Global tech outage highlights the need to balance speed with security |
Writing for the Wall Street Journal, James Rundle and Belle Lin say Friday’s tech outage following a defective update from cybersecurity company CrowdStrike – which was designed to refresh code in the firm’s threat-detection software - raises questions about automating software upgrades and about whether a handful of dominant suppliers in the security software market dangerously concentrates risk. CrowdStrike was responsible for about 15% of the security software market in 2023 based on revenue, second to Microsoft’s roughly 40%, according to research firm Gartner. “There’s always issues with concentration risk,” observes Neil MacDonald, a Gartner vice president. “The vendor providing the capability has a responsibility to deliver service that’s resilient.” Meanwhile, Lee McKnight, an associate professor in the School of Information Studies at Syracuse University, says: “Faulty patches and updates happen all the time. What’s different now is that the scale of these cloud services are so massive.” Instead of turning off automatic updates altogether, security and IT leaders are advised to place extra scrutiny on software updates, even if they originate from “trusted” vendors. Chief information officers and chief information security officers “need to assess where manual intervention makes sense as a layer on top of auto-updates,” says Andy Sharma, CISO of Redwood Software.