Category Archives: Crisis Management

CrowdStrike IT Outage Explained by a Windows Developer

July 24, 2024Aftermath, Attack Technology, Best Practices, Beyond, Business Continuity, Controls, Crisis, Crisis Management, Cyber Attacks, Cybersecurity, Digital Blackout, Digital era, Global, Governance Risk & Compliance, GRC, Impact, Implications, Incident, Information Technology, IT Governance, IT Outage, IT Service Management, ITSM, Resilience, Strategic Cybersecurity, Technology Trends, Threatsaftermath, attack technology, best practices, beyond, Business Continuity, controls, crisis management, Cyber Attacks, cybersecurity, Digital Blackout, digital era, global, Governance Risk & Compliance, GRC, impact, implications, incident, Information Technology, it governance, IT Outage, IT Service Management, ITSM, regulatory, resilience, strategic cybersecurity, technology trends, threatsadmin

Understanding the CrowdStrike IT Outage: Insights from a Former Windows Developer

Introduction

Hey, I’m Dave. Welcome to my shop.

I’m Dave Plummer, a retired software engineer from Microsoft, going back to the MS-DOS and Windows 95 days. Thanks to my time as a Windows developer, today I’m going to explain what the CrowdStrike issue actually is, the key difference in kernel mode, and why these machines are bluescreening, as well as how to fix it if you come across one.

Now, I’ve got a lot of experience waking up to bluescreens and having them set the tempo of my day, but this Friday was a little different. However, first off, I’m retired now, so I don’t debug a lot of daily blue screens. And second, I was traveling in New York City, which left me temporarily stranded as the airlines sorted out the digital carnage.

But that downtime gave me plenty of time to pull out the old MacBook and figure out what was happening to all the Windows machines around the world. As far as we know, the CrowdStrike bluescreens that we have been seeing around the world for the last several days are the result of a bad update to the CrowdStrike software. But why? Today I want to help you understand three key things.

Key Points

Why the CrowdStrike software is on the machines at all.
What happens when a kernel driver like CrowdStrike fails.
Precisely why the CrowdStrike code faults and brings the machines down, and how and why this update caused so much havoc.

Handling Crashes at Microsoft

As systems developers at Microsoft in the 1990s, handling crashes like this was part of our normal bread and butter. Every dev at Microsoft, at least in my area, had two machines. For example, when I started in Windows NT, I had a Gateway 486 DX 250 as my main dev machine, and then some old 386 box as the debug machine. Normally you would run your test or debug bits on the debug machine while connected to it as the debugger from your good machine.

Anti-Stress Process

On nights and weekends, however, we did something far more interesting. We ran a process called Anti-Stress. Anti-Stress was a bundle of tests that would automatically download to the test machines and run under the debugger. So every night, every test machine, along with all the machines in the various labs around campus, would run Anti-Stress and put it through the gauntlet.

The stress tests were normally written by our test engineers, who were software developers specially employed back in those days to find and catch bugs in the system. For example, they might write a test to simply allocate and use as many GDI brush handles as possible. If doing so causes the drawing subsystem to become unstable or causes some other program to crash, then it would be caught and stopped in the debugger immediately.

The following day, all of the crashes and assertions would be tabulated and assigned to an individual developer based on the area of code in which the problem occurred. As the developer responsible, you would then use something like Telnet to connect to the target machine, debug it, and sort it out.

Debugging in Assembly Language

All this debugging was done in assembly language, whether it was Alpha, MIPS, PowerPC, or x86, and with minimal symbol table information. So it’s not like we had Visual Studio connected. Still, it was enough information to sort out most crashes, find the code responsible, and either fix it or at least enter a bug to track it in our database.

Kernel Mode versus User Mode

The hardest issues to sort out were the ones that took place deep inside the operating system kernel, which executes at ring zero on the CPU. The operating system uses a ring system to bifurcate code into two distinct modes: kernel mode for the operating system itself and user mode, where your applications run. Kernel mode does tasks such as talking to the hardware and the devices, managing memory, scheduling threads, and all of the really core functionality that the operating system provides.

Application code never runs in kernel mode, and kernel code never runs in user mode. Kernel mode is more privileged, meaning it can see the entire system memory map and what’s in memory at any physical page. User mode only sees the memory map pages that the kernel wants you to see. So if you’re getting the sense that the kernel is very much in control, that’s an accurate picture.

Even if your application needs a service provided by the kernel, it won’t be allowed to just run down inside the kernel and execute it. Instead, your user thread will reach the kernel boundary and then raise an exception and wait. A kernel thread on the kernel side then looks at the specified arguments, fully validates everything, and then runs the required kernel code. When it’s done, the kernel thread returns the results to the user thread and lets it continue on its merry way.

Why Kernel Crashes Are Critical

There is one other substantive difference between kernel mode and user mode. When application code crashes, the application crashes. When kernel mode crashes, the system crashes. It crashes because it has to. Imagine a case where you had a really simple bug in the kernel that freed memory twice. When the kernel code detects that it’s about to free already freed memory, it can detect that this is a critical failure, and when it does, it blue screens the system, because the alternatives could be worse.

Consider a scenario where this double freed code is allowed to continue, maybe with an error message, maybe even allowing you to save your work. The problem is that things are so corrupted at this point that saving your work could do more damage, erasing or corrupting the file beyond repair. Worse, since it’s the kernel system that’s experiencing the issue, application programs are not protected from one another in the same way. The last thing you want is solitaire triggering a kernel bug that damages your git enlistment.

And that’s why when an unexpected condition occurs in the kernel, the system is just halted. This is not a Windows thing by any stretch. It is true for all modern operating systems like Linux and macOS as well. In fact, the biggest difference is the color of the screen when the system goes down. On Windows, it’s blue, but on Linux it’s black, and on macOS, it’s usually pink. But as on all systems, a kernel issue is a reboot at a minimum.

