 security by design part 12 security by design part 12 hemraj mon 10202025 658 security by design part 12 contributors joseph f norton joseph f norton risk security and crisis management professional linkedin joseph fnorton security by design part 12 latest trending image on july 19 2024 a single software update was able to create it chaos across the entire world a faulty crowdstrike channel file 291 software update to their falcon end point threat data file detection and response endpoint device software impacted crashed 9 million computers this created an immediate global it outage affecting airlines media outlets banks retailers and other organizations that use microsoft windows operating systems  largest it outage in history  the world economic forum is reporting this as possibly the largest it outage in history revealing the vulnerability and interconnections of complex digital systems  this follows the continuing clean up and losses due to the change healthcare cyber attack which occurred on february 19th 2024 with 687 billion in total losses expected including equity loss legal fees regulatory fines class action claims pr expenses notification costs and other expenses it is being reported that global microsoftcrowdstrike outage impact 5 million computers have been impacted fortune 500 expect 54 billion in direct cost impacts cyber insurers expect to pay out 15 billion in claims delta america s second biggest airline canceled 5000 flights disrupting travel for millions crowdstrike s cyber security services are used by 298 of the fortune 500 companies 538 of the fortune 1000 companies and 8 out of 10 of the top financial firms 163 companies have been directly impacted by this outage hosted on microsoft cloud services a full list of these companies can be found at list of companies affected by the global microsoftcrowdstrike outage tech business news  this does not include the companies impacted which host their own servers or who use other cloud services and crowdstrike falcon endpoint detection and response services at least one putative class action lawsuit from investors arguing they were misled by the company and told its technology was validated tested and certified before a faulty update triggered a global it outage  we got a taste of what a global cyberattack would look like  ian thorntontrump ciso at cyjax has commented we learned a valuable lesson about the fragility of our infrastructure thorntontrump said  we also learned how dangerous we got a taste of what a global cyberattack would look like  i feel like we are at one of those inflection moments as reported by reach chase difeliciantonio in the san franciso chronicle  crowdstrike s widespread deployment across industry and government itself reflect a kind of critical security flaw said professor ahmed banafa at san jose state university who teaches courses on computer networking operating systems and cybersecurity friday s incident appears to have been human error but what if this had been done intentionally he said  if you can bring millions of computers down that is a single point of failure banafa added i think microsoft is really going to think about their relationship with crowdstrike given what happened today  global it supply chain implications and impacts interros a supply chain risk intelligence company in their crowdstrike outage analysis reports  crowdstrike was involved in a global it outage that has highlighted the vulnerability of interconnected global supply chains the outage impacted 674620 direct customer relationships of crowdstrike and microsoft and over 49 million indirectly  according to interros data while the us was the most affected country with 41 of impacted entities the disruption was also felt at major ports and air freight hubs in europe and asia ports from new york to los angeles and rotterdam reported temporary shutdowns while air freight suffered the hardest blow with thousands of flights grounded or delayed the outage exacerbates existing supply chain challenges amid rising global demand and freight prices highlighting the potential longterm implications for global trade and finance interros analyzed the extended supply chains of both crowdstrike and microsoft whose microsoft 365 systems were disrupted as part of a crowdstrike update leading to outages for microsoft users across the world when examining the direct customer relationships tier 1 of both microsoft and crowdstrike interros was able to identify 674620 customer relationships  when expanding the scope of impact to include the customers of microsoft and crowdstrike s customers tier 2 the number of customer relationships identified by interros data grows to over 28 million and when going one step further tier 3 that figure to over 49 million customer relationships root cause  there is ample reporting by crowdstrike and the media as to the root cause of this cyber event being a bug failure in crowdstrike s automated software testing which did not catch the software bug in their channel file 291 software update to their falcon end point threat data file detection and response endpoint device software  really   a more discerning view should be asking these questions of crowdstrike as a prime top tier global supplier of cyber security services why do you and did you push out a global patch to all your customers at the exact same instant why did you not test your patch on target safe zone environments prior to pushing it out why did you not push this update patch out to you customers incrementally as a best practice to minimize the potential impacts in the event of such a failure as this what are and where were your governance and controls for software quality test and assurance a more discerning view should be asking these questions of customers of crowdstrike as a customer of crowdstrike why do you allow a third party to autopush a patch directly onto your production operations servers why do you not test third party software patches in a safe zone prior to widespread software update patch deployment what are and where were your governance and controls for software quality test and assurance  security focusing only on design aspects of complex systems will ensure cyber insecurity in my last post i commented that digital systems do not stand alone as technology systems only as soon as we deploy technology the technology enters the realm of becoming a system interconnecting and interacting with other systems with which our business operates these systems and interconnections extend throughout our organizations as well as throughout out our ter 1 extended customer and supplier interconnections our tier 2 extended customer and supplier interconnections our tier 3 extended customer and suppler interconnections and so on these business systems are comprised of benevolent technology people and processes interconnecting our business with our customers and suppliers as well as the shared open systems we use such as the world wide web and internet unfortunately bad actors also use the open and shared internet and world wide web systems with the sole purpose to compromise our business operations so focusing only on the secure design of technology products is not enough to secure our businesses by design  cyber events of minor and or catastrophic consequences can also be triggered by nonbad actors from anywhere within our extended customer and supplier chains the very nature of the complex interconnections of digital systems mandates that security by design requires that all aspects of security design and operations work in concert continually across all tiers of our organization customer supplier chain any gaps mistakes or lack of attentiveness by those who use support or operate our systems including those responsible for oversight and assurance will guarantee a cybersecurity compromise either by bad actors or by own or customer or supplier actors  security by design  people process people data people technology process people process data process technology technology people technology data technology process data process data people data technology  joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network special advisor for risk and cybersecurity to divihn chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy webinar image the ciso exchange for a safer digital world image zero trust architecture adoption in federal government image zero trust architecture adoption in federal government expert content image shadow ai and the governance gap what leaders must do now shantanoo govilkar image security by design part 2 joseph f norton image employee training awareness laszlo s gonc popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an ad 15 best practices in salesforce development many businesses have decided to use salesforce  what is governance risk and compliance grc a definitive guide grc is the capability or integrated collection artificial intelligence for all responsibly as we look towards the turn of another year it get the latest insights straight from our desk to your inbox subscribe featured articles explore more  image whitepaper ransomware threat management ransomware continues to be a real threat to business operations across all industries no organization is safe from this threat laszlo s gonc cissp first senior fellow divihn cybersecurity center of excellence view image cybersecurity incident response preparedness an incident response framework provides a structure to support incident response operations a framework typically provides guidance on what needs to be done but not on how it is done laszlo s gonc cissp first senior fellow divihn cybersecurity center of excellence view image iot medical device cybersecurity healthcare data and medical devices would be aggressively targeted by ransomware attacks since early 2017 has proven to be true  laszlo s gonc cissp first senior fellow divihn cybersecurity center of excellence view 