The likely cause of the CloudStrike chaos – and how a Trump presidency could undermine cybersecurity

This week’s IT outage is a timely reminder of how interdependent the world has become. The pandemic has shown us how vulnerable our supply chain is to global shocks.

The Crowdstrike outage showed us how vulnerable the software systems that keep the world running are.

Part of the problem stems from the global dominance of a few large technology companies: Windows is still the operating system used in many important systems, such as transportation, banking, and hospitals, and it was largely developed in a very different era.

The Crowdstrike software that injected the bug has a market share of nearly 20% and is often deployed in critical services that are targeted by cyberattacks due to the chaos that results when they are not functioning reliably.

This outage was not caused by a cyberattack, but by a bad update. The post-mortem has not yet been made public, but the nature of the outages suggests internal gaps in testing and other quality processes.

How can such a small and seemingly insignificant update cause such catastrophic operational and financial damage? The answer lies in the incentives of software and software service makers.

Technology is a fast-paced and highly competitive industry. There is immense pressure on software companies to continually deliver new features and functionality that will give them an edge over competitors.

When it comes to quality and safety, they benefit from doing just enough to get by, as customers can’t always see the impact of shortcuts in these areas.

Part of the reason for this is that software is sold under the terms of “buyer beware.” The software maker decides the tradeoffs between new features and quality, and if the customer decides to buy, they inherently assume the risk of those tradeoffs.

That’s a tough deal, since many customers are less technically capable of making those trade-offs than the software makers.

Times are changing, however. Both the US and Europe have recently adopted new cyber policies that place the responsibility for quality and security squarely on the software makers and industries that run critical services.

This change comes as sophisticated nation-state attacks on the private sector are now fully incorporated into the warfare playbook.

The line between national defense and civil defense is increasingly blurred. So far, these are policy statements that are not yet supported by legislative changes that allow lawsuits when due care has not been taken. But it is a clear indication of where things may go in the future.

Trump’s Battle with Cybersecurity Agency

Of course, that depends largely on the outcome of the American elections in November.

This is another area where Republican and Democratic policies diverge widely.

Donald Trump and his allies are locked in an ongoing battle with the Cybersecurity and Infrastructure Security Agency (CISA), the top U.S. government agency responsible for protecting critical infrastructure.

Although Trump himself created the agency in 2018, while he was still president, he publicly fired the agency’s director via Twitter in 2020 after he refused to support the disinformation campaign about the theft of the 2020 election.

Other Republican lawmakers believe CISA is involved in encouraging Meta and other social content platforms to suppress conservative views.

It is widely assumed that a Trump presidency will either defund CISA or neutralize it by filling it with Trump loyalists.

If that happens, it will be like opening an open fire for American adversaries to attack US critical infrastructure.

The outages at Crowdstrike clearly show that no country is far enough from Washington DC to not feel the real consequences of Washington DC politics.

I’m not sure what advice to give Kiwis, other than to buy a USB stick and back up their PC regularly!