Speaker 1: Kielder. I'm Chelsea Daniels and this is the Front Page,
Speaker 1: a daily podcast presented by the New Zealand Herald. Our
Speaker 1: y two k bug fears became a reality when millions
Speaker 1: of computers were disabled worldwide over the weekend. Microsoft estimates
Speaker 1: the outage meant eight point five million computers were disabled
Speaker 1: when an update from global cybersecurity company CrowdStrike went wrong. Banks, airports, supermarkets,
Speaker 1: media companies and retailers were left scrambling, and the company's
Speaker 1: chief executive says it could be some time before systems
Speaker 1: are completely back to normal. It's believed to have been
Speaker 1: the biggest tech outage in history. So what can we
Speaker 1: learn from this to prevent it from happening again? And
Speaker 1: does it expose weaknesses in a globally connected computer network.
Speaker 1: Today on the Front Page, to analyze the next steps
Speaker 1: from this tech crisis, we're joined by Aura Information Security
Speaker 1: advisory consultant Alistair Miller. Alistair, what was your reaction on
Speaker 1: Friday night when these problems started to be reported globally.
Speaker 2: I have to say I was a bit worried for
Speaker 2: all the IT teams who are going to have to
Speaker 2: deal with them. As the problems escalated and as we've
Speaker 2: now found out, it's least eight point five million computers.
Speaker 2: That's a lot of work for a lot of people
Speaker 2: to sort out.
Speaker 1: This issue has been blamed on a software update, but
Speaker 1: the effects were pretty wide spread. Planes were canceled, banking
Speaker 1: systems where inaccessible security systems went down. The list goes on.
Speaker 1: How standard is it that so many different and varied
Speaker 1: systems and industries would be linked to the same software.
Speaker 3: Unfortunately, it's quite common.
Speaker 2: There's a sort of only a small handful of big
Speaker 2: players in a lot of the IT spaces, and they
Speaker 2: pretty much cover all especially crowdstrikes at the top end
Speaker 2: of the market. So that will be with all those
Speaker 2: big players, those banks, big transport companies who we probably
Speaker 2: haven't seen in the press but probably have suffered because
Speaker 2: it's going to take a bit longer there and other
Speaker 2: big players are going to be impacted by those things.
Speaker 4: The scale of the outage unprecedented, affecting flights, banks, healthcare systems,
Speaker 4: and TV stations. The trouble first occurred in Australia and
Speaker 4: here industries hit in America, across Europe and Asia.
Speaker 3: Chaos for airlines there are canceled Amy drive.
Speaker 5: We'll have to try and get a flying home somewhere
Speaker 5: somewhere sometime, don't know.
Speaker 3: Sint John lost computers for taking calls and for dispatching.
Speaker 4: Literally a paper process, having to go back to writing
Speaker 4: things and using paper and paper boat system.
Speaker 1: We know the issues being traced back to CrowdStrike, a
Speaker 1: company that produces anti virus software. You mentioned with eight
Speaker 1: point five million Microsoft devices affected. What do you think
Speaker 1: went wrong here?
Speaker 2: It appears it's a bit of a lack of quality assurance,
Speaker 2: so they didn't do their testing with the latest Microsoft
Speaker 2: update and released a bit of software that conflicted badly
Speaker 2: with the Microsoft update and took all those PCs and
Speaker 2: servers out.
Speaker 1: And CrowdStrike I believe has around a twenty percent market share.
Speaker 1: Is this one example where one company being so dominant
Speaker 1: in the market really doesn't work in people's favor.
Speaker 2: Well, I mean there is that risk, and again they
Speaker 2: cater to the high end market, so the ones who
Speaker 2: are much more noticeable. But it's just very common in
Speaker 2: the IT space where there are a few big players
Speaker 2: who can dominate the markets and then obviously when run
Speaker 2: into trouble, it hits everyone. I mean, Microsoft and Amazon
Speaker 2: are the prime example really with who the biggest cloud
Speaker 2: providers adding Google not so big in New Zealand, but
Speaker 2: big worldwide. When they have issues, the whole world feels
Speaker 2: that pain. CrowdStrike is the company behind the software that
Speaker 2: brought everything down.
Speaker 1: We're deeply sorry for the impact that we've caused customers,
Speaker 1: to travelers, to anyone affected by this, including our companies.
Speaker 1: So we know what the issue is. We're resolving and
Speaker 1: have resolved the issue.
Speaker 2: Now.
Speaker 1: Is this really our y two k fears realized twenty
Speaker 1: four years later?
Speaker 2: It certainly demonstrates that the people who put in that
Speaker 2: hard work back then for y two k, this is
Speaker 2: what they were trying to mitigate, these kind of issues
Speaker 2: where it takes down all kinds of systems and things
Speaker 2: that you didn't necessarily expect cause you a lot of pain.
