Asia-Pacific faces fallout from CrowdStrike outage: ‘It will continue to happen’

The CrowdStrike outage, which shut down government and corporate IT systems across the globe, caused significant chaos across Asia-Pacific last week and raised many still unresolved questions about its financial fallout and liability issues. However, insurers and IT experts said the outages’ impact on the region was limited and would not lead to an overhaul of cybersecurity protocols, although they recommended businesses strengthen their backup systems and continuity plans in case similar incidents strike again in the future. The incident unfolded on July 19, just as businesses in Asia-Pacific were winding down for the evening. First, customers of major Australian and New Zealand banks could not access their accounts. The rest of the region followed an hour later, with processing systems at airports in Hong Kong, Singapore, India and Japan all going down and numerous airlines cancelling or delaying their flights. In Malaysia, train booking system were disrupted as were some ATMs, television broadcasting, postal and retail services and websites. Speculation of a malicious cyberattack quickly died down after the true culprit behind the chaos was revealed to be a software update from CrowdStrike, a global leader in cybersecurity technology, that was pushed to their Falcon platform, which is designed to stop system breaches using cloud technology. The update caused a glitch that crashed nearly 8.5 million Microsoft devices. Affected computers bore the frighteningly-named “blue screen of death”, displayed when Windows systems experience a critical error. In Asia-Pacific, where CrowdStrike is not as commonly used as other security software, the damage caused by the outage appears to have generally been limited. A few countries like Thailand were spared from the upheaval, with no reported impact on critical systems like telecommunication networks or government infrastructure. The outage had an even smaller impact on China, where the use of foreign software is discouraged by the government. Most of CrowdStrike’s customers are in the US, UK, India and Australia. For the companies that were affected, the toll it took on their operations clearly infuriated some. After being forced to deploy extra staff to manually check in his airline’s customers and manually write boarding passes, AirAsia boss Tony Fernandes lashed out at the companies behind the outage and demanded compensation. “Tech companies have little empathy. What we went through with Covid they had no sympathy. Now they have issues they expect us all to understand. Well, I’m not going to. Airlines need answers and compensation,” he wrote in a social media post. Impact assessment Questions now loom about the size of the damage and who will pay for the financial losses incurred by affected CrowdStrike customers. IT companies and insurers are scrambling to estimate the impact on businesses. On Thursday, insurer Parametrix said banking, healthcare and airlines would bear the brunt of the losses, with US Fortune 500 companies projected to take a US$5.4 billion hit. The Australian Industry Group told local press the losses in Australia – home to CrowdStrike’s biggest Asia-Pacific customer base – would exceed A$1 billion (US$652.3 million). Despite those staggering figures, the overall impact on the global economy was likely small, according to Capital Economics chief global economist Jennifer McKeown. “We estimated … late in 2022 that even a cyberattack which caused output to halve for three days across advanced economies would hit annual GDP by only about 0.2 per cent,” McKeown wrote in a note to clients last week “Given that this is not a cyberattack and has not affected all software by any stretch, the implications should be significantly smaller.” Most small to medium-sized businesses in Singapore, Australia and New Zealand told This Week in Asia they did not suffer outages as they did not use CrowdStrike, while others said only some staff computers crashed while others continued to function.. CrowdStrike is generally used by large organisations. The recovery in Asia was swift while the damage was minimal, although there was no clear patterns of how Asian countries were affected yet, said Andrew Mahony, head of cyber solutions for Asia for consulting firm Aon in Singapore. The timing of the outage late on Friday also lessened the damage for some businesses which might have taken an early afternoon off, he said. So far, Asia-Pacific clients he has dealt with mostly had clear cases for insurance claims, while others were “not materially affected, but certainly curious” about possible compensation, he added. “It looks like it could be a near-miss for many organisations and for many of the insurers at this stage … and I think, for the first time, it’s put that risk of technological failure, rather than the risk of attack and exploitation of vulnerability, out there,” he said. Mahony said it was ironic that insurers had recommended the use of software like CrowdStrike to their customers in order to minimise their risks. “Similarly, [insurers] look at how regularly their clients were applying patches [updates] so this is an ironic loss in that sense,” he said, referring to the fact that the outage was caused by CrowdStrike’s update. “Our concern going forward is there will be some pause when companies continue using these sorts of software or, when it comes to applying patches, they might wait and see how that patch was applied elsewhere before they apply their own, and that, of course, opens the door for bad actors.” So while businesses might become hesitant about using cybersecurity software, not using them is not a solution, Mahony said. Instead, companies should tighten their business continuity plans and increase insurance coverage to avoid financial losses, he argued. “We saw in this case, systems resumed fairly quickly … where we have probably seen more of a loss is where the operational downtime outlasts the system downtime,” he added. Aviation systems, for example, suffered 72 hours of operational downtime while the CrowdStrike crash lasted 12 hours, he said. Striking lessons Like Mahony, Singapore-based cybersecurity expert Ken Soh told This Week in Asia that businesses need to look at the latest outage with the perspective that update glitches happen quite regularly. “It will continue to happen since there is no 100 per cent defect-free software,” he said. He cited glitches in electric vehicles, smart TVs, fitness trackers, video games and digital fire alarms and suggested that businesses manage outage risks by diversifying the technologies or software they use. As businesses shore up their crisis plans, antivirus and cybersecurity software vendors should also step up the protection of their update processes, said Troy Hunt, the founder of “Have I Been Pwned”, a website that allows internet users to check whether their personal data has been compromised. In the meantime, he warned about an up tick in scams and said consumers should be wary of calls from call centres claiming to be from CrowdStrike or Microsoft offering support. “None of these parties will phone individual consumers about this incident,” Hunt said. Toby Murray, a University of Melbourne associate professor of cybersecurity, said the incident has highlighted why society’s dependence on just a few global tech giants and their software is risky. He said in an analysis published this week, there should be concerns that software such as CrowdStrike’s Falcon is too tightly integrated into Microsoft Windows, the fundamental operating system used by many computers. “As a maker of highly privileged software, CrowdStrike had a responsibility to ensure its updates were safe. It demonstrably failed, and we should all demand much higher standards of accountability from the makers of critical software,” he said. Using cybersecurity software remained crucial but he said Microsoft and CrowdStrike should work together to ensure tools like Falcon operate at arm’s length from the core of Microsoft Windows.

Asia-Pacific faces fallout from CrowdStrike outage: ‘It will continue to happen’

.css-1mniedq{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;}While its impact on the region was limited, analysts said the incident highlights the need for backup systems and business contingency plans

While its impact on the region was limited, analysts said the incident highlights the need for backup systems and business contingency plans