On July 19th, several Microsoft users woke up to a blue screen of death instead of a working Windows system. This failure caused a global outage that halted key operations worldwide, including airports, hospitals, and emergency services. There have been many theories about its cause, with some saying it was a cyber attack by Russia or China. However, this outage was unintentionally caused by Microsoft’s cyber security provider, CrowdStrike, one of the world’s leading cyber security companies.

What’s Behind Microsoft’s Global Outage?

In the wake of the event, CrowdStrike founder and CEO George Kurtz took to their blog to tender an apology, explaining the cause of the outage.

On July 19, at 04:09 UTC, CrowdStrike rolled out Falcon content, a sensor configuration update for Windows systems. This update protects the Falcon platform. The sensor configuration, called Channel Files, is usually updated several times a day to keep up with CrowdStrike’s discoveries of techniques and procedures.

However, the update contained a defect that they had missed. The defect triggered a logic error, which caused Windows systems to crash, leading to the system showcasing a blue screen of death. The outage affected users running Falcon sensors for Windows 7.11 and higher.

However, this failure doesn’t affect other operating systems like Linux and Mac. It only affected Microsoft Windows because the update was designed for it. So, while the fault was caused by the popular cybersecurity company CrowdStrike, Microsoft users bore the brunt of the failure. CrowdStrike also provided a detailed technical analysis of the incident.

About CrowdStrike

CrowdStrike is an American cybersecurity technology company located in Austin, Texas. The company provides several cyber security services including advanced malware detection, endpoint threat hunting, endpoint activity monitoring, endpoint lockdown and containment. They have helped to investigate major cyberattacks like the Sony Pictures hack in 2014 and Russian cyberattacks on the Democratic National Committee in 2015 and 2016.

CrowdStrike Falcon, one of its platforms, is a multipurpose platform that helps to stop breaches using a set of cloud-delivered technologies. Falcon utilizes robust solutions like next-generation antivirus (NGAV) and endpoint detection and response (EDR). CrowdStrike ranks first for endpoint security market share, making it the biggest provider, serving thousands of crucial organizations.

Besides the July 2024 failure, CrowdStrike has been involved in several small-scale failures, especially those involving Linux OS. This includes a May 2024 incident reported on the Rocky Linux forums where CrowdStrike software froze after an upgrade to Rocky Linux 9.4. There was also the Red Hat incident in June 2024.

The Effect of the Outage

Millions of people were affected following the Microsoft outage. However, according to Microsoft’s estimate, only 8.5 million Windows devices were affected, which represents less than 1% of Windows devices worldwide.

However, while this seems like a minute per cent, the outage effect was widespread because most critical infrastructure services and large organizations use CrowdStrike’s cyber security services, from hospitals to airports.

The most affected sectors were banking and aviation. Banks like the Bank of England couldn’t operate for hours, and airports worldwide, in Europe, Canada, the United States, and India, had to cancel flights or reschedule. Up to 3,000 flights were canceled and over 10,000 were delayed.

In addition to these, train services, restaurants, telecom companies, the stock exchange, and broadcast stations were also affected. Even emergency services experienced some issues, with some 911 services being operated manually. This outage affected tens of thousands of businesses.

Fixes to the Microsoft Outage

Hours after the crash, CrowdStrike released steps to fix the issue, with several users gaining access as early as that morning. However, the process is quite complex and may be difficult for regular users to perform.

This quick fix doesn’t work in all scenarios, and as a result, CrowdStrike and Microsoft engineers and experts have to manually fix some systems, leading to a slow recovery process. Meanwhile, some users have fixed theirs by continuously rebooting their systems.

A day after the outage, Microsoft also released a faster recovery tool than CrowdStrike. Two days later, CrowdStrike announced it was testing a faster recovery technique. The Department of Homeland Security said it has also been working hand in hand with CrowdStrike, Microsoft, and its critical infrastructure partners to address the system outages.

The Microsoft Recovery Tool was last updated on the 22nd as version 3.1. This tool has two repair options: ‘recover from WinPE,’ which produces boot media to help with the device repair, and ‘recover from safe mode,’ which produces boot media so the device can boot into safe mode.

On the other hand, CrowdStrike provided a dedicated hub, offering updated remediation guidance and best practices to resolve the error. Users can watch videos on how to use the host remediation.

For the latest updates, visit the CrowdStrike support portal or Microsoft Azure Status Dashboard. If the stated recovery method doesn’t work, CrowdStrike advises customers to contact their CrowdStrike representatives or Technical support.

Cybersecurity Threats Following the Outage

Several cybersecurity threats have emerged after the incident, as hackers have leveraged the outage to use social engineering techniques to deceive people. As a result of this cyber threat, the United States Cybersecurity and Infrastructure Security Agency (CISA) encouraged users to be vigilant and follow guidance for legitimate sources.

CrowdStrike, through its counter-adversary operations, also published a list of blogs on websites impersonating CrowdStrike and their methods.