What Runs in Kernel Mode

Now that we know a bit about kernel mode versus user mode, let’s talk about what specifically runs in kernel mode. And the answer is very, very little. The only things that go in the kernel mode are things that have to, like the thread scheduler and the heap manager and functionality that must access the hardware, such as the device driver that talks to a GPU across the PCIe bus. And so the totality of what you run in kernel mode really comes down to the operating system itself and device drivers.

And that’s where CrowdStrike enters the picture with their Falcon sensor. Falcon is a security product, and while it’s not just simply an antivirus, it’s not that far off the mark to look at it as though it’s really anti-malware for the server. But rather than just looking for file definitions, it analyzes a wide range of application behavior so that it can try to proactively detect new attacks before they’re categorized and listed in a formal definition.

CrowdStrike Falcon Sensor

To be able to see that application behavior from a clear vantage point, that code needed to be down in the kernel. Without getting too far into the weeds of what CrowdStrike Falcon actually does, suffice it to say that it has to be in the kernel to do it. And so CrowdStrike wrote a device driver, even though there’s no hardware device that it’s really talking to. But by writing their code as a device driver, it lives down with the kernel in ring zero and has complete and unfettered access to the system, data structures, and the services that they believe it needs to do its job.

Everybody at Microsoft and probably at CrowdStrike is aware of the stakes when you run code in kernel mode, and that’s why Microsoft offers the WHQL certification, which stands for Windows Hardware Quality Labs. Drivers labeled as WHQL certified have been thoroughly tested by the vendor and then have passed the Windows Hardware Lab Kit testing on various platforms and configurations and are signed digitally by Microsoft as being compatible with the Windows operating system. By the time a driver makes it through the WHQL lab tests and certifications, you can be reasonably assured that the driver is robust and trustworthy. And when it’s determined to be so, Microsoft issues that digital certificate for that driver. As long as the driver itself never changes, the certificate remains valid.

CrowdStrike’s Agile Approach

But what if you’re CrowdStrike and you’re agile, ambitious, and aggressive, and you want to ensure that your customers get the latest protection as soon as new threats emerge? Every time something new pops up on the radar, you could make a new driver and put it through the Hardware Quality Labs, get it certified, signed, and release the updated driver. And for things like video cards, that’s a fine process. I don’t actually know what the WHQL turnaround time is like, whether that’s measured in days or weeks, but it’s not instant, and so you’d have a time window where a zero-day attack could propagate and spread simply because of the delay in getting an updated CrowdStrike driver built and signed.

Dynamic Definition Files

What CrowdStrike opted to do instead was to include definition files that are processed by the driver but not actually included with it. So when the CrowdStrike driver wakes up, it enumerates a folder on the machine looking for these dynamic definition files, and it does whatever it is that it needs to do with them. But you can already perhaps see the problem. Let’s speculate for a moment that the CrowdStrike dynamic definition files are not merely malware definitions but complete programs in their own right, written in a p-code that the driver can then execute.

In a very real sense, then the driver could take the update and actually execute the p-code within it in kernel mode, even though that update itself has never been signed. The driver becomes the engine that runs the code, and since the driver hasn’t changed, the cert is still valid for the driver. But the update changes the way the driver operates by virtue of the p-code that’s contained in the definitions, and what you’ve got then is unsigned code of unknown provenance running in full kernel mode.

All it would take is a single little bug like a null pointer reference, and the entire temple would be torn down around us. Put more simply, while we don’t yet know the precise cause of the bug, executing untrusted p-code in the kernel is risky business at best and could be asking for trouble.

Post-Mortem Debugging

We can get a better sense of what went wrong by doing a little post-mortem debugging of our own. First, we need to access a crash dump report, the kind you’re used to getting in the good old NT days but are now hidden behind the happy face blue screen. Depending on how your system is configured, though, you can still get the crash dump info. And so there was no real shortage of dumps around to look at. Here’s an example from Twitter, so let’s take a look. About a third of the way down, you can see the offending instruction that caused the crash.

It’s an attempt to move data to register nine by loading it from a memory pointer in register eight. Couldn’t be simpler. The only problem is that the pointer in register eight is garbage. It’s not a memory address at all but a small integer of nine c hex, which is likely the offset of the field that they’re actually interested in within the data structure. But they almost certainly started with a null pointer, then added nine c to it, and then just dereferenced it.

CrowdStrike driver woes

Now, debugging something like this is often an incremental process where you wind up establishing, “Okay, so this bad thing happened, but what happened upstream beforehand to cause the bad thing?” And in this case, it appears that the cause is the dynamic data file downloaded as a sys file. Instead of containing p-code or a malware definition or whatever was supposed to be in the file, it was all just zeros.

We don’t know yet how or why this happened, as CrowdStrike hasn’t publicly released that information yet. What we do know to an almost certainty at this point, however, is that the CrowdStrike driver that processes and handles these updates is not very resilient and appears to have inadequate error checking and parameter validation.

Parameter validation means checking to ensure that the data and arguments being passed to a function, and in particular to a kernel function, are valid and good. If they’re not, it should fail the function call, not cause the entire system to crash. But in the CrowdStrike case, they’ve got a bug they don’t protect against, and because their code lives in ring zero with the kernel, a bug in CrowdStrike will necessarily bug check the entire machine and deposit you into the very dreaded recovery bluescreen.

Windows Resilience

Even though this isn’t a Windows issue or a fault with Windows itself, many people have asked me why Windows itself isn’t just more resilient to this type of issue. For example, if a driver fails during boot, why not try to boot next time without it and see if that helps?

And Windows, in fact, does offer a number of facilities like that, going back as far as booting NT with the last known good registry hive. But there’s a catch, and that catch is that CrowdStrike marked their driver as what’s known as a bootstart driver. A bootstart driver is a device driver that must be installed to start the Windows operating system.

Most bootstart drivers are included in driver packages that are in the box with Windows, and Windows automatically installs these bootstart drivers during their first boot of the system. My guess is that CrowdStrike decided they didn’t want you booting at all without their protection provided by their system, but when it crashes, as it does now, your system is completely borked.

