Major Event Risk Incident

The cyber events that occurred on Friday, July 19 exemplify the reality of event risk. Companies that had cyber event plans were able to quickly reverse the CrowdStrike update and provide timely notice to impacted parties. Those without plans had to scramble to organize and mobilize in order to restore access to critical business devices and processes. Millions of consumers woke up to suddenly find they couldn’t travel, execute an online transaction, make or collect a payment, or simply get information. The outage impacted an exceptionally broad array of systems that included 911 emergency services, health care, and even governments.

Business and everyday life functions have become highly dependent on consistent and instant device access to interconnect with data, image and voice data. It’s easy to take this dependency on safe and secure connectivity for granted and rely on third parties to have business processes that preclude failures. Regrettably, the harsh reality is that event risk is always present and it’s always possible that something will occur that creates significant impact. The CrowdStrike software update failure is yet another incident that highlights how disruptive events can occur despite established oversight, controls and redundant processes.

The CrowdStrike failure involved a defect found in a single content update for Windows hosts. Mac and Linus hosts were not impacted. The issue was not a security incident or cyberattack. However, the failure impacted 8.5 million devices, many of which supported countless business units and individuals. To CrowdStrike’s credit, the issue was identified, isolated and a fix deployed. However, the nature of the issue required remediation at the individual device level. CrowdStrike stock fell about 15% on Friday and another 15% on Monday as this article was written. The final impact of the substantial reputational blackeye is unknown at this stage.

Consider how many incidents we’ve read about in the past few months where consumers have incurred real losses based on their dependency on third parties. We expect third parties will protect device access, non-public information, and limit exposure to malicious software that could negatively impact operations and hard-won reputations. We also expect there will be timely notice of incidents and product failures that impact us. Savvy risk managers will tell you there are many risk events that don’t get reported.

Event risk is inescapable and always present. While good cyber security practices are often in place across most businesses and service providers, these practices are not perfect and cannot ensure a zero-defect rate. And, while we work hard to mitigate the impact of event risk through preventive measures, it’s exceedingly important to establish backup and response plans to handle event risks when they occur. The CrowdStrike incident also underscores the importance in mitigating any single vendor issue.

After all, event risk is always present.

Our fractional risk management services provide exceptionally cost-effective solutions. Call us for a confidential conversation.

‍