In the digital age, cybersecurity is paramount. Companies rely on sophisticated security systems to protect their data and infrastructure. However, sometimes these very systems can become the source of major disruptions. A recent incident involving the cybersecurity firm CrowdStrike highlights this paradox. An update by CrowdStrike led to a global outage, severely affecting critical infrastructures like airports, hospitals, and banks. This article delves into the causes, impacts, and broader implications of this incident.

Affected Infrastructures

The outage impacted numerous critical infrastructures:

• Airports: Operations were delayed, causing chaos for travelers and logistical nightmares for airlines.
• Hospitals: Patient care systems were disrupted, potentially endangering lives.
• Banks: Financial transactions were halted, affecting customers and businesses alike.

The Faulty Code

The root cause of the outage was a malfunction in the CrowdStrike Falcon sensor, a program that integrates deeply with the operating system. This low-level integration meant that when the sensor malfunctioned, it caused the entire system to fail. The automated update, intended to enhance security, instead introduced a critical vulnerability.

Challenges in Resolution

One of the significant challenges in resolving the issue was the lack of privilege for most employees to reboot their computers in fail mode. This restriction complicated the recovery process, as many affected systems remained non-functional until specialized personnel could intervene.

Risks of Deep Integration

The incident raises concerns about the risks of granting extensive access to third-party programs like CrowdStrike Falcon. The video argues that giving a company kernel-level access can be risky, as any malfunction or vulnerability can lead to catastrophic failures, as seen in this case.

Causes of Internet Outages

The CrowdStrike incident is part of a broader context of internet outages. The video outlines several causes:

• Technical Failures: Misconfigurations or software updates can disrupt services. For example, a global outage was caused by a Microsoft cloud security update in July 2024.
• Government Decisions: Governments may cut internet access to control information or quell dissent. Notable examples include Egypt and Libya during the Arab Spring, and a seven-month outage in Manipur, India, in 2023.
• Cyber Attacks: Coordinated attacks by malicious groups can impact internet infrastructure, such as the 2016 DDOS attack on Dyn, affecting services like Twitter, Netflix, and Reddit.
• Natural Phenomena: Severe solar storms can interfere with internet infrastructure, reminiscent of the Carrington Event of 1859.