Ordinary PC users may have moved past the global IT meltdown from last week, but businesses and governments are now required to reassess their backend systems and explore safer options, according to Dubai-based cybersecurity experts who spoke to Khaleej Times on Wednesday. This comes less than a week after a software update by cybersecurity firm CrowdStrike impacted nearly 8.5 million Microsoft devices globally.
"Residents should be more vigilant against scammers and cyberhackers," advised Rayad Kamal Ayub, managing director of Rayad Group, and Irene Corpuz, a GRC and Cyber Policy Advisor in Dubai. They emphasized that the widespread tech failure, which led to travel disruptions and affected major industries worldwide, was not a cyberattack. In the UAE, some government services and airport operations were also affected, but swift governmental action mitigated the impact.
Ayub highlighted two significant concerns following the CrowdStrike incident: the societal risks of tech industry consolidation and the vulnerability caused by a single company's error. He noted that CrowdStrike and Microsoft's dominant market positions could lead to significant disruptions if not properly managed. He also compared the situation to the SolarWinds hack in 2020, which affected numerous government departments and major corporations.
Ayub stressed the need for governments and businesses to view cybersecurity as a critical investment rather than a mere expense. He pointed out that technological advancements could help prevent future tech failures and secure customer data. The UAE government, he noted, is highly protective of its data, with critical resident data now stored within the country with backups.
Irene Corpuz, also a founding partner and board member at Women in Cybersecurity Middle East, expects ongoing investigations and remediation efforts. She advised businesses to review their update deployment processes and emphasized the importance of proper testing and backup protocols. Corpuz noted that the CrowdStrike incident revealed vulnerabilities in even top security firms, affecting their credibility and client data security.
To prevent future incidents, Corpuz recommended best practices such as extensive pre-deployment testing, implementing fail-safes, and conducting security audits. She also stressed the importance of transparency from software providers and the need for thorough testing before deployment. Collaboration within the IT industry was crucial during the recent incident, and sharing insights to strengthen broader cybersecurity defenses is essential.