Speaker 1: We were talking on this podcast actually last week about
Speaker 1: if we need to break up the banking sector or
Speaker 1: SuperM it's locally for more competition. Is that something that's
Speaker 1: even possible in the tech sector, or do you need
Speaker 1: a large company like CrowdStrike, say, to actually have the
Speaker 1: capacity to manage millions of devices globally?
Speaker 3: They have a lot of competitors.
Speaker 2: I think our problems are more people have not got
Speaker 2: good business continuity and disaster response plans. A lot of
Speaker 2: New Zealand businesses have nothing, and the ones that a
Speaker 2: lot of the other ones will have something written on
Speaker 2: a piece of paper that's never been exercised at all.
Speaker 2: So people actually prepared for problems happening, because we'll know
Speaker 2: they do. You know, we have COVID, we have earthquakes.
Speaker 2: I mean, you have plans for you know, a fire
Speaker 2: escape and you practice that drill once a year. So
Speaker 2: companies have to have plans for what happens if we
Speaker 2: lose all our servers and how do we get around that?
Speaker 1: So is this really an issue with companies worldwide not
Speaker 1: having those fire escape drills?
Speaker 3: Say it is?
Speaker 2: I mean, I think we'll find that some of them
Speaker 2: have recovered within twenty four to forty eight hours, other
Speaker 2: ones will drag on for weeks, and the ones that
Speaker 2: dragon for weeks will be the ones without the good plans.
Speaker 1: Does New Zealand have any companies based here that could
Speaker 1: take on some of this workload.
Speaker 2: To try and fix it all manually. I mean, we
Speaker 2: New Zealand has an IT skill shortage, which is one
Speaker 2: of the reasons why some companies are going to take
Speaker 2: a long time to recover because they're going to be
Speaker 2: looking to outside providers. But I mean all companies can
Speaker 2: either talk to themselves or talk to consultancies and other
Speaker 2: experts in the area to get advice on what is
Speaker 2: a good business continuity or disaster response plan.
Speaker 1: I've seen the term single point failure emerge in some
Speaker 1: of our analysis of this. Can you explain what that
Speaker 1: actually is?
Speaker 2: So, a single point of failure, or as people lovingly
Speaker 2: call it, a spoff, is basically where everything points to
Speaker 2: one thing. Often in an organization, it can be a person.
Speaker 2: When that person is everything grinds to a halt. It's
Speaker 2: that one place where, even if you had multiple things
Speaker 2: around it, they all have to deal with that system,
Speaker 2: talk to that person or get sort of channeled through it,
Speaker 2: and when that goes down, the whole business goes down
Speaker 2: with it. In this case, it's not quite a single
Speaker 2: point of failure, but it's the inability to have a
Speaker 2: failover for when that thing fails that's more of the
Speaker 2: issue in this case.
Speaker 1: How vulnerable are global systems to these types of issues?
Speaker 1: Does this make us more susceptible to hackers or malicious attacks.
Speaker 2: Indirectly, it may well do where people lose the ability
Speaker 2: to monitor things and see what's going on on a
Speaker 2: wider scale.
Speaker 3: For the issues. Obviously, the attackers.
Speaker 2: Immediately jumped on it, and we're looking to scam people
Speaker 2: with fake websites, fake emails of help and things like that.
Speaker 2: But I think what it really reflects is how interconnected
Speaker 2: the world is nowadays, how much we depend on our
Speaker 2: IT systems, and we need them to be resilient and
Speaker 2: robust to cope with things like this.
Speaker 5: We've been long encouraged to keep our devices software up
Speaker 5: to date, but there are now tough questions as to
Speaker 5: how one faulty update could have brought so much chaos.
Speaker 5: To be clear, this wasn't a hack or cyber attack,
Speaker 5: so you don't need to change any passwords. It only
Speaker 5: affected machines running Microsoft, but every single one will need
Speaker 5: a manual reboot in safe mode. Microsoft says some people
Speaker 5: have to do this as many as fifteen times.
Speaker 1: For years now, we've all been talking about society moving
Speaker 1: more and more online. Do you think this incident will
Speaker 1: make some governments and companies stop and have a bit
Speaker 1: of a rethink.
Speaker 2: Well, I mean, I think they'll have a think about
Speaker 2: it and they'll have to consider what to do. I
Speaker 2: mean often a good business continuity plan is to have
Speaker 2: some paper and some forms available, tell your staff about
Speaker 2: it train the minute, and when the computers go down,
Speaker 2: they go back to those pieces of paper and carry
Speaker 2: on in a sort of more outdated world. But at
Speaker 2: least they know what they're doing and they know how
Speaker 2: to do it.
Speaker 3: Yeah.
Speaker 1: I saw in some supermarkets they actually had those things
Speaker 1: that we used.
Speaker 3: To have and yeah, the little stubs of pay for you.
Speaker 1: Yeah, the stubs of paper or those things where you'd
Speaker 1: push the thing across for the card reader.