Fixing the Issue

Fixing a machine with this issue is fortunately not a great deal of work, but it does require physical access to the machine. To fix a machine that’s crashed due to this issue, you need to boot it into safe mode, because safe mode only loads a limited set of drivers and mercifully can still contend without this boot driver.

You’ll still be able to get into at least a limited system. Then, to fix the machine, use the console or the file manager and go to the path window like windows, and then system32/drivers/crowdstrike. In that folder, find the file matching the pattern c and then a bunch of zeros 291 sys and delete that file or anything that’s got the 291 in it with a bunch of zeros. When you reboot, your system should come up completely normal and operational.

The absence of the update file fixes the issue and does not cause any additional ones. It’s a fair bet that the update 291 won’t ever be needed or used again, so you’re fine to nuke it.

Conclusion

Further references

CrowdStrike IT Outage Explained by a Windows DeveloperYouTube · Dave’s Garage13 minutes, 40 seconds2 days ago

The Aftermath of the World’s Biggest IT Outage

July 22, 2024Aftermath, Attack Technology, Best Practices, Beyond, Business Continuity, Controls, Crisis Management, Cyber Attacks, Cybersecurity, Digital Blackout, Digital era, Global, Governance Risk & Compliance, GRC, Impact, Implications, Incident, Information Technology, IT Governance, IT Outage, IT Service Management, ITSM, Regulatory, Resilience, Strategic Cybersecurity, Technology Trends, Threatsaftermath, attacktechnology, bestpractices, beyond, businesscontinuity, compliance, controls, crisismanagement, cyberattacks, cybersecurity, digitalblackout, digitalera, global, governance, GRC, impact, implications, incident, informationtechnology, ITgovernance, itoutage, ITServiceManagement, ITSM, regulatory, resilience, risk, strategiccybersecurity, technologytrends, threatsadmin

The Great Digital Blackout: Fallout from the CrowdStrike-Microsoft Outage

i. Introduction

On a seemingly ordinary Friday morning, the digital world shuddered. A global IT outage, unprecedented in its scale, brought businesses, governments, and individuals to a standstill. The culprit: a faulty update from cybersecurity firm CrowdStrike, clashing with Microsoft Windows systems. The aftershocks of this event, dubbed the “Great Digital Blackout,” continue to reverberate, raising critical questions about our dependence on a handful of tech giants and the future of cybersecurity.

ii. The Incident

A routine software update within Microsoft’s Azure cloud platform inadvertently triggered a cascading failure across multiple regions. This outage, compounded by a simultaneous breach of CrowdStrike’s security monitoring systems, created a perfect storm of disruption. Within minutes, critical services were rendered inoperative, affecting millions of users and thousands of businesses worldwide. The outage persisted for 48 hours, making it one of the longest and most impactful in history.

iii. Initial Reports and Response

The first signs that something was amiss surfaced around 3:00 AM UTC when users began reporting issues accessing Microsoft Azure and Office 365 services. Concurrently, Crowdstrike’s Falcon platform started exhibiting anomalies. By 6:00 AM UTC, both companies acknowledged the outage, attributing the cause to a convergence of system failures and a sophisticated cyber attack exploiting vulnerabilities in their systems.

Crowdstrike and Microsoft activated their incident response protocols, working around the clock to mitigate the damage. Microsoft’s global network operations team mobilized to isolate affected servers and reroute traffic, while Crowdstrike’s cybersecurity experts focused on containing the breach and analyzing the attack vectors.

iv. A Perfect Storm: Unpacking the Cause

A. The outage stemmed from a seemingly innocuous update deployed by CrowdStrike, a leading provider of endpoint security solutions. The update, intended to bolster defenses against cyber threats, triggered a series of unforeseen consequences. It interfered with core Windows functionalities, causing machines to enter a reboot loop, effectively rendering them unusable.

B. The domino effect was swift and devastating. Businesses across various sectors – airlines, hospitals, banks, logistics – found themselves crippled. Flights were grounded, financial transactions stalled, and healthcare operations were disrupted.

C. The blame game quickly ensued. CrowdStrike, initially silent, eventually acknowledged their role in the outage and apologized for the inconvenience. However, fingers were also pointed at Microsoft for potential vulnerabilities in their Windows systems that allowed the update to wreak such havoc.

v. Immediate Consequences (Businesses at a Standstill)

The immediate impact of the outage was felt by businesses worldwide.

A. Microsoft: Thousands of companies dependent on Microsoft’s Azure cloud services found their operations grinding to a halt. E-commerce platforms experienced massive downtimes, losing revenue by the minute. Hospital systems relying on cloud-based records faced critical disruptions, compromising patient care.

Businesses dependent on Azure’s cloud services for their operations found themselves paralyzed. Websites went offline, financial transactions were halted, and communication channels were disrupted.

B. Crowdstrike: Similarly, Crowdstrike’s clientele, comprising numerous Fortune 500 companies, grappled with the fallout. Their critical security monitoring and threat response capabilities were significantly hindered, leaving them vulnerable.

vi. Counting the Costs: Beyond Downtime

The human and economic toll of the Great Digital Blackout is still being calculated. While initial estimates suggest billions of dollars in lost productivity, preliminary estimates suggest that the outage resulted in global economic losses exceeding $200 billion, the true cost extends far beyond financial figures. Businesses across sectors reported significant revenue losses, with SMEs particularly hard-hit. Recovery and mitigation efforts further strained financial resources, and insurance claims surged as businesses sought to recoup their losses.

