Will they also be summoning the owners of airlines and critical infrastructure that had no fallback or continuity plans in the event of an IT outage?
If the website fails, that costs a lot of money, but nobody is in danger. If dispatch systems fail that has a safety risk to flight ops.
While you may not be happy that your flight gets cancelled. For airline IT there is a cost vs benefit balance between the probability of flight cancellations vs the cost of having extra systems. (And in this case extra systems would probably have been affected by the same security platform, because not having that is another risk of cyber attack to consider)
That doesn't apply to flight ops, where each operator needs to prove to a very high level that safety is always maintained. Maximum probability for catastrophic failure is 10E-9 and for hazardous is 10E-7. No commercial considerations considered, have to make those numbers to be allowed to operate.
1. https://www.npr.org/2024/07/23/nx-s1-5049792/deltas-airlines...
I guarantee they all had BC/DR plans.
I honestly believe the whole thing in general has net negative ROI just because it never works.
Then again with systems working Boeing failed that one...
Except for massive disruptions to tons of people, businesses, and economies worldwide, with impacts rippling out for days after services have been restored?
What's absurd about it? It's absurd that I want the software operating my MRI and providing doctors with necessary information during surgeries to be different from what accountants using Excel and video game players use?
What's absurd is congress hoping to solve the fundamental problem by asking the CrowdStrike CEO to come in for a one on one. Even if we took this process at face value and assumed they were earnest it would be laughable.
Meanwhile.. the government is the largest healthcare payer in the world. For not particularly great reasons. This _is_ one of the downstream impacts of that reality.
This has nothing to do with there being a healthy market of operating systems to choose from.
> I’ve seen the fragmentation in edge devices
How many versions and patch levels of Windows exist? How many are currently deployed? How many must stay on the current version because of fragmentation?
> You know how many bugs you have with one stack?
The scenario that started this discussion is a single bug in a single piece of software impacting a large number of businesses, some of which are safety and life critical, all of which are on a single OS.
It's not a question of "how many bugs," because you can't fully eliminate them in any system which is actually updated _ever_, it's a question of "how many people does this single bug impact?"
Will this require more time and labor? Yes, of course. Does that make it "absurd" to consider? No, that's pure hyperbole.
Should hospitals plan on not being able to provide medical care and not able to transfer their patients elsewhere, or divert the inflow of new patients elsewhere, because every other hospital is down too, there is no one left to provide care, and 911 is shot anyway? Maybe. Right after planning for a nuclear explosion over the city.
What happened was pretty much an "act of God"-level crisis, except caused by a de-facto infrastructure provider with way more destructive power than they're equipped to handle. IMO, not only CrowdStrike should be liable for the damage and lives lost because of the outage, this incident should be a prompt to rethink the entire idea of endpoint security.
--
[0] - I think it should be, but then I think the entire business with endpoint protection is bullshit.
No, but cyberattack takes out all computer infrastructure is a high impact, low risk that critical infrastructure providers must account for and would've prevented any impact from CrowdStrike's blunder. They obviously didn't do that.
Yes.