When good IT goes bad

Hands up if you had heard about Crowdstrike before 20 July. Keep them up if you knew that your organisation used one of their products.

I would be surprised if many Kiwi business managers or board directors still have their hands up, because the use of Crowdstrike isn’t a board decision or even a managerial one - it’s operational.

As many have learned this week, CrowdStrike is a company that helps protect computers and data from cyber threats. They offer a service called Falcon that combines antivirus, threat detection, and a team of experts who monitor for attacks 24/7.

The Crowdstrike system uses real-time data and intelligence to quickly identify and stop threats, helping organisations prevent security breaches. Its Falcon service was at the heart of the problem; that being, a routine update contained corrupted files that the widely used Microsoft Windows operating system relies on. 

Such updates are a normal part of Falcon’s operation and occur several times a day in response to novel tactics, techniques, and procedures discovered by CrowdStrike. As of now, it’s not clear why the error occurred, but that will no doubt emerge in due course as the outage continues to be investigated.

Crowdstrike isn’t the only vendor in this space – there are many similar service providers, and they exist to mitigate a multitude of risks in the cyber and digital security space.

Whichever tool your organisation uses is an operational decision that is usually delegated to the CIO (if you’re large enough) or your managed service partner (if you’re not.)

As a manager or board member, you might get visibility of the operational tools the organisation you oversee uses, but it’s likely to be more informational than governance related.

However, as we found out on Friday, sometimes a small decision can have a big impact. It’s the impact of these decisions that managers and directors need to be aware of.

Tools like Falcon are a double-edged sword. If you don’t have them, you’re vulnerable to cyber security risks. If you do have them, you’re vulnerable to their release processes.

So, what should Kiwi business managers do? I’m not saying you should go on a witch hunt and ask for a list of all the tools your organisation is using. That’s not the best use of anyone’s time – especially when outages like this are the exception, not the norm.

Instead, you should be making sure you understand what impacts your organisation might experience should technology fail, so you can recover as fast as possible.

Recovery is important, because often the knock-on effect of being offline for three hours is worse than the actual outage – and that's where organisations need to be ensuring they are best protected.

What responsible managers or boards need to do now is maintain the appropriate level of oversight of their IT and ask these questions:

• Is there someone in the organisation who understands all the tools currently in use?
• Does our organisation understand the potential impact of an outage like the one caused by Falcon?
• How long could our organisation operate if specific IT systems were unavailable due to a vendor error?
• Does our organisation have the right people, processes, and tools to recover as quickly as possible?

It’s easy to sit back when an IT outage affects your competitors. However, proactive and responsible management and governance should seize this opportunity to test their own resilience.

By understanding the tools in use, assessing the potential impacts of outages, and ensuring the right people, processes, and tools are in place, companies can better prepare to withstand and quickly recover from such incidents.

This proactive approach not only mitigates risks but also strengthens the overall security posture of the organisation.

While you don’t need to know all the technology products your organisation is using, you do need to know what impacts your organisation might experience if things go wrong.