Top insights for IT pros
From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.
Experts have been telling IT Brew about the danger presented by unsecured and mismanaged third party vendor access for months—and the July CrowdStrike IT outage is a perfect example of what can go wrong when organizations place too much trust outside their tech departments.
“You put your own company at risk, as well as all your customers,” software developer and technologist Thomas Haver told IT Brew.
Blame game. Haver said while CrowdStrike is certainly to blame for not establishing the processes necessary to test the update it sent out, the organizations that didn’t block the update are at least equally responsible.
“The companies that did this and ended up seeing the blue screen of death—they blindly took in all of these updates from CrowdStrike,” Haver said.
In order for the update to pass through without challenge, Haver continued, organizations need to fail on multiple fronts.
“You have rules in place, but people don’t follow them; you have rules in place, but some leader tells you to bypass them…or you have people who switch into those roles who are unaware, not trained appropriately, and they make that mistake,” Haver said. “That’s the true ‘whoopsie doodle’ that occurs.”
Fixit. Solving this problem won’t be easy. Third party access to internal organizational systems is a hot topic among security experts concerned over how to manage the expanded threat surface from external vendors. Looking at the tech stack isn’t going to be sufficient to resolve the problem, Nexthink CEO Pedro Bados told IT Brew in an email.
“Rather than overhauling IT stacks, organizations must find ways to enhance visibility into their IT systems’ performance,” Bados wrote.
Haver doesn’t think the issue is going away. He told IT Brew that companies and organizations’ short term decision-making often doesn’t prioritize security over speed and features. That’s where things fall apart.
“We are making the decision to push net new features to production over making our systems more reliable, because the net new feature gives you more return on investment, versus making your systems more reliable, [but] you don’t see that value until you end up having a failure,” he said. “So it’s going to be a worsening problem."