Lessons Learnt From the Global Outage

The Microsoft global outage has raised several concerns, such as the effect of over-dependence on a single service provider.

Microsoft averages over one billion users per month, and following the global failure, it’s evident that thousands of organizations, including federal organizations, depend on Microsoft. Also, CrowdStrike owns about 24 percent of the endpoint security market share.

This overdependence is the reason for the system failure’s large-scale impact, grounding tens of thousands of organizations and creating millions of financial losses to several industries. Thus, organizations need to look into diversifying their tech infrastructure to prevent such a complete shutdown. There’s also the issue of cybersecurity’s vulnerability. While this outage resulted from an error, it presents the likely effect of a global cyberattack.

Such large-scale cyber attacks can shut down most of the world’s industries. Thus, there is a need to step up cybersecurity with rigorous methods to prevent malicious activities.

Another issue is the need for a thorough incident response plan to ensure quick recovery. There’s also a need for cyber insurance that considers losses besides cyberattacks, like unintentional acts. With organizations losing millions due to the crash, having cyber insurance will reduce the losses.

The high demand for SaaS has led to a surge in interest in Cloud-to-Cloud Backup services. All indications are that this trend will continue in the coming years.

The Rise of SaaS and Cloud Storage

Business customers are increasingly abandoning “boxed software” in favor of SaaS. For several years now, this has been the most popular type of cloud service. According to Gartner, the SaaS market will reach $176 billion this year and $280 billion next year. As the “State of SaaSOps” report shows, companies use an average of 80 IT-sanctioned applications, with 70% of business applications based on SaaS. Cloud-based software has changed the way companies access and store data. The popularity of Cloud-to-Cloud Backup services is rapidly growing on the wave of SaaS.

The largest cloud service providers like to boast about their higher security standards compared to companies using their own IT infrastructure. However, contrary to the marketing boasts of Amazon AWS, Microsoft Azure, and Google Cloud Platform, they do not guarantee complete security for users. A famous Polish boxer, Jerzy Kulej, once said, “There’s no one who’s invulnerable to a punch, only those who are poorly hit.”

So, the situation is not as rosy as the marketers working for the “big three” try to convince us, but it’s also not as bad as opponents of cloud services claim. Cyber gangs can occasionally hit giants hard, although these are not common occurrences.

From the perspective of a SaaS user, the most important thing is that service providers only protect their own data and infrastructure, and they do not create backups of files, databases, or virtual machines belonging to customers as part of their standard offer. For example, the Microsoft Azure service agreement states that the provider recommends that users regularly back up their data using “third-party services or applications.” Microsoft, like its largest competitors, operates on a shared responsibility model, which in practice means that it does not create data copies for users, and SaaS users must take care of comprehensive backup and disaster recovery themselves.

Blind Trust Can Be Costly

Entrepreneurs approach cloud service providers’ offers in various ways. Often, you can encounter extreme attitudes – some are exceptionally distrustful of providers and don’t want to move data from their own data center, while others place boundless trust in them. Unfortunately, excessive faith in the operator’s capabilities can result in the loss of valuable information, and in the best-case scenario, expenses related to its recovery. As a study conducted last year by ESG shows, only 13% of respondents realize that when using SaaS, they must take responsibility for data protection themselves. In a similar survey conducted seven years earlier by Aberdeen Research, this percentage was 9%. Although there is some progress, it is not very impressive. C2C backup service providers still have a lot of work to do, both in promoting their products and educating SaaS users.

Data loss for SaaS-managed services can occur as a result of human error, a cyberattack, or errors made during the data synchronization or migration process. IT specialists participating in this year’s Spanning Cloud Apps survey identified three main reasons for using SaaS backups. Half of the respondents consider creating SaaS data backups as a necessary step to minimize the risk of data loss and downtime, nearly 20% do it to protect the company and data from human errors, and 15% want to protect themselves from ransomware attacks.

C2C Backup Minimizes the Risk of Data Loss

What pays off more – taking the risk and not performing regular SaaS backups, and in case of misfortune paying the service provider for data recovery, or using applications or services from external companies? This is a dilemma faced by many companies. The first of the mentioned options is neither cheap nor short. For example, for the Salesforce Data Recovery service, the customer pays a one-time fee of $10,000, and the order fulfillment time is 6 to 8 weeks. Even if the above price is acceptable for large enterprises, the waiting time can give IT managers a heart attack. Some services, such as Microsoft 365, work with tools like OneDrive, providing at least basic protection. However, these are indirect solutions, not guaranteeing the security that most organizations need.

