Cybersecurity lessons and best practice in the wake of the CrowdStrike outage

Less than two weeks after the massive CrowdStrike outage of 19 July affected Windows users the world over, the cybersecurity industry has drawn up a series of lessons that can be taken forward.

The unprecedented scale of the outage has sparked intense discussions about cybersecurity practices, vendor accountability, and the risks associated with centralised IT services.

Read more: Global IT outage highlights the hazards of technology software concentration

Stephen Osler, the co-founder and business development director at Nclose, said one of the most promising developments was the possibility of a new collaborative approach to software testing and deployment.

“There is the potential for a deployment alliance, where member vendors subscribe to best-practice methodologies for testing software updates before deployment. A signing authority could also validate certain procedures. This would show vendor alignment with global best practice and give assurances to customers,” he said.

While the full ramifications of the outage are still unfolding, one thing is clear: it has irreversibly altered the cybersecurity landscape. As organisations worldwide re-evaluate their IT strategies and vendors revamp their processes, the industry is ready for a new era of collaboration, accountability and resilience.

South Africa has the fifth-worst cybercrime density globally and only 26% of SA companies recently surveyed have cybersecurity insurance in place.

More than 10.9 billion sensitive records were breached globally from 2005 to 2018. Cybercrime affects all industries, but two in particular — health and financial services — must always ensure uptime and sensitive data protection.

Dirk Labuschagne, chief information security officer at Direct Transact. (Photo: Supplied)

Dirk Labuschagne, the chief information security officer at one of South Africa’s largest banking and payments service providers, Direct Transact, is a member of a special SA Reserve Bank task team to prepare for the eventuality of a nationwide outage.

Labuschagne shared six top cybercrime mitigation tactics. As it turns out, several regulators and security organisations have released updated cybersecurity and data security guidelines this year.

1. Compliance with the 2024 Cybersecurity Framework (CSF)

The US’s National Institute for Standards and Technology has published a 2024 Cybersecurity Framework (CSF), which includes information on how cybersecurity should be governed within organisations, including covering the organisational context, risk management strategies and supply chain risk management.

2. PCI-DSS compliance for organisations using bank cards

The PCI-DSS compliance framework offers detailed guidance for the payments industry on how to maintain the highest levels of security when it comes to sensitive card payment data.

3. The South African Reserve Bank’s updated 2024 rules 

The South African Reserve Bank recently released The Joint Standard: Cybersecurity and Cyber Resilience, which sets out best practices and processes relating to cybersecurity and cyber resilience for the National Payments System in South Africa.

The standard specifically looks at developments in the payments space, related to digitisation, financial technology, automation and artificial intelligence, and what risks need to be managed. Labuschagne said all banks, payment players and financial institutions must familiarise themselves with and implement these standards before they officially come into effect on 1 June 2025.

4. Top-down buy-in 

Labuschagne says one of the top requirements for successful cybersecurity is that it is supported and adopted with a top-down approach.

“Cybersecurity cannot be relegated just to the IT department. A strong cybersecurity strategy needs to be driven from the board and C-suite level in order for it to become ingrained in the company’s culture, operations and workflows.

“Cyber attackers look for chinks in the armour of an organisation, and if an organisation is well-managed and unified around cybersecurity, it will be much harder for bad actors to find vulnerabilities,” he says.

5. Phishing emails to staff is one of the biggest vulnerabilities

Deloitte estimates that more than 95% of cybersecurity attacks on organisations are preventable and that 90% of successful malware or ransomware attacks on organisations are due to staff negligence, such as clicking on phishing emails.

“When it comes to instilling a healthy and robust cybersecurity culture in your organisation, it’s far better to use a carrot rather than a stick approach. Ultimately, a cybersecurity education and awareness strategy can only succeed if there is willing participation from all staff members.

“Gamification and incentivisation are great ways to get cooperation from everyone in the organisation,” Labuschagne recommends.

6. Updated technology and a good data set-up

While it helps to have the most up-to-date technology, a secure data centre also goes a long way towards improving cybersecurity within an organisation.

Labuschagne says a secure data centre should have immutable storage, application contingency and disaster recovery solutions in the event of natural disasters, intensified nationwide load shedding and any other adverse and unexpected events.

“It’s also wise to do regular penetration testing on your data centre. Direct Transact, for instance, uses testers who are approved by the PCI Council, who we invite to try to breach our defences via multiple attack vectors. If they find vulnerabilities or weaknesses, we’ll know where to strengthen our defences,” he says.

***

The vice-president and principal analyst at Forrester, Andras Cser, largely agrees, saying tech leaders should use infrastructure automation where possible to avoid manual recovery procedures, along with developing rollback and regression capabilities, testing them often to ensure that systems can be recovered to a previous state.

“Customers need to ask for business interruption indemnification clauses in the event of a software update gone awry such as the current CrowdStrike one. For software that runs in trusted spaces with automatic updates, especially those that impact/use kernel modules or otherwise may impact operating system stability, this could be seen as a necessary step toward building back trust,” he says. DM