Cybersecurity insights from the Crowdstrike incident

Understanding the CrowdStrike incident

On July 19, 2024, Austin-based cybersecurity company CrowdStrike experienced a significant incident. A major update was released in their Falcon Sensor security software, resulting in over 8.5 million Windows operating systems to crash¹ and users facing the blue screen of death (BSOD).² This is a stop error screen that prevents any other actions and caused Microsoft Windows to shut down.

This incident was not caused by cybercriminals or malicious insiders, but by a logic error in the Falcon Sensor update. Although CrowdStrike rapidly provided a fix, the restoration required a manual process, resulting in a time-consuming effort to bring systems back up.

The disruption impacted several industries including banking, hospitality, manufacturing, retail, and others. About 25% of Fortune 500 companies, amongst many others, experienced disruptions. Several major airlines were amongst those impacted. Of the over 10,000 flights cancelled worldwide, over 5,000 were Delta flights, reportedly costing them nearly $500 million.³

The total loss of the CrowdStrike outage is estimated to be at $5.4 billion,⁴ and the incident has been called one of the largest IT outages in history.⁵ The disruptions continued for much of the following week due to the manual restoration process. Although organizations worked to restore critical systems within a few days, it is estimated that it could take months for all systems to recover.

Unlike the SolarWinds attack of 2020, the CrowdStrike outage was caused by a faulty update versus the work of a sophisticated cybercriminal organization. While the incident had a different cause, the financial impacts can be compared to the cost of a cyberattack. Currently, the average cost of a cybersecurity breach is at $4.88 million,⁶ with average recovery costs (excluding cost of a ransom payment) estimated at $2.73 million⁷ per incident.

Lessons from the CrowdStrike incident

This event highlighted the vulnerabilities that can arise even from routine software updates and the potential consequences of such incidents on a global scale. It also underscored the importance of robust testing and deployment procedures for software updates, particularly those that are widely used in critical infrastructure and enterprise environments.

While organizations like CrowdStrike need to take this into consideration prior to pushing out releases, organizations can prepare to help address and mitigate the impacts to their operations. This is not a single-threaded approach, instead requiring organizations to consider layers in their overall security strategy.

Here are a few recommendations:

1. Develop and maintain a risk management plan. These may be in the form of incident response or disaster recovery and business continuity plans. Planning for incidents, whether caused by malicious actors or faulty updates, can be a very similar process. If your organization already has a risk management plan in place, familiarize yourself with the details in the case of an incident.

2. Rehearse incidents and resolutions. The risk management plan must be effectively communicated and understood by the appropriate stakeholders. Drills or tabletop exercises (TTX) are very effective rehearsal methods, allowing organizations to test and validate their plans in a controlled, low-risk environment.

3. Perform regular backups. Backing up data and updating systems can limit the risk of data loss. Regularly assessing your security measures and backing up data can limit the risk of loss and data corruption. It is recommended to keep backups off-site or in the cloud as on-premises backups could be compromised.

4. Conduct plan patch management. Yes, this outage was caused by a faulty release, but systems and applications are still the most secure when updated regularly. According to Google Mandiant, 33% of all security breaches resulted from the exploitation of unpatched vulnerabilities.⁸

   The question becomes how soon you push out a critical patch. Leading practices say they should be released within 2 weeks to 30 days. If you can run the patch in a development environment first, you can see what impacts the update has on your environment prior to pushing out to production.

5. Work with a trusted partner. In the complex world of maintaining confidentiality, availability, and integrity of your systems, there is value in engaging a trusted cybersecurity partner. Work with someone who can continue to advise on resilience and improve your cybersecurity maturity. This can pay dividends in developing an effective strategy to address and mitigate risks, whether caused by malicious actors or issues in system updates.

Be proactive to protect your organization

CAI offers end-to-end cybersecurity services that can help your organization assess your system vulnerabilities and start proactively planning for a cyber incident. Our team can help you navigate the complex environment of evolving cybersecurity threats, cyber solutions, and find the right tools for your organization. We also offer ongoing cyber advisory solutions to help provide support following an implementation. Start proactively protecting your organization by connecting with our cyber experts.