You have to understand the business resilience of your vendor and supplier base. The CrowdStrike outage wasn't a cyberattack. It wasn't a malicious insider doing something nefarious. It was a regular process that SaaS solutions go through all the time to update their products. That doesn't make it any less damaging to operational health though. Understanding your vendors' business resilience ultimately makes you more resilient. So get on that.
⚠️ In the early hours of Friday, July 19, an update to the CrowdStrike Falcon Sensor product triggered a worldwide outage on Windows machines. The incident was not a cyberattack or malicious in any way. It was faulty code in a regular product update. This is a perfect example of why you need to continually assess the business resilience practices of your third parties and understand the third-party risk exposure in your vendor universe when widespread outages like this one occur. CrowdStrike regularly publishes content updates to its Falcon Sensor products to ensure that they're protecting against the newest cyberattacks. All reports point to the update being part of that deployment cycle. The update, however, included some faulty code that triggered the dreaded Blue Screen of Death on Windows machines. Affected equipment suddenly displayed the dreaded "Blue Screen of Death," grinding thousands of companies to a halt worldwide and disrupting operations at banks, airlines, hospitals, and other organizations. Regardless of the cause, a high-impact incident is the wrong time to ensure you have a third-party incident response plan. https://buff.ly/3WbAppV Instead, start preparing for the next incident by implementing a proactive approach now. Start with these 4 best practices: 1. Develop a centralized inventory of all third parties 📇 2. Build a map of third parties to determine technology concentration risk 🗺️ 3. Assess third parties' business resilience and continuity plans 📋 4. Continuously monitor impacted vendors and suppliers for issues 📡 The CrowdStrike issue was thankfully not from a malicious source, but risk monitoring remains a key component in understanding your exposure to a third-party incident. However, over the next few weeks, companies affected by the CrowdStrike outage will likely spend significant time recovering their systems. Vendors, large and small, will contend with the business slowdown and potentially bring many thousands of end-user machines back into service. #TPRM #VendorRisk #RiskManagement #Cybersecurity
