Impact of Outage on Business Continuity and Resilience

The outage emphasized the need for resilience and diversified dependencies in enterprise landscapes.

### CrowdStrike Outage: Lessons Learned and the Importance of Resilience
* 🔒  The recent CrowdStrike outage highlighted the **interconnected nature of today's technology landscape**, impacting **8.5 million critical computers** and various industries.
* 💻  The fix for the outage was fairly manual and time-consuming, emphasizing the need for **efficient incident response and recovery processes**.
* 🛡️  The outage underscored the importance of **resilience in business continuity**, with companies like Delta facing **significant disruptions** due to the incident.
* 🔍  Sanjay Poonen emphasized the need for **thorough testing and preparedness for various scenarios**, including **human error, malicious attacks, or natural disasters**.
* 📊  Concentration risk was a key concern, as many organizations heavily relied on CrowdStrike's services, leading to **widespread impacts**.
* 🚨  Poonen described the outage as a "**warning shot**," prompting organizations to **reassess their dependencies and resilience strategies**.
* 📈  The incident serves as a **wake-up call for enterprises** to diversify their technology dependencies and build a **more calculated mix of solutions** for increased resilience.

What's the lasting effect of the outage?
Yeah, we, you know, we live in an extremely interconnected world right now. Cloud devices, servers, and CrowdStrike is a popular technology. We use it as well. And so when something like this happens, there is a long tail. And it has to be, you know, it has to be cleaned up. The lessons here and the fix, for the most part, was fairly manual. So it took time. It wasn't a complicated fix, but it took time. And I think we're coming out of it. But there's a lot of learnings that we're also getting out of this process.
Sanjay, did you have any cause for concern ahead of this about prior updates that CrowdStrike could run, that there might have been anything that would signal that such an event could occur? They're a security company you trust. You tend to trust security companies. And, you know, and so there was no there.

was nothing before this specifically
about CrowdStrike that would be of concern.
What what is always of concern when you have a large number of catches and a
large number of connected systems and dependencies, is your ability to really
stage a patch, test it in your particular environment because no two
environments are the same. And then once you know that you've got
it working where you need it to push it out, know what security the window that
you have between a critical patch and your ability to deploy it is very, very
small. And so you tend to trust more and push
faster. We have heard from across industries,
particularly from the airline industry, the Delta CEO coming out and apologizing
because still today there are issues that are affecting their ability to
serve customers. Sanjay, when it comes to business
continuity, what could a company like Delta have done to prevent the fallout
that we now see was 3500 plus cancellations on Saturday?
You know, Caroline, it's about

about resilience.
And people use the word resilience in sort of a Broadway.
But for us, it's about businesses' ability to get back to life, regardless
of the catastrophic event. It could have been human error in this
case, possibly human error. It could be in a malicious, it could be
internal, external malicious. It could be a natural disaster.
So what we do is help our customers build a capability, build a platform,
build a muscle to repeat a testing and scale, so that in the event that
something goes sideways, you've tried and tested the ability for your business
to come back to life. And I think, I think with everything
we've got going on as enterprises, not enough time is spent on practical
capabilities of resilience and more sort of you tend to lean on on the academic
thought process. Yes, we've got this list, we've done
this. We've, we've, we've written this up. But how much of your enterprise have you
actually tested with a deep degree of

confidence?
And that's what we try to enable our customers to do.
Sanjay, I wrote in my Tech Daily column this morning about concentration risk,
the idea that so many corporates and government entities relied on
CrowdStrike, but also that 8.5 million computers. It was the most critical of
computers that were impacted. How could have that been mitigated or prevented?
It's been think of it as a warning shot. We've all been sort of sitting back and
saying, okay, so what does my fleet look like?
What do my servers look like? What are my orders?
You know, what are my users working with? And it almost makes you take a step back
and say, we need to have a very calculated mix so that you're not
overreliant or overdependent on any one environment because that's part of
resilience. You know, that is exactly part of
resilience. And I think for everyone, this
weekend's been a bit of a wakeup call to

say, okay, where am I overdependent or
don't have enough controls, or could be more resilient.
And I think, you know, for all the negative outcome of something like this, the positive takeaway, if you can, is, let's go back and make sure we are very calculated about how we build out the enterprise landscape.

Outages, Hacks and This Year's Lessons for Tech

Welcome to the Bloomberg Technology YouTube channel. Subscribe for original series and mini-docs on game-changing technologies, profiles on innovators, live conversations with experts, and breaking technology news & analysis from Bloomberg TV.

Bloomberg Technology

The Lingering Impact of the Recent Outage

The outage had a long-lasting effect due to the manual and time-consuming fix process.

There were no prior signals of the event from CrowdStrike that could have caused concern.

The tight window for deploying critical patches raises challenges for testing and deployment in interconnected systems, as seen in the ongoing issues faced by the airline industry.

Business resilience is about the ability to recover from catastrophic events, whether due to human error, malicious acts, or natural disasters.

The focus should be on building a tested and scalable capability to bring the business back to life, rather than just relying on academic theories.

Many enterprises overlook the practical testing of their resilience capabilities, instead of simply relying on written plans.

The Significance of Diversification in Risk Management

Concentration risk in relying on a single entity like CrowdStrike has led to a critical impact on 8.

This situation serves as a warning to businesses to diversify and avoid overdependence on any single environment for resilience.

The recent events have been a wakeup call for the importance of having a calculated mix of resources to mitigate and prevent such risks.

Building a Resilient Enterprise Landscape

Being more calculated in building the enterprise landscape can help identify overdependence and lack of controls.

This, in turn, can improve resilience and mitigate negative outcomes.

The focus should be on finding a balance to avoid overdependence and enhance overall control and resilience.