What SMB’s Should Learn From CrowdStrike Outage

Why Cloud Cybersecurity Tools are Necessary

We all know that cybercrime is a serious problem. In 2022, over 800,000 reported cyber-crimes resulted in over $10 billion in financial losses in the United States alone! Cyber criminals are constantly finding new ways to attack and are incorporating new Artificial Intelligence (AI) tools to improve their efficiency. Accordingly, businesses need to incorporate tools that can quickly adapt to new threats.

The cloud is now everywhere. The Internet of Things (IoT) has invaded our lives.

• Your car’s computer connects to the internet to provide navigation, provide a hotspot or let you start it from your phone.
• Your appliances tell you when you are low on milk, allow you to pre-heat the oven or lower the house temperature before you get home.
• Smartwatches track our vital functions and devices regulate blood sugar for diabetes.

The IoT extends to business where:

• High value goods carry sensors to make certain temperatures are within tolerance.
• Vehicles are tracked for location and speed.
• Service technicians are routed to the next emergency

Anything connected to the internet is an end-point which needs to be protected in real time. The best place to secure a cloud connected device is from a cloud delivered security service.

How Cloud Security Suites Work

Every device cannot have a physical firewall between it and the internet. Because data travels over the internet, it can be scanned in transit. Whether your data is stored in a public cloud, your computer room or on the truck delivering your goods, cloud-delivered security enables consistent protection .

Cloud security companies provide “multi-layered” security:

• Identity and Access Management ensures only authorized users access data and systems.
• Encryption scrambles data into gibberish in transit and only authorized users have the decryption key.
• Firewalls and Filters inspect all traffic looking for malware, spyware and other improperly formed packets of data.
• Monitoring and Logging activity keeps track of who does what and when. If suspicious looking activity occurs, the tools notify appropriate personnel.
• Vulnerability scanning finds weak spots in security before an attacker can!
• Intrusion Detection and Prevention Systems look for suspicious patterns of activity to prevent attacks before they occur. These systems can turn off operating system features or shut down servers or network access before malware can spread.

The recent massive outage was due to a routine automated CrowdStrike content update that corrupted devices running Microsoft Windows. Because the update was automatically pushed to computers running the service, and the application prevents other systems from remotely changing computer configurations, fixes had to be applied manually with multiple reboots! Sentinel One‘s, after action report explains what happened and how to fix it. Unfortunately, it also advises of scams that appeared immediately after the system failure. Providers like CrowdStrike learn from each other and share information about current threats.See the Official CrowdStrike Remediation page

What We Learn from the CrowdStrike Debacle

Human error and not criminal activity caused the massive outage and lingering financial issues. However, we must not let our guard down against cyber attack! Conversely we must learn from the CrowdStrike debacle and take the following actions:

1. Update or Create a Disaster Recovery Plan – It is not a question of if, but when you will be unable to access your vital information systems. It is each businesses responsibility to have processes prepared for any incident which can impact its business operations. Disaster recovery plans include:
   • Computer systems disabled by hardware or software failure, cyber attacks or power outages
   • Natural and man made disasters such as hurricane, earthquake, flooding, fire, or building failure such as a roof collapsing.
   • Loss of key personnel to illness, death or simply going to a competitor.
   • Any other foreseeable disaster which can impact business operations.
2. Develop and Test Business Continuity Plans – Having a disaster recovery plan is important, but even more important is planning and testing for routine failure. Bad weather days, power outages, hard drive failures, internet outages and other similar failures happen all the time.
3. Find a Trusted IT Advisor – If the NSA can be hacked, so can you. The days of setting up your computer and leaving it alone until it fails are over! Small businesses need sophisticated systems to protect themselves from cyber attack. Modern IT is complex to make the user experience easy. Find a cloud service provider and/or a trusted managed service provider for on-premise systems who knows how to setup modern safeguards including:
   • Multi-factor authentication. Strong passwords are not enough!
   • Modern, AI Powered, firewall, identity management, intrusion detection and threat prevention software.
   • Offsite backup for data. Consider having your systems in held escrow. Images of your systems held in escrow can be turned on in case of disaster.
   • Periodic vulnerability scanning

Next Steps

The CrowdStrike incident did not directly impact small to mid sized businesses IT infrastructure. However, the impact caused on the large enterprises using the software Now is always the time to have a good disaster recovery plan. In the digital age, the cloud must be a part of that plan. At I-BN we know that one size does not fit all when it comes to cloud. Accordingly we offer multiple services to help on your journey to and in the cloud..

• For customers who are still on premise, we offer Cloud Selection Services. Whether you start with simple cloud backup or want to go all in, we can help you find the right type of cloud and service provider.
• Customers already in the cloud can sign up for a free Cloud Optimization Discovery call with one of our experts.