Erosion of Trust: The incident exposed the fragility of our increasingly digital world, eroding trust in both CrowdStrike and Microsoft. Businesses and organizations now question the reliability of security solutions and software updates.
Supply Chain Disruptions: The interconnectedness of global supply chains was thrown into disarray.Manufacturing, shipping, and logistics faced delays due to communication breakdowns and the inability to process orders electronically.
Cybersecurity Concerns: The outage highlighted the potential for cascading effects in cyberattacks. A seemingly minor breach in one system can have a devastating ripple effect across the entire digital ecosystem.

vii. Reputational Damage

Both Microsoft and CrowdStrike suffered severe reputational damage. Trust in Microsoft’s Azure platform and CrowdStrike’s cybersecurity solutions was shaken. Customers, wary of future disruptions, began exploring alternative providers and solutions. The incident underscored the risks of over-reliance on major service providers and ignited discussions about diversifying IT infrastructure.

viii. Regulatory Scrutiny

In the wake of the outage, governments and regulatory bodies worldwide called for increased oversight and stricter regulations. The incident highlighted the need for robust standards to ensure redundancy, effective backup systems, and rapid recovery protocols. In the United States, discussions about enhancing the Cybersecurity Maturity Model Certification (CMMC) framework gained traction, while the European Union considered expanding the scope of the General Data Protection Regulation (GDPR) to include mandatory resilience standards for IT providers.

ix. Data Security and Privacy Concerns

One of the most concerning aspects of the outage was the potential exposure of sensitive data. Both Microsoft and Crowdstrike store vast amounts of critical and confidential data. Although initial investigations suggested that the attackers did not exfiltrate data, the sheer possibility raised alarms among clients and regulatory bodies worldwide.

Governments and compliance agencies intensified their scrutiny, reinforcing the need for robust data protection measures. Customers demanded transparency about what data, if any, had been compromised, leading to an erosion of trust in cloud services.

x. Root Causes and Analysis

Following the containment of the outage, both Crowdstrike and Microsoft launched extensive investigations to determine the root causes. Preliminary reports cited a combination of factors:

A. Zero-Day Exploits: The attackers leveraged zero-day vulnerabilities in both companies’ systems, which had not been previously detected or patched.

B. Supply Chain Attack: A key supplier providing backend services to both companies was compromised, allowing the attackers to penetrate deeper into their networks.

C. Human Error: Configuration errors and lack of stringent security checks at critical points amplified the impact of the vulnerabilities.

D. Coordinated Attack: Cybersecurity analysts suggested that the attack bore the hallmarks of a highly coordinated and well-funded group, potentially a nation-state actor, given the sophistication and scale. The alignment of the outage across multiple critical services pointed to a deliberate and strategic attempt to undermine global technological infrastructure.

xi. Response Strategies

A. CrowdStrike’s Tactics

Swift Containment: Immediate action was taken to contain the breach. CrowdStrike’s incident response teams quickly identified and isolated the compromised segments of their network to prevent further penetration.
Vulnerability Mitigation: Patches were rapidly developed and deployed to close the exploited security gaps. Continuous monitoring for signs of lingering threats or additional vulnerabilities was intensified.
Client Communication: Transparency became key. CrowdStrike maintained open lines of communication with its clients, providing regular updates, guidance on protective measures, and reassurance to mitigate the trust deficit.

B. Microsoft’s Actions

Global Response Scaling: Leveraging its extensive resources, Microsoft scaled up its global cybersecurity operations. Frantic efforts were made to stabilize systems, restore services, and strengthen defenses against potential residual threats.
Service Restoration: Microsoft prioritized the phased restoration of services. This approach ensured that each phase underwent rigorous security checks to avoid reintroducing vulnerabilities.
Collaboration and Information Sharing: Recognizing the widespread impact, Microsoft facilitated collaboration with other tech firms, cybersecurity experts, and government agencies. Shared intelligence helped in comprehending the attack’s full scope and in developing comprehensive defense mechanisms.

xii. Broad Implications

A. Evolving Cyber Threat Landscape

Increased Sophistication: The attack underscored the evolving sophistication of cyber threats. Traditional security measures are proving insufficient against highly organized and well-funded adversaries.
Proactive Security Posture: The event emphasized the need for a proactive security stance, which includes real-time threat intelligence, continuous system monitoring, and regular vulnerability assessments.

B. Trust in Cloud Computing

Cloud Strategy Reevaluation: The reliance on cloud services came under scrutiny. Organizations began rethinking their cloud strategies, weighing the advantages against the imperative of reinforcing security protocols.
Strengthened Security Measures: There is a growing emphasis on bolstering supply chain security. Companies are urged to implement stringent controls, cross-verify practices with their vendors, and engage in regular security audits.

xiii. A Catalyst for Change: Lessons Learned

The Great Digital Blackout serves as a stark reminder of the need for a comprehensive reevaluation of our approach to cybersecurity and technology dependence. Here are some key takeaways:

Prioritize Security by Design: Software development and security solutions need to prioritize “security by design” principles. Rigorous testing and vulnerability assessments are crucial before deploying updates.
Enhanced Cybersecurity: The breach of CrowdStrike’s systems highlighted potential vulnerabilities in cybersecurity frameworks. Enhanced security measures and continuous monitoring are vital to prevent similar incidents.
Diversity and Redundancy: Over-reliance on a few tech giants can be a vulnerability. Diversifying software and service providers, coupled with built-in redundancies in critical systems, can mitigate the impact of such outages.
Redundancy and Backup: The incident underscored the necessity of having redundant systems and robust backup solutions. Businesses are now more aware of the importance of investing in these areas to ensure operational continuity during IT failures.
Disaster Recovery Planning: Effective disaster recovery plans are critical. Regular drills and updates to these plans can help organizations respond more efficiently to disruptions.
Communication and Transparency: Swift, clear communication during disruptions is essential. Both CrowdStrike and Microsoft initially fell short in this area, causing confusion and exacerbating anxieties.
Regulatory Compliance: Adhering to evolving regulatory standards and being proactive in compliance efforts can help businesses avoid penalties and build resilience.
International Collaboration: Cybersecurity threats require an international response. Collaboration between governments, tech companies, and security experts is needed to develop robust defense strategies and communication protocols.

xiv. The Road to Recovery: Building Resilience

The path towards recovery from the Great Digital Blackout is multifaceted. It involves:

Post-Mortem Analysis: Thorough investigations by CrowdStrike, Microsoft, and independent bodies are needed to identify the root cause of the outage and prevent similar occurrences.
Investing in Cybersecurity Awareness: Educating businesses and individuals about cyber threats and best practices is paramount. Regular training and simulation exercises can help organizations respond more effectively to future incidents.
Focus on Open Standards: Promoting open standards for software and security solutions can foster interoperability and potentially limit the impact of individual vendor issues.

xv. A New Era of Cybersecurity: Rethinking Reliance

The Great Digital Blackout serves as a wake-up call. It underscores the need for a more robust, collaborative, and adaptable approach to cybersecurity. By diversifying our tech infrastructure, prioritizing communication during disruptions, and fostering international cooperation, we can build a more resilient digital world.

The event also prompts a conversation about our dependence on a handful of tech giants. While these companies have revolutionized our lives, the outage highlighted the potential pitfalls of such concentrated power.

xvi. Conclusion

The future of technology may involve a shift towards a more decentralized model, with greater emphasis on data sovereignty and user control. While the full impact of the Great Digital Blackout is yet to be fully understood, one thing is certain – the event has irrevocably altered the landscape of cybersecurity, prompting a global conversation about how we navigate the digital age with greater awareness and resilience.

This incident serves as a stark reminder of the interconnected nature of our digital world. As technology continues to evolve, so too must our approaches to managing the risks it brings. The lessons learned from this outage will undoubtedly shape the future of IT infrastructure, making it more robust, secure, and capable of supporting the ever-growing demands of the digital age.

xvii. Further references

Microsoft IT outages live: Dozens more flights cancelled …The Independenthttps://www.independent.co.uk › tech › microsoft-crow…

Helping our customers through the CrowdStrike outageMicrosofthttps://news.microsoft.com › en-hk › 2024/07/21 › helpi…

CrowdStrike-Microsoft Outage: What Caused the IT MeltdownThe New York Timeshttps://www.nytimes.com › 2024/07/19 › business › mi…

Microsoft IT outage live: Millions of devices affected by …The Independenthttps://www.independent.co.uk › tech › microsoft-outa…

What’s next for CrowdStrike, Microsoft after update causes …USA Todayhttps://www.usatoday.com › story › money › 2024/07/20

CrowdStrike and Microsoft: What we know about global IT …BBChttps://www.bbc.com › news › articles

Chaos persists as IT outage could take time to fix …BBChttps://www.bbc.com › news › live

Huge Microsoft Outage Linked to CrowdStrike Takes Down …WIREDhttps://www.wired.com › Security › security

CrowdStrike’s Role In the Microsoft IT Outage, ExplainedTime Magazinehttps://time.com › Tech › Internet

Crowdstrike admits ‘defect’ in software update caused IT …Euronews.comhttps://www.euronews.com › Next › Tech News

Microsoft: CrowdStrike Update Caused Outage For 8.5 …CRNhttps://www.crn.com › news › security › microsoft-cro…

It could take up to two weeks to resolve ‘teething issues …Australian Broadcasting Corporationhttps://www.abc.net.au › news › microsoft-says-crowdst…

Microsoft-CrowdStrike Outage Causes Chaos for Flights …CNEThttps://www.cnet.com › Tech › Services & Software

Leveraging SFIA for Objective Downsizing: Safeguarding Your Digital Team’s Future

April 9, 2024Agile, Benefits, Best Practices, Capabilities, Coaching, Competence, Crisis, Crisis Management, Critical, Data, Data Analytics, Digital Age, Digital Transformation, Effective, Framework, Governance Risk & Compliance, GRC, How To, Implementation, Information Technology, Job, Knowledge Area, Layoff, SFIA, Skill set, Stakeholders, Strategydigital, downsizing, future, leveraging, objective, safeguard, SFIA, teamadmin

Utilizing the Skills Framework for the Information Age to Strategically Reduce Staff: Protecting the Future of Your Digital Workforce

In an ever-evolving digital landscape, organizations are continuously faced with the challenge of aligning their workforce capabilities with the strategic objectives and technological demands of the market. This occasionally necessitates the difficult decision of downsizing.

However, when approached with a strategic framework such as the Skills Framework for the Information Age (SFIA), downsizing can be managed in a way that not only reduces the workforce but also strategically refines it, ensuring that the remaining team is more aligned with future goals.

i. Understanding SFIA

The Skills Framework for the Information Age (SFIA) provides a comprehensive model for the identification of skills and competencies required in the digital era. It categorizes skills across various levels and domains, offering a structured approach to workforce development, assessment, and strategic alignment. By mapping out competencies in detail, SFIA allows organizations to objectively assess the skills available within their teams against those required to achieve their strategic goals.

ii. SFIA: A Framework for Fair and Transparent Downsizing

SFIA offers a standardized way to assess and compare employee skill sets. By leveraging SFIA, organizations can:

o Identify critical skills: Pinpoint the skills essential for current and future digital initiatives.

o Evaluate employee capabilities: Assess employees objectively based on their SFIA profiles, ensuring data-driven decisions.

o Maintain a strong digital core: Retain top talent with the most crucial skill sets to safeguard the team’s future.

iii. Strategic Downsizing with SFIA: A Guided Approach

A. Analyzing Current and Future Skill Requirements

The first step in leveraging SFIA for downsizing involves a thorough analysis of the current skill sets within the organization against the backdrop of the future skills required to meet evolving digital strategies. This diagnostic phase is critical in identifying not just surplus roles but also areas where the organization is at risk of skill shortages.

B. Objective Assessment and Decision Making

With SFIA, the assessment of each team member’s skills and competencies becomes data-driven and objective, mitigating biases that can often cloud downsizing decisions. This framework enables managers to make informed decisions about which roles are essential for future growth and which are redundant or can be merged with others for efficiency.