Speaker 2: Oh yes, yes, And that's brilliant that they still had
Speaker 2: them and the staff knew what they were doing. I mean,
Speaker 2: you do need these fallbacks. Hopefully we never have to
Speaker 2: use them all very infrequently, but to have them there
Speaker 2: is absolutely key.
Speaker 1: Well, a cashless society is one area that's caused concern
Speaker 1: for some. The idea of us removing physical money and
Speaker 1: going fully digital, given some people couldn't access their accounts
Speaker 1: or use pay systems, is that one area particularly that
Speaker 1: might need to be re examined.
Speaker 2: It certainly puts it at a very high risk of
Speaker 2: the repercussions should we not be able to access that money. Obviously,
Speaker 2: if you can't get to an ATM to withdraw the
Speaker 2: money because the ATM's fallen over, even with cash, you're
Speaker 2: kind of stuck. But it's definitely something to consider going
Speaker 2: forward where everything is either on your phone or on
Speaker 2: a card.
Speaker 1: What's the likelihood of a global outage like this happening again,
Speaker 1: and if so, how do we go about preventing it.
Speaker 2: I think it's fairly likely that within the next couple
Speaker 2: of years something similar will happen. It's just as we've
Speaker 2: been saying that the number of providers out there is
Speaker 2: limited in some spaces, some of them tend to monopolize
Speaker 2: certain sexes, so it's going to hit and so it's
Speaker 2: really having those plans and getting people to exercise them,
Speaker 2: at the very least round a tabletop, so everyone gets
Speaker 2: around that for a few hours and practices it, and
Speaker 2: then every now and then actually doing a physical test
Speaker 2: of it of knocking over a system and seeing how
Speaker 2: you recover from it.
Speaker 6: Microsoft's going to be looking at this closely to see
Speaker 6: how this never happens again. From a brand perspective, they're
Speaker 6: going to have to spend weeks and months ahead trying
Speaker 6: to contain that. But it does speak to just a broader,
Speaker 6: the stronger and stronger intact. We're not talking about thirty
Speaker 6: forty companies. There's really a core ten to twenty. They're
Speaker 6: run the global IT infrastructure.
Speaker 1: Should we have some kind of worldwide regulatory agreement on
Speaker 1: something like.
Speaker 2: This, It's a very interesting idea. International regulation is absolutely
Speaker 2: a nightmare as far as I can tell, so it
Speaker 2: would be a good idea, But I imagine getting anything
Speaker 2: through the United Nations or some similar body would be
Speaker 2: very hard work in.
Speaker 1: Terms of managing it. From a New Zealand point of view,
Speaker 1: Is there anything our government can do to prevent something
Speaker 1: like this happening again, or at least making it a
Speaker 1: better turnaround, so to speak, to get everything back online.
Speaker 2: Well, interestingly, the FMA, who regulates financial bodies, recently put
Speaker 2: out a sort of not quite a regulation, but a
Speaker 2: requirement that businesses actually get ready for this kind of thing,
Speaker 2: improve their resiliency and redundancy plans. So parts of the
Speaker 2: government are taking this seriously. What they really need to
Speaker 2: do is kind of have a bit more of a
Speaker 2: stick about it and go. We're going to come and
Speaker 2: order you every year to and check these plans real
Speaker 2: and that you've been practicing them. It should probably be
Speaker 2: in all areas where things really matter to us, so
Speaker 2: you know, the health, transport, financial, those kind of things
Speaker 2: are the ones that probably need that level of plans
Speaker 2: in place.
Speaker 1: And in terms of the general public, should we not
Speaker 1: get our money out of the banks and bury it
Speaker 1: in the backyard.
Speaker 3: I think that may be an overreaction.
Speaker 2: I would imagine that's probably going to have as many
Speaker 2: repercussions as doing that. But we certainly need to be
Speaker 2: prepared ourselves, have our own sort of fire drill or
Speaker 2: earthquake escape plan on what happens if we can't, you know,
Speaker 2: use our card. Do we have you know, a couple
Speaker 2: of hundred bucks in a draw that we could then
Speaker 2: go and get groceries or whatever we need? So we
Speaker 2: ourselves are not kind of beyond having little plans.
Speaker 1: Yeah, a bit of a wake up call for everyone.
Speaker 2: Hey, it is it's that complacency where we get where
Speaker 2: it's someone else will always fix that problem. We don't
Speaker 2: have to worry about it because it's taken care of.
Speaker 1: Thanks for joining us, Elstair no problem, Chelsea.
Speaker 3: It was a pleasure to talk to you.
Speaker 1: That's it for this episode of the Front Page. You
Speaker 1: can read more about today's stories and extensive news coverage
Speaker 1: at enzedherld dot co dot nz. The Front Page is
Speaker 1: produced by Ethan Siles with sound engineer Patti Fox. I'm
Speaker 1: Chelsea Daniels. Subscribe to The Front Page on iHeartRadio or
Speaker 1: wherever you get your podcasts, and tune in tomorrow for
Speaker 1: another look behind the headlines.