Let’s talk about the CrowdStrike Impact—a significant cybersecurity event that took down systems worldwide.
What Happened?
CrowdStrike, a well-known cybersecurity provider, released a new pattern update for their platform. Unfortunately, this update had an unintended consequence: it caused systems to go offline. If you’ve flown with Delta recently, you may have personally felt the effects of this outage.
Why Did This Happen? Understanding Ring Zero
To understand why this was such a big deal, you need to know about Ring Zero—the most privileged layer of an operating system. The OS itself runs in Ring Zero, and to enhance security, CrowdStrike runs in Ring Zero too. While this setup allows for deep system protection, it comes with a significant risk:
-
If a process running in Ring Zero goes wrong, there are no safeguards—the entire system can crash.
-
While the CrowdStrike application itself is vetted and approved to run in Ring Zero, the pattern updates it receives are not pre-approved individually.
-
This means an update—like the one CrowdStrike deployed—can cause catastrophic failures across multiple systems.
The Fallout & Lessons Learned
Because of this issue, systems worldwide went offline, causing widespread disruption. Now, Delta Airlines is suing CrowdStrike due to the significant downtime and business impact they suffered.
What’s the takeaway here? Whether using CrowdStrike or any other security software, patching and updates should always be carefully staged. There’s a reason for the IT joke: "How many computers would you like to break at once?"—because if you roll out updates without testing, you could bring down your entire infrastructure.
Best Practices for Patching & Security Updates
-
Stage Your Rollouts: Don’t update all your systems at once. Test first, then deploy in phases.
-
Have a Rollback Plan: If an update goes sideways, you need a way to revert quickly.
-
Monitor Critical Updates Closely: Security updates are essential but should never be blindly trusted.
-
Understand the Risks of Ring Zero: Any software running at this level must be carefully managed—there are no safety nets if something goes wrong.
Final Thoughts
The CrowdStrike incident reminds us that even cybersecurity tools meant to protect us can introduce risks if handled improperly. Whether you’re managing a small IT environment or an enterprise system, careful planning and staged rollouts are critical.