File Photo/NBD

On Friday, July 19 (Beijing time), a software bug in the CrowdStrike cybersecurity software caused Microsoft Windows systems to crash globally, which has been called the "largest IT outage in history" by foreign media.

Key businesses and services around the world, including airlines, hospitals, railway networks, and television stations, were paralyzed due to the Microsoft system outage. Even 911 call operators in the US were unable to respond to emergencies. In addition, global supply chains were also hit, with the highly complex aviation system being the most severely affected. It may take weeks for air transportation to return to normal.

Although the IT system failure has now been resolved, the incident highlights the vulnerability of global technology infrastructure and has also sparked global reflection on the reliance on a single technology "main artery", as well as what responsibility software companies should bear when code defects cause major disruptions.

As one of the main desktop operating systems, Windows has 1 billion users worldwide, and cybersecurity relies on a few cybersecurity companies around the world, including CrowdStrike. Cybersecurity tools typically run in the background of computers to protect them from hackers. When a defective software is released on the internet, it can almost immediately cause damage to a large number of businesses and personal computers.

NBD noticed that in addition to this unprecedented product defect, CrowdStrike's products have also experienced similar problems in the past. An internal report from CrowdStrike sent to customers obtained by foreign media shows that in April of this year, CrowdStrike pushed a software update to customers running Linux systems, which caused the computer to crash. At the time, it took CrowdStrike nearly five days to fix the vulnerability. CrowdStrike promised to improve its testing process at the time.

In fact, CrowdStrike has always been known for solving the most difficult security problems. It was hired to investigate the hacking of Sony Pictures in 2014 and the hacking of the Democratic National Committee (DNC) in 2016. Hillary Clinton's emails were exposed in the 2016 incident.

The company was founded in 2011 and is headquartered in Austin, Texas. 271 of the Fortune 500 companies are its customers, and many government agencies, such as the Cybersecurity and Infrastructure Security Agency (CISA), the top cybersecurity agency in the United States, use CrowdStrike's software.

Gao Feng, senior research director of Gartner, a US IT research and consulting company, said in an interview with NBD that for enterprises (and individuals), they can increase resilience, such as introducing multiple suppliers to reduce the risk of relying on a single supplier. At the same time, contingency plans can also be formulated, such as bypassing CrowdStrike directly after a downtime. For cybersecurity companies, they can control patch updates, such as strictly controlling the pushed patches and sending them to the user side after testing.