Adrian Johnson
TLDR: Global Computer Outage Is A Wakeup Call
Key Points:
- CrowdStrike pushed out an update to its Falcon scanning service, causing millions of computers worldwide to crash.
- The outage highlighted the interconnected nature of business operations and the need for cybersecurity regulation, governance, and insurance policy changes.
In a recent global computer outage caused by a Falcon update from cybersecurity vendor CrowdStrike, millions of computers crashed, leading to what has been deemed the largest IT outage in history. This incident will likely prompt changes in cybersecurity regulation, governance, and insurance policies, all spurred on by one of the good guys in the cybersecurity world.
The interconnected nature of business operations was starkly highlighted by the outage, affecting critical infrastructure sectors such as hospitals, banks, and government agencies. Even though CrowdStrike pulled back the update within 90 minutes, the effects persisted throughout the day, impacting companies that were not even CrowdStrike clients.
As a result of this outage, we can expect the following:
- Regulation: Legislators and regulators are likely to conduct investigations, call for notification of automatic updates, and demand quality assurance standards.
- Cyber Governance: Companies will focus on incident response and cyber risk management, involving boards and senior executives to ensure systems are resilient and incident response plans are robust.
- Business Interruption Claims and Insurance Coverage Changes: Organizations affected by the outage may seek reimbursement from CrowdStrike, leading to insurance carriers reviewing policies and potentially making changes to protect against third-party liability claims in the future.
It is crucial to build on the lessons learned from the CrowdStrike outage, conducting post-mortem analyses and ensuring collaboration across industry sectors for improved response to cyber incidents. By taking these steps, the cybersecurity community can turn this incident into a beneficial learning experience rather than just another entry on the list of cyber events.
