CrowdStrike outage - key lessons for DPOs and CPOs

The 19 July CrowdStrike software update that resulted in a global cyber crash, affecting critical services across various industries, including hospitals, airlines, and financial institutions, has had many people reviewing their privacy and cyber processes. Estimates currently stand at 8.5m computers affected - around 1% of Windows machines worldwide. Unprecedented in its size, the incident can serve as a reminder of many lessons for privacy and security teams:

• The need to ensure that their organisation has strong change management policies and procedures in place. The CrowdStrike outage appears to have been caused by a software update defect (malfunction), and ideally sound development, testing, and quality assurance review and approval procedures would have detected any flaws before production deployment.
• The importance of having formal backup policies and procedures, business continuity plans, and disaster recovery procedures. These should be current, approved by management, and periodically tested to provide for timely recovery of systems when unexpected events transpire.
• As part of the change management processes, if it is not possible to have “staging” environments separate from production environments for testing, the production environment should be configured so that it has resilience against failures of groups of servers, and those groups of servers updated one at a time, with appropriate monitoring for potential failures.