Blue Screen of Death: Global CrowdStrike outage is a call to action
25 July 2024
Ten key legal and risk takeaways from the CrowdStrike outage
What you need to know
- The global IT outage triggered by cyber security company, CrowdStrike, is a stark reminder of the importance for all organisations to have effective third party risk management.
- The outage is also a reminder that it only takes a small lapse in security or process to trigger significant incidents, and there is a growing expectation in regulators and customers that all organisations will have mature crisis and incident readiness capabilities.
- While the short-term impact of the global outage is mostly resolved we have yet to see how the long tail of post incident investigation, disputes and regulatory investigations might evolve. We expect to see service level agreement and contract reviews of material service providers, insurance claims, claims for damages and the need for customer remediation.
What you need to do
The outage is a call to action for all organisations to review essential risk management and readiness practices. Here are some key actions to consider.
If you were directly impacted conduct a post incident review that examines:
- impact to customers, financial losses, regulatory reporting, and potential claims and remediation, including an early assessment of customer harm;
- effectiveness of business continuity and recovery processes; and
- effectiveness and maturity of incident and crisis response.
Whether or not you were directly impacted, understand and improve your resilience to similar outages in the future.
- Review the adequacy of your material service provider management practises, your third party risk assessments and ensure the adequacy of existing risk and governance arrangements.
- This assessment should include a contractual review of cyber clauses (proportionality tiered by supplier risk criticality), assessment and assurance of the same, and clarification of contractual accountability and liability in the event of an incident.
- Assess and uplift the maturity of your cyber readiness capability and ensure you have "thorough and comprehensive" planning in place.
- Include a significant third party outage in your next executive and board level simulation.
- Review your scenario planning and ask "what if" questions: What if recovery was not as fast? What if the outage was the result of a cyber threat actor? What if there was a downstream impact on other critical service providers?
- Use these scenarios to test critical supplier arrangements – review and update contracts and service level agreements to minimise disruption and incentivise desired responses.
- Review whether liability cover under cyber, business interruption, professional indemnity and errors and omissions insurance policies are adequate – understand what is covered and your responsibilities.
- As part of your response to business disruption, consider your litigation footing. Are you likely to make a claim against your suppliers? Are you customers likely to claim against you?
The scale and suddenness of this outage is now a "foreseeable risk." Even if your organisation was not directly impacted this time, regulators and customers expect all organisations to learn the lessons and adapt. In the article below, we explore 10 key legal and risk takeaways from the CrowdStrike outage.
Worldwide disruption
A worldwide IT outage unfolded in the course of Thursday 18 and Friday 19 July 2024.
Cyber security company CrowdStrike released an update to Microsoft Windows that triggered a "logic error" resulting in a system crash that impacted computer networks worldwide, disrupting payment systems, banks, airports, hospitals, retailers, energy companies – many organisations that use both Windows and CrowdStrike saw at least some level of disruption.
The outage triggered meetings of various Government cyber and emergency management committees and warnings of the sudden rise in scammers and cyber criminals seeking to take advantage of the outage. Despite no long-term impact to critical infrastructure, speculation as to the costs of the incident is already well into the hundreds of millions of dollars, worldwide.
In the sections below we explore 10 key legal and risk takeaways from the CrowdStrike outage.
1. Small lapses can cause significant incidents
While we are still waiting for the complete picture, CrowdStrike has stated that the global outage was caused by a configuration update to Windows systems that use their security platform, Falcon. The configuration update triggered a "logic error", which resulted in servers and end points (laptops and desktops) crashing and failing to restart.
Compounding the impact for many was the use of BitLocker full-disk encryption, a sophisticated defence solution designed to prevent cyber threats, which also prevented users and IT teams from deploying the fix unless they had access to each endpoint’s unique BitLocker decryption key.
According to CrowdStrike, customers running the software who downloaded the update between 04.09 UTC and 5.27 UTC were susceptible to a crash.
This means that a simple update to a piece of code that was in release for a total of 78 minutes, caused a global outage that reportedly impacted 8.5 million devices worldwide.
While the scale of incident from a seemingly minor change may seem surprising, this outage aligns with two of Ashurst's key observations from cyber post incident reviews:
- Small lapses in processes and risk management often trigger significant incidents. Lapses can manifest in several ways. Control design and effectiveness may be inadequate, automated monitoring and alerting capabilities might be limited or circumvented, asset registers may be incomplete, and the scope of penetration testing can be insufficient.
- Incidents almost always involve third parties. In an increasingly sophisticated and interconnected environment, a third party will often be a significant contributing factor to an outage or security incident. Visibility of third parties and fourth parties (and beyond) that play a critical role in the provision of services is essential.
2. Regulators expect greater visibility of material services providers and operational resilience
There is a raft of new regulations aimed at strengthening operational resilience specifically aimed at preventing and responding to disruptions such as the CrowdStrike outage to minimise harm to customers.
The new legislation such as CPS 230 Operational Risk Management in Australia and DORA in the UK will lift the bar on the management of third parties and introduce better practice that will require organisations to adopt a risk-based approach.
Better practice also requires an organisation to look through to the processes, risks and controls of the service provider to deliver the services the organisation relies on to provide critical operations to customers. This reinforces the principle that an entity may outsource the activity, but not the risk or accountability.
Greater visibility will then be required of material service provider risk frameworks and their capability to manage risk to prevent such incidents. In particular, the CrowdStrike outage reminds us of the importance of understanding what best practice change management and patching looks like, and ensuring that organisations set clear expectations with material service providers on the level of testing required before patching.
It is recognised this visibility is harder to obtain with large global players such as Microsoft where entities have limited leverage to influence them to provide information over risk management practices. New regulation currently under consultation in the UK aims to designate critical third parties (CTPs) and bring them under the supervisory remit of financial regulators, similar to European Supervisory Authorities powers under DORA.
Even with visibility, there is no guarantee that you will be able to prevent significant incidents – you also need to be confident in your own capability to respond with appropriate contingency and continuity planning, including identifying back-up or substitute systems, processes, and service providers.
3. Readiness is a regulatory issue
While an incident may not be your fault, customers and regulators expect you to be able to adequately respond. Regulators across the world increasingly expect organisations to demonstrate greater levels of sophistication and maturity in incident and crisis management response. Following an incident, regulators are "marking" a company's response in relation to the effectiveness of existing plans and processes. The benchmark is to have "thorough and comprehensive planning" for significant incidents.
Ashurst has defined ten core elements to assessing readiness maturity.
