The Elephant in the Room

Daniel Goymer • July 21, 2024

The big tech story over the past week, perhaps ever has been the CrowdStrike incident. It would be impossible to put out a newsletter article this week and not draw some attention to it. Luckily, none of our managed customers have been directly impacted, although we have had discussions with CrowdStrike in the past, their particular security offering is not well aligned to small business requirements. 

 

But, could this have happened to another provider? The very simple answer is yes, this is the worst-case nightmare of all IT professionals, a bad update is a reality for all software, and we all dread the day it happens to us on any scale. The irony is that the very software designed to help prevent these situations has created the biggest and most costly IT outage in history. 


The reason for the scale of this outage is that the update got pushed to approximately 8.5 million Windows computers and servers, although servers have redundant systems with backups, laptops and desktops do not. The fix for these devices by in large required multiple passwords, often not easily obtainable, and physical access to the device and procedures not readily available to the common end user.


The net effect of this bad update was vast, Hospitals and Doctors across the US & UK were unable to operate, Upwards of 5,000 flights have been cancelled with a backlog of around 40,000 delays across the US and abroad that is expected to take months to clear. Major public transport providers were affected halting Train and bus services. Locally, mostly Banks and Payment systems were the only major systems affected. In all of this, we should still count ourselves lucky. This particular incident affected less than 1% of all Windows devices globally.


So the question arises, what happens in a larger outage? What happens when a bigger brand pushes a bad update? What happens when a major Internet or power provider goes offline? What happens when my cloud services go offline? Not only are these possible scenarios, they are all real-world scenarios that have happened in the past. 


Many questions will be asked over the coming months, what happens if a bigger brand pushes a bad update? Who pays? How can it be prevented? Are we too reliant on a few major Mega corps? The reality is that any solution to risk carries trade-offs that will erode security and require careful consideration. Delaying security updates and allowing individual company admins to test each update is an unreasonable overhead and would create windows for cyber miscreants. 

 

The question then gets asked, is it time for the humble desktop to be retired and all users moved to a centralised remote desktop architecture with backups and more redundancy? The de-centralised nature of the desktop has been one of its enduring strengths, and moving all users to a centralised model would, at first glance, appear to increase the risk of major meltdowns, not decrease it. How will your business operate during a large-scale IT outage regardless of the architecture employed?

 

So, what do we all do now? This will be a question thousands of businesses are asking and there will be plenty of new company's popping up saying they have the answer. My thoughts,


  • Talk to your technology team, ensure they've got good documentation, would the appropriate passwords be available quickly should a similar issue arise? 
  • Look at your Business Continuity (BC) plans, too often these plans are left up to the tech department. The whole business needs to be involved in your BC plans, the old adage, to a man with a hammer, everything looks like a nail is apt here. If you leave your tech department to work on your BC plans alone, they will come up with a technology solution. Technology is not the solution to every business problem. 
  • You still need security, don't look to weaken your security to prevent this. The software update in question could have equally been released by any number of software vendors, on Windows, Apple, or Linux devices. 
  • There is no quick fix, every option has trade-offs and these need to be considered carefully before any wholesale changes are made, don't buy-in to the marketing of any business that claims they have a solution. 

 

As always, our team is happy to discuss any concerns you may have, we have people versed in business continuity planning, security and appropriate digital architecture. We are happy to work through these discussions with your business, coming up with solutions that meet your requirements. 

Recent Posts

March 26, 2025
If you think cybercriminals only go after big corporations in major cities, think again.  The majority of incidents recorded by the NCSC impact individuals and small to medium businesses, proving that cyber threats don’t discriminate based on location - they target opportunity. With over 23,000 reports to the Netsafe helpline, and $17.8M in losses reported last year, small-town businesses are very much in the spotlight. In the past few months alone, three local accounting firms in regional New Zealand have suffered a data breach,and local ISP - Inspire was recently the target of a malicious cyber attack.
March 21, 2025
We've had a flying start to the year, and given we're really just past the point where you start to realise what day it actually is, we thought we'd share everything we've been working on lately. 2024 In Review As we reflect on 2024, it's clear that this year has been one of remarkable achievements and significant advancements for Yorb. We were very proud that we won the Reseller News Innovation Awards in the Regional Partner Category, a testament to our commitment to excellence and innovation. AI has continued to dominate the headlines, with some businesses making great strides in how they work and interact. However, the majority are still grappling with understanding the full impact of this technology on their business, industry, and society. As we navigate this evolving landscape, companies must adapt to the security implications, ensure the integrity of data, and adjust to changing work and consumer patterns. In line with our commitment to security, we launched our new Security Platform, Yorb Defender 2.0. Designed from the ground up to be Essential 8 compliant, we believe this solution is now a best-in-class product that meets the requirements of modern business. 2025 Looking Forward Looking ahead to 2025, we have set ambitious goals following the EOS business framework. Our recent Annual Planning has helped us develop our 10-year, 3-year, and 1-year goals, with a strong focus on several key areas: Client Experience: We are dedicated to ensuring that every interaction with Yorb meets and exceeds your expectations. Automation Platforms: We will continue to develop our automation platforms to provide more consistent and efficient service. Investing in New Technologies: Our focus will be on AI, Hyper-Automation, and Data Governance to stay ahead of the curve. Team Development: We are committed to investing in our team, ensuring they receive the best skills training in technical, people, professional, and business areas. We will are also excited to be launching business peer groups focussed around AI, bringing together business owners and leaders from across the regions to explore what the future holds for all of us. This year we are injecting new energy into our Total Support agreement, we believe there is more to our partnership than phones calls, Teams Conferences and remote support. We are therefore introducing ongoing scheduled visits as part of the contract, alongside a productivity focus with scheduled access to our development team. Kicking off this year will be monthly seminars on topics such as Security, AI, Productivity, we want to hear what topics matter most to you. Look out for your invite in the coming weeks. I’m incredibly excited by 2025 and the opportunities it brings, we call breath a collective sigh that 2024 is behind us lets get cracking on what promises to be a great year. Daniel Goymer CEO
March 12, 2025
Your IT provider should be a key partner in helping your business grow—but are they delivering real value? In this webinar, Crystal Jamieson, Marketing Manager at Yorb, sits down with Aaron Smith from Morphability to discuss how businesses can assess their IT providers, spot red flags, and ensure they’re getting the best service possible. Aaron has spent over a decade working with Managed Service Providers (MSPs) and now specialises in helping them refine their sales and growth strategies. With firsthand experience in how MSPs operate and evolve, he shares valuable insights on what to look for in an IT provider, what to avoid, and how businesses can maximise their IT investments. Join us as we dive into the key considerations for choosing and managing your IT provider effectively.
Share by: