CrowdStrike: Lessons in Mission Assurance to Build Resilience for Complex Cyber–Physical–Social Systems

Abstract

Computer systems exist to meet the explicit needs of the organisations they support. As such, the drive to protect computer systems increasingly relies on Mission Assurance - a need to guarantee service outcomes to the organisation. Building resiliency in Complex Cyber-Physical-Social Systems (C-CPSS) is an imperative challenge that requires a mission-centric approach to cyber security that extends beyond the traditional considerations of hardware and software. C-CPSS are complex systems-of-systems that contain cyber, physical, and social components. They sit on the edge of chaos and can exhibit emergent behaviours that are difficult to predict or control. Due to their interconnection across a broad range of societal services, a single cyber security incident in a C-CPSS can have cascading consequences.This work examines the 2024 CrowdStrike outage as a case study of a C-CPSS failure, where services across the world were significantly degraded due to a lack of error handling in a misconfigured file. This degradation extended beyond the cyber domain, and included aircraft cancellations, hospitals cancelling surgeries, failures in e-commerce, and impacts on essential government services across the globe. This lowers the trust in those services and had impacts beyond the cyber domain. This paper explicitly examines the C-CPSS elements affected to illustrate the importance of considering C-CPSS factors in cyber security design and Mission Assurance practices, so that wider systems can become more resilient to emergent, unexpected, and potentially catastrophic effects. Although this event was not explicitly an intentional security failure, this work also discusses how the need for resilience would be applied to large-scale attacks such as the type conducted by Advanced Persistent Threats.