It is therefore not surprising that more and more companies are using C2C backups. Until the end of 2014, the service remained in a deep niche. It became more widely known when EMC (now Dell EMC) acquired Spanning Cloud Apps. Since then, this market segment has begun to develop. Interestingly, three years later, EMC sold this company to the Insight Venture Partners fund. Currently, each of the major players in the data protection market has C2C backup in its portfolio. This is a very interesting proposition for several reasons. Vendors who focus solely on backup and DR have top-class specialists and extensive experience, so their products allow for cheaper and faster backups than, for example, the aforementioned Salesforce or backup services offered by AWS Amazon, Microsoft Azure, or Google Cloud Platform. In addition, they take into account many data loss scenarios. They are also flexible in restoring from cloud-to-cloud backups, as the organization can restore data to various computers, such as laptops or other mobile devices. The fact that C2C backup does not require additional hardware is of great importance.

Cloud backup can be a cheap solution, especially for consumers and small businesses that do not have a large amount of data to protect. Finally, creating backups in the cloud through a service provider is easier to manage, as an external company takes everything upon itself. Nevertheless, this element may be perceived as negative for those customers who want to have complete control over their backups.

C2C Backup or On-Premise Backup?

Not all CIOs are fans of C2C backup services. Opponents point to the costs associated with cloud-based backups. The highest fees are charged for data egress, when data is downloaded or copied from a cloud location. For infrequently used digital assets, these costs can be manageable. However, experts note that while storage costs are relatively low, data recovery fees can often shock CFOs and IT heads. Therefore, it’s crucial to carefully read C2C backup service agreements, especially the fine print. Creating backups from cloud to cloud can also be costly and complex in multi-cloud deployments.

Other challenges in cloud environments include limited bandwidth and latency. Therefore, one way for organizations to gain confidence in C2C backups is to test them.

Businesses can also create SaaS backups on local servers. One advantage of traditional backups compared to C2C is the speed and ease of data recovery. Traditional backups are useful when recovering large amounts of digital assets and in situations where users need quick access to data.

Storware Backup and Recovery’s Cloud-to-Cloud Backup Support

Storware Backup and Recovery is a comprehensive data protection solution that supports various platforms, including cloud environments. Its C2C (Cloud-to-Cloud) backup functionality allows you to protect your data residing in one cloud environment and replicate it to another, providing a robust disaster recovery strategy.

Key features and capabilities of Storware’s C2C backup:

• Platform Support: Storware supports major cloud platforms like AWS, Azure, and GCP, ensuring compatibility with your existing infrastructure.
• Data Replication: You can seamlessly replicate your data from one cloud environment to another, ensuring redundancy and protection against data loss.
• Scheduling and Automation: Automate backup schedules to streamline your data protection process and reduce manual intervention.
• Granular Control: Exercise fine-grained control over your backup policies, including retention periods, compression levels, and encryption settings.
• Incremental Backups: Optimize backup efficiency by only backing up changes since the last backup, reducing data transfer times.Security: Storware incorporates robust security measures like encryption to protect your sensitive data during transmission and storage.
• Integration: Seamlessly integrate Storware with your existing cloud infrastructure and management tools.

Benefits of using Storware’s C2C backup:

• Enhanced Data Protection: Protect your data against various threats, including accidental deletion, hardware failures, and cyberattacks.
• Disaster Recovery: Ensure business continuity by having a reliable backup of your data in a separate cloud environment.
• Compliance: Meet industry-specific compliance requirements that mandate data protection and redundancy.
• Cost-Effective: Optimize your backup storage and network usage by leveraging cloud-based infrastructure.

By leveraging Storware’s C2C backup capabilities, you can effectively protect your cloud-based data and ensure business resilience.

Storware Backup and Recovery Architecture

Summary

A comprehensive overview of Cloud-to-Cloud Backup (C2C Backup) services and their growing importance in the context of SaaS adoption. Key points include:

• Increasing SaaS adoption: The shift from on-premises software to SaaS has driven the need for C2C Backup solutions.
• Limitations of cloud providers’ security: Despite claims of high security, cloud providers like AWS, Azure, and GCP do not provide full backup and recovery services for customer data.
• Shared responsibility model: The responsibility for data protection primarily lies with the customer, not the cloud provider.
• Benefits of C2C Backup: It offers a cost-effective and managed solution for data protection, addressing challenges like human error, cyberattacks, and data loss.
• Challenges and considerations: Factors such as cost, performance, and data sovereignty can influence the choice between C2C Backup and on-premises solutions.

Key arguments in favor of C2C Backup:

• Cost-effective: Especially for small businesses and consumers with smaller data sets.
• Managed service: Cloud providers handle the backup and recovery process.
• Flexibility: Ability to restore data to various devices.

Potential drawbacks:

• Cost: Data egress fees can be significant.
• Performance: Limited bandwidth and latency can affect recovery times.
• Data sovereignty: Some organizations may have concerns about storing data outside their control.

In conclusion, the text highlights the growing importance of C2C Backup services in today’s cloud-centric environment. While cloud providers offer significant benefits, it’s crucial for organizations to understand their shared responsibility in data protection and to carefully evaluate their options when choosing a C2C Backup solution.