Global IT outage highlights the hazards of technology software concentration

Technology has invaded most aspects of our lives, but this has never been more glaringly apparent than on Friday, 19 July, when a cybersecurity update from CrowdStrike malfunctioned, causing a global tech outage.

The fault was caused by a defect in a Falcon content update for Windows hosts. Mac and Linux hosts were not affected. However, the tech fallout had worldwide effects, grounding airlines, silencing broadcasters and affecting servers from Australia to the US to South Africa.

Arthur Goldstuck, head of World Wide Worx, said the outage was compounded by the fact that so many organisations now depend on the cloud. “So much of Microsoft’s cloud services are interlinked and the problem here is multiplied by CrowdStrike’s systems being intended to unify all their threat detection and combating tools,” he told news broadcaster eNCA. The broadcaster had also experienced some downtime during the outage.

Security Scorecard chief executive Dr Aleksandr Yampolskiy said the incident served to highlight the importance of using multiple vendors so that companies remain protected if one firewall goes down. “[The] global outage is a reminder of the fragility and systemic ‘nth-party’ concentration risk of the technology that runs everyday life: airlines, banks, telecoms, stock exchanges and more,” he said, adding that SecurityScorecard research, in collaboration with McKinsey, shows that 62% of the global external attack surface is concentrated in the products and services of just 15 companies.

“You need to have diverse systems, know where your single points of failure are, and proactively stress-test through tabletop exercises and simulations of outages,” said Yampolskiy.

The report points out that although companies spend hundreds of thousands of dollars per year managing cyber risk within their vendor and third-party ecosystem, and millions on cyber programs, their billion-dollar business is only as good as the cybersecurity of their smallest vendor. “The interconnected nature of our digital landscape requires a shift in how companies think about their cyber ecosystem risk — it is no longer just about your resilience; you need to consider the broader system and how to build mutual support with peers, competitors and your vendors,” says Charlie Lewis, partner at McKinsey and a co-author of the report.

A flight board shows numerous delayed flights and some cancelled flights at Washington Dulles International Airport in Dulles, Virginia, US, 19 July 2024. Operations at various airports and airlines have been impacted by a global tech outage in systems running Microsoft Windows linked to a faulty CrowdStrike cybersecurity software update. (Photo: EPA-EFE / MICHAEL REYNOLDS)

Double whammy for Microsoft users