C. Skill Gaps and Redeployment

Identifying skill gaps through SFIA provides insights into potential areas for redeployment within the organization. Employees whose roles have been identified as redundant might possess other skills that are underutilized or looko could be valuable in other departments. This not only minimizes job losses but also strengthens other areas of the business.

D. Future-proofing Through Upskilling

SFIA also helps organizations to future-proof their remaining workforce through targeted upskilling. By understanding the precise skills that will be needed, companies can implement training programs that are highly relevant and beneficial, ensuring that their team is not only lean but also more capable and aligned with future digital challenges.

E. Communication and Support Structures

Effective communication is crucial during downsizing. Using the insights gained from the SFIA framework, leaders can better articulate the reasons behind the restructuring decisions, focusing on the strategic realignment towards future goals. Additionally, offering support structures for both departing and remaining employees, such as career counseling or upskilling opportunities, can help in maintaining morale and trust.

iv. Benefits of Leveraging SFIA for Downsizing

A. Objective Skills Assessment:

o SFIA facilitates an objective assessment of employees’ skills and competencies, enabling organizations to identify redundancies, skill gaps, and areas of expertise within the digital team.

o By basing downsizing decisions on skills rather than job titles or seniority, organizations can ensure alignment with strategic objectives and retain critical capabilities.

B. Strategic Workforce Planning:

o SFIA supports strategic workforce planning by providing insights into the current skill landscape, future skill requirements, and potential areas for development within the digital team.

o Organizations can use this information to align workforce capabilities with evolving business needs, anticipate skill shortages, and proactively address talent gaps.

C. Efficient Resource Allocation:

o By leveraging SFIA to identify redundancies or underutilized skills, organizations can optimize resource allocation and streamline the digital team’s structure.

o This ensures that resources are allocated effectively to high-priority projects and initiatives, maximizing productivity and return on investment.

D. Retaining Critical Capabilities:

o SFIA enables organizations to identify and retain employees with critical skills and expertise essential for the success of digital initiatives.

o By offering redeployment opportunities, upskilling programs, or knowledge transfer initiatives, organizations can retain valuable talent and maintain continuity in project delivery and innovation.

E. Enhancing Employee Engagement:

o Involving employees in the skills assessment process and offering opportunities for redeployment or skills development demonstrates a commitment to employee development and engagement.

o This approach fosters a positive organizational culture, enhances morale, and mitigates the negative impact of downsizing on remaining staff.

v. Beyond Downsizing: Building a Future-Proof Digital Team

While SFIA can aid in objective downsizing, it also promotes long-term digital team development:

o Skills gap analysis: Identify skill deficiencies across the team and implement training programs to bridge those gaps.

o Targeted upskilling: Invest in upskilling initiatives aligned with SFIA to prepare your team for future digital challenges.

o Succession planning: Leverage SFIA data to develop succession plans and cultivate future digital leaders.

vi. Conclusion

Downsizing, especially within digital and tech teams, poses the risk of eroding an organization’s competitive edge if not handled with foresight and precision.

By employing the SFIA framework, businesses can approach this delicate process objectively, ensuring that decisions are made with a clear understanding of the skills and competencies that will drive future success.

This not only helps in retaining a robust digital capability amidst workforce reduction but also aligns employee growth with the evolving needs of the organization.

Ultimately, leveraging SFIA for objective downsizing serves as a strategic maneuver to safeguard your digital team’s future, ensuring the organization emerges stronger and more resilient in the face of challenges.

vii. Further references

LinkedIn · SkillsTX8 reactions · 5 months agoLeveraging SFIA for Objective Downsizing: Safeguarding Your Digital Team’s Future

LinkedIn · John Kleist III10+ reactions · 11 months agoNavigating Technology Layoffs: Why Using a SFIA Skills Inventory is the Ideal Approach

SFIAhttps://sfia-online.org › about-sfiaSFIA and skills management — English

International Labour Organizationhttps://www.ilo.org › publicPDF▶ Changing demand for skills in digital economies and societies

Digital Education Resource Archivehttps://dera.ioe.ac.uk › eprint › evid…Information and Communication Technologies: Sector Skills …

De Gruyterhttps://www.degruyter.com › pdfPreparing for New Roles in Libraries: A Voyage of Discovery

Digital Education Resource Archivehttps://dera.ioe.ac.uk › eprint › evid…Information and Communication Technologies: Sector Skills …

Can a single security framework address information security risks adequately?

April 4, 2024Benefits, Best Practices, Beyond, Coaching, Comparison, Controls, Crisis Management, Cyber Attacks, Cyber risk, Cybersecurity, Digital Transformation, Effective, Framework, Good Security, Governance Risk & Compliance, GRC, Hardware Security, Information Security, Mobile Security, Network Security, Secure SDLC, Security, Security Operations, Software Security, Strategic Cybersecurity, Web SecurityA single, address adequately, governance, security frameworkadmin

Is it possible for a singular security framework to effectively mitigate information security risks?

In the rapidly evolving digital landscape, information security has taken center stage as organizations across the globe face an unprecedented range of cyber threats.

From small businesses to multinational corporations, the push toward digital transformation has necessitated a reevaluation of security strategies to protect sensitive data and maintain operational integrity.

