Balancing internal innovation and third-party vendor risk

The importance of collaboration and strong partnerships in the enterprise

News By Jill Knesek published 25 September 2024

As a former FBI Special Agent in the Los Angeles Cyber Crime Squad, I've seen my fair share of defective software updates. However, the recent global tech outage caused by a faulty software update from CrowdStrike has truly captured the world's attention. The shock and awe of such a well-regarded cybersecurity vendor causing a major security incident has brought to light a previously overlooked area of third-party risk. 

Given CrowdStrike’s reputation and trusted position, many companies automatically allowed its software update package into their systems without fully considering the possibility of a defect. Consequently, no CISO expected the update to result in a global tech outage, causing systemic disruption across interconnected systems.

The aftermath of the CrowdStrike incident was particularly severe for banks, hospitals, retailers, and airlines.

Interestingly, some companies with outdated systems were reportedly unscathed by the flawed update, whereas others with best-in-class systems endured outages for a few days or longer. This is not a story of old technology versus new technology, as some articles have implied. Rather, it is a nerve-wracking tale arguing the need for a risk-based approach to minimize the possibility and impact of a defective software update.

Jill Knesek

Know Thy Vendor

CrowdStrike has come under criticism for its automatic update process and not staggering or staging the release to limit the potential for widescale disruption. However, the company is not alone in its approach: keen to protect customers against a newly discovered cyberthreat, many other security vendors also automatically provide real-time updates.

Although CrowdStrike’s update was defective, the incident nonetheless spotlights the importance of balancing innovation across the IT system landscape with more diligent third-party vendor management. CISOs are reminded to foster secure innovation by collaborating with their technology peers across the organization and forging strong partnerships with the company’s third-party vendors. The two priorities are not mutually exclusive; instead, they’re intertwined.

Collaborating with technology peers yields better ways to understand, minimize, and mitigate risks, ensuring the company can continue to innovate without increasing cyber risk for the business. Partnerships with critical third-party vendors provide greater assurance that vendors are prepared to respond at scale when the next unexpected outage occurs. Understanding which vendors are distributed across a large portion of the corporate infrastructure and production environments (especially those that receive regular updates) can optimize the processes of replacing software with new and improved versions.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors