COMMENTARY

In the world of cybersecurity, no company is immune to outages and breaches. Recently, CrowdStrike, a leader in endpoint security, had a glitch that affected many usersWhile the details of the root cause analysis still popping up, I suspect there is a good chance that the problem stems from a lack of adherence to the process, especially code that may not have undergone proper testingpre-deployment security assessments or governance.

Why the process matters

The output of any business process is predicted by adherence to the process. In other words, a process will never be predictable (or maximally efficient) if it is not followed. That sounds like a tautology, but there is a misguided idea that software development is somehow the exception to this rule.

These processes include important steps such as code reviews, security checks, and user acceptance testing. When well-meaning people ignore the process, usually in an attempt to move quickly, the risk of bugs and vulnerabilities skyrockets.

We often speak with technical leaders who confess that they have very few process controls. Chief information security officers (CISOs) who are unaware that important code changes have not gone through security review, or chief information officers (CIOs) whose teams are not aware of architecture changes.

Worse still, when managers think their teams are largely adhering to their procedures, a quick check of the recording systems often reveals that this is not the case.

If our suspicions are correct, the CrowdStrike outage serves as a reminder that even the most sophisticated and respected companies can suffer failures when compliance processes fail. In many cases, these failures can be traced to a lack of visibility and accountability in the process itself.

The pernicious thing about processes is that they can seem like a tax on productivity until it’s too late. In our financialized world, the risk of failure or breach is not tracked on a balance sheet anywhere. Technical debt is real, but it’s not tracked by the Financial Accounting Standards Board or generally accepted accounting principles.

Over time, improving processes leads to greater efficiency and productivity, but implementing change can be difficult. It can be especially difficult to know where to start and which process change to prioritize.

How to prevent future incidents

Ensuring compliance with processes and visibility can significantly improve an organization’s security, reliability, and overall performance, preventing costly downtime and maintaining customer confidence.

Key steps to ensure process compliance

1. End-to-end process insight: Comprehensive visibility into every step of business processes is critical. This transparency ensures that all activities, from code development to deployment, are monitored and recorded, making it easier to identify and address potential issues before they escalate.

2. Automated compliance checks: By automating compliance checks, you can ensure that all necessary reviews and approvals are completed before code is shipped. This reduces the chance of human error and ensures that all code meets required security and governance standards.

3. Real-time auditing and reporting: Real-time auditing and reporting capabilities enable organizations to continuously monitor their processes and generate detailed reports. This functionality helps to quickly identify deviations from the established process and take corrective actions quickly.

4. Proactive risk management: Advanced analytics and risk management tools can help organizations proactively identify and mitigate risks. By analyzing historical data and trends, potential problems can be predicted and preventative measures can be suggested, minimizing the impact of any disruptions.

Conclusion

The recent CrowdStrike outage highlights the critical importance of adhering to established processes and governance frameworks. As we navigate the complexities of the digital landscape, we must remember that robust processes and effective governance are the cornerstones of success. By focusing on process adherence and visibility, organizations can prevent future incidents like the CrowdStrike outage and ensure their business remains resilient and secure.