What the CrowdStrike incident taught us about information security
ISO 27001 — the internationally recognised standard for information security
In July 2024, a faulty update to CrowdStrike’s Falcon security software crashed about 8.5 million Windows computers worldwide — airports, banks, hospitals and broadcasters were disrupted. It wasn’t an attack: the fault was in a configuration update that was pushed to all customers at once, without a staged rollout. CrowdStrike withdrew the update within 78 minutes, but recovering the affected computers often meant manual work on each device.
The incident shows that risks to information security don’t only come from attackers. Availability is part of information security, and a failure at one supplier can stop thousands of organisations that depend on it — whatever their size or expertise in cybersecurity.
ISO 27001 is the internationally recognised standard for information security. It helps organisations identify, assess and reduce risks — including those that come from suppliers and changes to systems: it requires change management, testing before release, oversight of suppliers and ICT readiness for business continuity.
Key benefits of ISO 27001
- Identifying vulnerabilities and threats in information systems
- Putting controls in place to protect data and systems
- Monitoring and responding to security incidents effectively
- Building trust with clients and partners
The CrowdStrike incident taught us that even the best aren’t immune to mistakes, and that a failure at a single supplier can stop a whole chain. The key is to keep improving your security practices — including how you handle changes, suppliers and continuity plans.
A standard such as ISO 27001 can significantly reduce risk and help organisations deal effectively with threats and outages. If you want to improve your information security and implement ISO 27001, get in touch!