Against this backdrop, many organizations turn to security frameworks as the cornerstone of their information security programs. However, the question remains: Can a single security framework adequately address information security risks?

i. Understanding Security Frameworks

Security frameworks are structured sets of guidelines and best practices designed to mitigate information security risks. They provide a systematic approach to managing and securing information by outlining the policies, controls, and procedures necessary to protect organizational assets. Popular frameworks such as ISO 27001, NIST Cybersecurity Framework, and CIS Controls have been widely adopted across industries.

ii. The Benefits of Security Frameworks

Security frameworks offer several advantages:

o Standardized Approach: They provide a consistent methodology for implementing security controls.

o Risk Identification: They help organizations identify and prioritize security risks.

o Compliance: They can assist with meeting industry regulations and standards.

o Best Practices: They incorporate best practices for information security.

iii. The Argument for a Single Framework

Adopting a single security framework can offer several benefits. For starters, it streamlines the process of developing and implementing a security strategy, providing a clear roadmap for organizations to follow. It also simplifies compliance efforts, as stakeholders have a singular set of guidelines to adhere to. Moreover, a single framework can foster a focused and cohesive security culture within an organization, with all efforts aligned towards the same objectives.

iv. The Challenges

However, relying solely on a single security framework may not be sufficient to address all aspects of information security for several reasons:

A. Diverse Threat Landscape

The cybersecurity landscape is constantly evolving, with new threats emerging regularly. A single framework may not cover all types of threats comprehensively, leaving organizations vulnerable to overlooked risks. For instance, while one framework may focus on network security, it might not adequately address social engineering attacks or insider threats.

B. Industry-Specific Requirements

Different industries have unique security requirements and compliance mandates. A single framework may not align perfectly with industry-specific regulations and standards. Organizations operating in highly regulated sectors, such as healthcare or finance, may need to adhere to multiple frameworks and standards to ensure compliance and mitigate sector-specific risks effectively.

C. Organizational Specificity

Each organization has unique risks based on its industry, size, geographic location, and technological infrastructure. A one-size-fits-all approach may not cater to specific security needs.

D. Scalability and Flexibility

Organizations vary in size, complexity, and technological infrastructure. A one-size-fits-all approach may not accommodate the diverse needs of different organizations. A rigid adherence to a single framework may hinder scalability and flexibility, limiting the organization’s ability to adapt to changing threats and business environments.

E. Comprehensive Coverage

While some frameworks are comprehensive, they may lack depth in certain areas. For instance, a framework may cover a wide range of controls but not delve deeply into specific threats like insider threats or advanced persistent threats (APTs).

F. Emerging Technologies

Rapid advancements in technology, such as cloud computing, IoT, and AI, introduce new security challenges that traditional frameworks may not adequately address. Organizations leveraging cutting-edge technologies require agile security measures that can adapt to the unique risks associated with these innovations. A single framework may struggle to keep pace with the evolving technological landscape.

G. Integration Challenges

Many organizations already have existing security processes, tools, and investments in place. Integrating a new security framework seamlessly with the existing infrastructure can be complex and resource-intensive. A single framework may not easily integrate with other security solutions, leading to fragmented security measures and gaps in protection.

H. Regulatory Requirements

Organizations often operate under multiple regulatory environments. Relying on a single framework may not assure compliance with all the applicable laws and regulations, especially for organizations operating across borders.

v. Towards a Hybrid Approach

Given the limitations of a single-framework approach, organizations are increasingly adopting a hybrid or integrated approach to information security.

This involves leveraging the strengths of multiple frameworks to create a robust, flexible security posture that addresses the specific needs of the organization and adapts to the changing threat landscape.

A. Complementarity: By integrating complementary frameworks, organizations can cover a broader spectrum of security domains, from technical controls to governance and risk management.

B. Flexibility: A hybrid approach allows organizations to adapt their security practices as new threats emerge and as their own operational environments evolve.

C. Regulatory Compliance: Combining frameworks can help ensure that all regulatory requirements are met, reducing the risk of penalties and enhancing trust with stakeholders.

D. Best Practices: An integrated approach enables organizations to benefit from the best practices and insights distilled from various sources, leading to a more mature security posture.

vi. Complementing Frameworks with Best Practices and Custom Strategies

Info-Tech Research Group’s “Assess Your Cybersecurity Insurance Policy” blueprint outlines an approach for organizations to follow in order to adapt to the evolving cyber insurance market and understand all available options. (CNW Group/Info-Tech Research Group)

In addition to utilizing a primary security framework, organizations should integrate industry best practices, emerging security technologies, and custom strategies developed from their own experiences. This includes investing in ongoing employee training, staying updated with the latest cyber threat intelligence, and conducting regular security assessments to identify and mitigate vulnerabilities.

vii. Collaboration and Information Sharing

Collaboration and information sharing with industry peers, regulatory bodies, and security communities can also enhance an organization’s security posture. By sharing insights and learning from the experiences of others, organizations can stay ahead of emerging threats and adapt their security strategies accordingly.

viii. Conclusion

In conclusion, while adopting a single security framework can provide a solid foundation for managing information security risks, it should not be viewed as a panacea.

Organizations must recognize the limitations of a singular approach and supplement it with additional measures to address specific threats, industry requirements, and emerging technologies.

A holistic cybersecurity strategy should leverage multiple frameworks, tailored controls, continuous monitoring, and a proactive risk management mindset to effectively mitigate the ever-evolving cyber threats.

By embracing diversity in security approaches and staying vigilant, organizations can better safeguard their valuable assets and sensitive information in today’s dynamic threat landscape.

ix. Further references

Academia.eduhttps://www.academia.edu › CAN_…can a single security framework address information security risks adequately?

Galehttps://go.gale.com › i.doCan a single security framework address information security risks adequately?

Semantic Scholarhttps://www.semanticscholar.org › …CAN A SINGLE SECURITY FRAMEWORK ADDRESS INFORMATION …

DergiParkhttps://dergipark.org.tr › art…PDFAddressing Information Security Risks by Adopting Standards

TechTargethttps://www.techtarget.com › tipTop 12 IT security frameworks and standards explained

JD Suprahttps://www.jdsupra.com › legalnewsWhat is an Information Security Framework and Why Do I Need One? | J.S. Held

LinkedInhttps://www.linkedin.com › adviceWhat are the steps to choosing the right security framework?

Secureframehttps://secureframe.com › blog › se…Essential Guide to Security Frameworks & 14 Examples

MDPIhttps://www.mdpi.com › …Risk-Management Framework and Information-Security Systems for Small …

LinkedInhttps://www.linkedin.com › adviceWhat is the best way to implement a security framework for your business?

