively expensive, Rosenzweig said, and few would do it. But it would be difficult for Congress or the Biden administration to require them to do so without doing the same thing within the government, which would be time-consuming and astronomically expensive.

“It’s an interesting question,” said Rosenzweig, founder of Red Branch Consulting PLLC, a homeland security and cybersecurity consulting firm. “The government can’t tell people to diversify if it doesn’t do it itself – and it’s the biggest, if not certainly one of the biggest (Microsoft) customers.”

However, Rosenzweig also warned that Friday’s blackout is likely to be repeated and may have even more serious consequences, so governments and the private sector must be prepared.

“They have to spend additional money” to build in better protection, including backups, he said. “If companies don’t do that, something like this will happen again, either accidentally like this time or through malicious acts.”

Other cybersecurity experts believe the system works as it is and that CrowdStrike bears full responsibility for the failure in a way that could not be improved by additional government intervention.

“This incident appears to be a serious failure of quality control, not a malicious act,” cybersecurity strategist and former FBI counterintelligence officer Eric O’Neill said of the paralysis on Friday. “While the damage is noted, regulations are unnecessary; the market will drive customers to other vendors or convince them to use CrowdStrike.”

However, O’Neill said better regulation of cybersecurity investments and adherence to best practices are critical because the U.S. government has “under-responded in this crucial area of critical infrastructure.”

“If the U.S. government has to bail out CrowdStrike – the company is too big to fail, in my opinion – then taxpayers will bear the burden,” O’Neill said.

“Critical infrastructure and international partners”

Over the past few years, DHS and its Cybersecurity and Infrastructure Security Agency have worked to build a network of public and private sector partnerships to better respond to such global incidents, believing that the government cannot handle it alone.

Educating the private sector and cybersecurity firms on what to do – and what not to do – is a critical part of that, whether the problem is a cyberattack or a faulty cybersecurity update, CISA Director Jen Easterly said in an interview with USA TODAY in 2022.

To that end, CISA said Friday it is aware of the widespread outage affecting Microsoft Windows hosts due to an issue with a recent CrowdStrike update and is working closely with CrowdStrike and federal, state, local, tribal and territorial partners, as well as critical infrastructure and international partners, to assess the impact and support remediation efforts.

CISA also warned its network of public and private partners that it had observed hackers and other “threat actors exploiting this incident for phishing and other malicious activities.”

What happens next for companies?

CrowdStrike and Microsoft business customers may look for alternative providers after the global outage, but that doesn’t address the core of the problem, said Javad Abed, a cybersecurity and data compromise expert and assistant professor at the Carey Business School at Johns Hopkins University in Baltimore.

“The CrowdStrike incident is a stark reminder that relying on a single cybersecurity tool, regardless of the vendor’s reputation, creates a dangerous single point of failure,” Abed said. “And implementing multiple layers with multiple vendors is critical to business continuity and protecting critical operations.”

This type of outage can happen to any vendor or company, Abed said, but it is largely preventable, and redundancy is one of the core principles of cybersecurity.

Related Posts

Man dies in construction accident in Paradise Valley

SLED is investigating Aiken Mayor Teddy Milner | Aiken area public safety and court news

Man from Minot threatens police and neighbors with gun