A Major IT Outage: What Happened?

On July 19, 2024, a significant IT outage disrupted services worldwide. Banks, healthcare facilities, emergency services, and payment systems faced interruptions, causing widespread business closures and even flight cancellations. This global incident left many travelers stranded and businesses scrambling to restore operations. 

What is CrowdStrike? 

CrowdStrike is a leading American cybersecurity company specialising in software to monitor and detect cyber threats. Their flagship product, Falcon EDR (Endpoint Detection and Response), acts like a powerful antivirus tool. It detects and mitigates security threats, alerting of potential hackers. 

During a recent update, it caused many computers to crash, resulting in the infamous Blue Screen of Death (BSOD) on Windows systems. Given that Microsoft systems constitute about 70% of desktop operating systems worldwide, the effects of this outage were extensive, impacting millions globally. *

Is My Computer Safe? 

The good news is that CrowdStrike's products are primarily used by organisations, not individual home users. If you are using regular antivirus and anti-malware programs, you would not have been affected by this outage. However, it raises an important question: what can I do to prepare for future outages? 

Lessons Learned for Businesses 

1. Review Redundancy and Single Point Failures 

• Relying on a Single Source: If your organisation depends heavily on one cybersecurity provider, it can be risky when things go wrong. 
• Diversify Your Vendors: By using multiple service providers, you reduce the impact of any one service experiencing issues. 
• Redundant Security Measures: Always have backup security solutions ready to deploy during outages. 

2. Enhance Incident Response 

• Effective Plans: A well-prepared incident response plan can greatly reduce the impact of outages. When was the last time you tested yours? 
• Scenario Planning: Ensure your incident response plans cover various disruption scenarios. 
• Communication Plans: Clear communication is crucial during outages. What will your messaging be? 

3. Employee Training 

• Build a Culture of Resilience: The Australian Cybersecurity Center (ACSC) reported that during the outage, malicious websites and unofficial code attempted to exploit the situation; training staff to recognise these risks is essential.** 
• Handle Disruptions: Well-trained employees can better manage disruptions and outages. 
• Regular Drills: Conduct regular training sessions and simulated drills to ensure your team is prepared to handle real incidents efficiently. This includes recognising phishing attempts and social engineering attacks that often follow major disruptions. 

4. Organisational Resilience 

• The recent CrowdStrike outage was not caused by a cyber-attack, but it serves as a valuable learning opportunity. You can use this experience to strengthen your business culture of resilience and improve your preparedness for future incidents. The ability to maintain and quickly recover normal operations during a disaster is crucial. 

Lessons Learned for Individuals 

As a reminder to remain vigilant, and as noted by the ACSC, unofficial websites and sources of help were released to take advantage of the CrowdStrike incident**, here are some essential tips to keep in mind: 

1. Exercise Caution with Unsolicited Communications: 

Be extra cautious if your primary security tool is down. Always be skeptical of unsolicited messages that ask for personal information or urge you to act quickly. Avoid clicking on suspicious links and directly verify any requests for personal information or payments. 

2. Have a recovery plan and backup your data:

Ensure your important files are backed up so that you are not reliant on a single source. In the event an outage occurs prepare a recovery plan. 

3. Verify the Source: 

During worldly events, if you receive a suspicious call or message, verify the caller’s identity. Be aware of tools like voice cloning and number spoofing that make calls appear legitimate. If in doubt, hang up and contact the entity directly. 

4. Secure Your Information:

Use strong, unique passwords for all your accounts and consider a password manager. Enable multi-factor authentication to increase security. 

5. Monitor and report Suspicious Activity: 

Regularly check bank and other sensitive accounts for unauthorised transactions and alerts. Report suspicious activity to relevant organisations immediately. If you suspect a cyber-attack, report it to https://www.cyber.gov.au/