As we saw on the back of Friday’s mass IT outage: with technology, come risks – to companies and customers alike.

The global ripple effect of last week’s CrowdStrike incident illustrates the interconnectivity across the supply chain and concentration risk in the market.

As experts now warn of possible further risks as criminals seek to exploit the ongoing IT issues through phishing, I would suggest some key steps to be taken strategically to ensure that this situation does not impact the customers in future, such that trust is restored longer term.

Key questions the incident raises

How such a failure can occur on a global scale? 
Friday’s global outage illustrates the great fragility of the world’s core IT infrastructure.

Software vendors have become so large and so interconnected that their failures can damage the global economic system and tens of millions of customers.

The key challenge is the over-reliance of companies on a single major provider for their systems, while not mitigating the concentration risk by having several solutions in place to avoid IT outages such as the one we saw on Friday, such that if one of the systems is impacted, there is a workaround in place that could be accessed fast.

This is important not only from the technology side, but also from the people and processes, e.g. how fast can companies restore back their material services to continue to be able to provide the service to their customers and ensure continued trust.

Why do so many systems depend on just a single vendor?
In some of the cases the single vendor is a choice due to cost. The rationale is that the vendor is so big and powerful (Microsoft) that companies do not anticipate it could ever go down.

This is similar with cloud service providers, e.g. Azure, where we see banks building its entire digital infrastructure through a single provider in anticipation that the chance of the outage happening is extremely low and there won’t be a damage to their material services.

The challenge of course is that given that multiple companies rely on the same provider, once the provider goes down, it inevitably impacts millions of customers. This is what we saw with Cloudstrike just last week, a company that has become so large and so interconnected that its failures caused damage on a global scale.

What should regulators do?
Existing regulations by FCA and EBA do have provisions in place that call out concentration risk in the market and the fact that companies should be doing much more to mitigate it.

There are other regulations globally that work to similar effect. However, I have seen that in practice there has been a lot of opposition from businesses to invest into several providers (e.g. cloud providers) given the cost, the fact that the outage probability is typically considered extremely unlikely given the historical probabilities.

I believe that going forward there will be a much bigger push from regulators to mitigate concentration risk, at the level of the company but also at the level of the providers that are available to provide the service. I anticipate both tighter regulations, but also tighter scrutiny from regulators should any company prioritise the cost and efficiency over the safety and security of their operations.

Will this outage be costly to taxpayers? Why?
I think it will be costly for everyone, whether the contributions are spent directly on addressing this challenge today and thinking more strategically into the future. This Global outage could invite greater political and regulatory scrutiny.

I would anticipate that taxpayer money will be funding the direct impact of the IT outage, but more importantly the longer-term remediation in future, including having the more robust policies and processes in place from the regulator and the businesses to keep us as customers safe and secure.

Key lessons learned

Communication
Communication is essential to support the external and internal image of both CrowdStrike and the businesses impacted globally to rebuild the trust with those impacted. I would anticipate that in the next couple of days, there will be communication on crucial steps that will be taken, not only at company level, but at governmental and regulatory levels to mitigate these risks in future, so that trust is restored longer term.

Interconnectivity
The global ripple effect of this outage illustrates the level of interconnectivity and complexity within the supply chain and concentration risk in this market.

We need to look holistically at the supply chain infrastructure that’s providing systems services as well as products, investing into operational resilience across data, technology, third parties, people and processes. Material services should be identified and prioritised to ensure a proportionate response.

Disaster Recovery Plans
This could be a wake-up call for businesses to invest into tried and tested disaster recovery plans, which in many cases unfortunately remain more as a paper-based exercise rather than a plan that has been battle tested at scale across vital simulation scenarios, including extremely unlikely crisis scenarios like this one.

Concentration Risk
Software vendors like CrowdStrike have become so large and so interconnected that their failures can damage the global economic system and tens of millions of customers globally.

It is key that companies, but also governments and the regulatory bodies, be more mindful and perhaps concerned about systemic or concentration risk of being dependent on a single major provider.

Recommended reading

• Survey: 75% of Businesses Block GenAI to Protect Data
• Data Governance A Cornerstone to Better AI
• Mass IT Outages Reported Worldwide

While it was Cloudstrike and Microsoft this time, it could be that cloud giants like Amazon or Google could go down on another occasion, and the impact would be every bit as detrimental.

From the government’s perspective, there has to be careful impact monitoring of the situation, as this would help us build the nation’s ability and resilience to respond to similar events.

As for the regulators, I would anticipate them being more joined up in protecting customers and building digital trust. In addition, having a much bigger push to mitigate concentration risk, not only at company level, but also at the level of the providers that are available in the market that are distributing end-to end-services.

I anticipate both tighter regulations, including the incoming Digital Operational Resilience Act (DORA) implementation, but also tighter scrutiny from the regulators should companies prioritise the cost and efficiency over the safety and security of their customers.