How the CrowdStrike Incident is Shaping Risk Management Services and Business Continuity in 2024
The July 2024 CrowdStrike incident disrupted Windows systems across many organizations. It showed how a faulty security update can affect business continuity. The cause was a content configuration update for the Falcon Windows sensor. Cloud dependence was one planning concern raised afterward, not the cause of the incident. This article reviews those concerns and the lessons for risk management.
The CrowdStrike Incident, A Wake-Up Call for IT Leaders:
On July 19, 2024, CrowdStrike released a content configuration update for its Windows sensor. The faulty update caused affected Windows systems to crash. According to CrowdStrike, Mac and Linux hosts were not affected. The incident prompted IT leaders to review shared dependencies and recovery plans.
Affected systems displayed the “blue screen of death (BSOD).” A common security component could therefore disrupt many services at once. The issue was not limited to cloud-hosted infrastructure. Teams need to understand dependencies across endpoints, servers and cloud services.
Reevaluating Cloud Dependencies:
Abhishek Gupta from DishTV emphasizes the need to revisit existing cloud strategies. “When an issue of such magnitude happens and causes such a big disruption, it is important and necessary to revisit your existing beliefs, decisions, and tradeoffs that went into arriving at the current architecture,” he says. Following the CrowdStrike incident, DishTV is already re-evaluating its cloud strategy in a phased manner.
Shashank Jain from Shree Financials advocates for a strategic shift, suggesting that all patches should first be tested on a test server. “Organizations and CISOs must review their cloud strategies, and the automatic updating of patches should be discouraged. All patches should first be tested on a test server,” Jain adds, emphasizing the need for rigorous testing to prevent cascading failures.
Saurabh Gugnani from TMF Group suggests a diversified approach to cloud strategies to mitigate such risks. “Yes, they [enterprises] should revisit cloud strategies. It has to be a mix of all the available solutions.” he advises.
Enhanced Business Continuity Plans:
Shivkumar Borade, founder of Mytek Innovations, highlights the importance of updating business continuity plans to address unexpected downtimes. “In response to recent disruptions affecting our critical operations, we have proactively updated our Business Continuity Plan to address unexpected downtimes and minimize the impact on productivity and service delivery,” he says.
Borade explains that their internal communication was significantly disrupted, with their entire network, including Outlook, Teams, and SharePoint, being hosted on Microsoft 365. However, their in-house developed application remained unaffected due to GoDaddy’s hosting infrastructure. This incident underscores the need for robust communication management and diversified hosting strategies.
Addressing Vendor Lock-In:
The CrowdStrike incident raised concerns about reliance on shared vendors and security tools. Allie Mellen, a principal analyst at Forrester, stresses the importance of reliable tools and services in the face of cyber threats. “Reliability of the tools and services cybersecurity teams use is critical in the face of cyberattacks,” she states, highlighting the need for continuous validation and testing.
The incident showed how failure in a shared component can affect multiple services. Sunil Varkey from Beagle Security notes, “Trust between cloud and security vendors is now questioned.” He advocates for agentless solutions that can offer enhanced security without the vulnerabilities associated with traditional agents.
Enhanced Risk Management Practices:
The CrowdStrike incident underscores the need for improved risk management practices and effective business continuity. Gaurav Ranade from RAH Infotech emphasizes continuous adaptation and improvement in cybersecurity practices. D.R. Goyal from Rakuten Symphony suggests a mechanism to test updates with select users before a full release to reduce the impact.
Ashis Guha, founder of An Idea Global Innovations, points out the broader implications for the global economy, noting that longer downtimes and recovery times will impact productivity and economics. The practical lesson is to map shared dependencies and test recovery from their failure.
How Technijian Can Help
Tailored Risk Management Solutions:
Technijian can help assess risk management needs. Start by identifying critical systems, shared vendors and recovery targets. Then assign owners to address the highest-priority gaps.
Advanced Cloud Security Services:
Cloud security remains part of the wider risk review. Technijian can help assess monitoring, threat detection and access controls. However, a cloud-only review would miss endpoint and update risks highlighted by this incident.
Comprehensive Business Continuity Planning:
Technijian can help develop and test business continuity plans. Include recovery procedures, staff training and alternate communication methods. Regular exercises can reveal gaps before a disruption occurs.
Incident Response and Recovery:
Technijian offers incident response and recovery support. Agree the scope, escalation contacts and recovery priorities in advance. Response time and recovery depend on the incident and available resources.
The 2024 CrowdStrike incident offers lessons about update controls, shared dependencies and recovery. It does not show that cloud services alone caused the outage. Review critical systems, test recovery and keep a clear communication plan. Technijian can help define the next steps for your organization.
Primary incident source: CrowdStrike preliminary post-incident review, July 24, 2024. The attributed industry comments remain from the CIO article linked earlier.