AuditBoardhttps://www.auditboard.com › blogIT Risk Management: Definition, Types, Process, Frameworks

ICU Computer Solutionshttps://www.icucomputer.com › postCyber Security Risk Assessment: Components, Frameworks, Tips, and …

Isora GRChttps://www.saltycloud.com › blogBuilding an Information Security Risk Management (ISRM) Program, Complete …

https://secureframe.com/blog/security-frameworks

Creating a Well-Structured Crisis Management Plan

March 2, 2024Creating, Crisis Management, Plan, Well-Structuredcreatingadmin

Building Resilience: A Guide to Creating a Well-Structured Crisis Management Plan

In today’s fast-paced and often unpredictable business environment, crises are not a matter of “if” but “when.” These crises can range from natural disasters to financial downturns, cyber-attacks, or public relations nightmares.

Being prepared with a well-structured crisis management plan can significantly mitigate the impact of these crises on your business, employees, and stakeholders.

i. Understanding Crisis Management

Crisis management refers to the identification, assessment, understanding, and alleviation of significant negative events. It involves pre-crisis planning and preparation, crisis response or management, and post-crisis recovery. A robust CMP not only aims to mitigate the impacts of a crisis but also prepares an organization for quick recovery and continued operation post-crisis.

ii. Components of a Crisis Management Plan

A. Crisis Management Team (CMT): The core of any CMP, this team is responsible for making critical decisions. It should represent a cross-section of the organization’s departments and include members with decision-making capabilities.

B. Risk Assessment and Crisis Identification: Understanding what constitutes a crisis for your organization is critical. Identify potential risks and vulnerabilities through a thorough risk assessment process.

C. Communication Plan: Effective communication is vital during a crisis. The plan should outline internal and external communication strategies, including templates for press releases, social media responses, and stakeholder notifications.

D. Roles and Responsibilities: Clearly define the roles and responsibilities of the CMT and other stakeholders in the event of a crisis. This ensures that everyone knows what is expected of them.

E. Response Strategies: Develop specific strategies for different types of crises. This might involve evacuation plans, data recovery processes, or other operational contingencies.

F. Training and Testing: Regular training sessions and drills for the CMT and employees ensure preparedness. Simulate different crisis scenarios to test the effectiveness of the CMP.

G. Recovery and Post-Crisis Analysis: Outline steps for business continuity and recovery. After a crisis, conduct a thorough analysis to identify lessons learned and improve future crisis management efforts.

iii. Step-by-Step Guide to Creating a Crisis Management Plan

Step 1: Assemble the Crisis Management Team

Start by selecting a diverse group of individuals from different departments who can bring various perspectives and skills to the table.

Step 2: Conduct a Risk Assessment

Identify potential crises that could impact your organization. Consider factors such as likelihood, impact, and readiness to respond.

Step 3: Develop the Communication Plan

Craft a detailed communication strategy that addresses both internal and external stakeholders. Determine the channels of communication that will be most effective in a crisis.

Step 4: Define Roles and Responsibilities

Assign specific tasks and responsibilities to team members. Clear delegation ensures a cohesive response effort.

Step 5: Formulate Response Strategies

Create detailed action plans for responding to the identified risks. Include immediate actions, resources needed, and stakeholders involved.

Step 6: Outline Key Procedures

Your plan should outline specific procedures for responding to different types of crises. This includes evacuation plans, data recovery processes, and steps for addressing media inquiries. Ensure these procedures are practical and can be swiftly implemented.

Step 7: Implement Training and Drills

Preparation is key to effective crisis management. Regular training sessions and drills should be conducted to ensure that your team is ready to implement the crisis management plan. Simulations of various scenarios will help identify any weaknesses in your plan and provide an opportunity for improvements.

Step 8: Establish Recovery Procedures

Ensure your CMP includes steps for returning to normal operations. Consider the resources needed for recovery and strategies for managing post-crisis communication.

Step 9: Technology Integration

Leverage technology to enhance your crisis management capabilities. Implement tools for real-time communication, data analysis, and incident tracking. Utilize social media monitoring to stay aware of public sentiment and address misinformation promptly. Technological integration enhances the agility and responsiveness of your crisis management efforts.

Step 10: Legal and Regulatory Compliance

Ensure that your crisis management plan adheres to legal and regulatory requirements. Be aware of industry-specific regulations and compliance standards. Work closely with legal advisors to navigate potential legal implications and obligations during a crisis.

Step 11: Monitor and Update

The external and internal business environment is constantly changing, which can introduce new risks. Continuously monitor these changes and review your crisis management plan at regular intervals or after any major business change. Updating your plan ensures it remains relevant and effective.

Step 12: Build Relationships with Key Partners

Establishing strong relationships with emergency services, local authorities, and other key partners is essential. Such partnerships can provide valuable support and resources during a crisis.

Step 13: Ensure Financial Preparedness

Ensure that your organization has adequate financial reserves or insurance to handle potential crises. Financial preparedness can significantly alleviate the stress of managing a crisis and aid in a quicker recovery.

Step 14: Reflect and Learn from Crises

After a crisis, it’s crucial to conduct a post-mortem analysis to understand what went well and what didn’t. This reflection period is an opportunity to learn from the experience and make necessary adjustments to your crisis management plan.

iv. Conclusion

Creating a well-structured crisis management plan requires careful planning, teamwork, and ongoing evaluation. By anticipating potential crises and establishing a clear action plan, your organization can navigate through tumultuous times with greater resilience and confidence.

A well-structured crisis management plan is invaluable in today’s uncertain business climate. It equips organizations with the tools and strategies needed to respond effectively to crises, minimize damage, and expedite recovery.

By following the outlined steps and ensuring each component of the CMP is meticulously crafted, organizations can navigate through crises with confidence and resilience.