Crowdstrike IT outage: Singapore government to set up internal task force to assess digital resilience

On August 7, MPs analysed the cause and effects of the major computer outage involving CrowdStrike that rocked the world on July 19, 2024 (Singapore time).

The incident affected media, banking, flights and transportation systems worldwide.

Changi Airport, which handles an average of 1,000 flights a day, has been hit hard, with airport staff resorting to manual check-ins and flight schedules disrupted.

Minister of Digital Development and Information, Josephine Teo, came to clarify the extent of the computer outage.

Most essential services are not affected

According to Teo, most essential services in Singapore have not been affected.

For affected businesses, the impact has primarily been on internal staff, while a minority of cases have seen customers affected by service disruptions.

This included passenger check-in at Changi Airport Terminal 4 and gantry operations at select HDB car parks.

In a written reply to Parliament dated Aug 6, Transport Minister Chee Hong Tat revealed that 108 departing flights were delayed by more than 30 minutes. One departing flight and its arriving return flight were cancelled.

“Pretty harmless software update”

So what exactly happened on July 19 that left so many people facing the “blue screen of death”?

In this particular case, Teo revealed, “it is not yet fully understood what caused a relatively routine software update” to produce this result.

She would later call it a “relatively harmless software update” with unintended consequences.

However, the Ministry of Digital Development and Information (MDDI) has set up an internal task force to engage relevant partners to obtain information on the incident and assess whether further measures need to be taken to improve Singapore’s resilience.

Lessons learned

Given that not all disruptions can be avoided, Teo said it is all the more important for system owners to be able to recover quickly from unexpected disruptions.

Teo explained that critical information infrastructure, essential services and government services are all subject to “strict requirements” and require business continuity plans, disaster recovery plans and incident response plans.

“When things are going well, companies may wonder why they should incur costs or prioritize efforts to assess and improve their resilience measures,” Teo acknowledged.

She encouraged companies to implement precautionary measures before it is too late.

Beware of imposing mandatory requirements

While she stressed the importance of such measures, Teo also said the government must be “very careful” when making such measures mandatory.

She explained that this could deprive owners of computer systems of their power to act and their sense of ownership.

She added that many different components go into making a system resilient.

“I think it’s foolhardy to assume that we fully understand all the different factors that can cause major disruptions. In the vast majority of cases, it’s important to enable, and even require, system owners to take responsibility for building resilience into the system.”

Use of third-party software is “inevitable”

Despite the recent incident, the use of third-party software is “inevitable.”

These software programs offer a “wide range of features” to meet the requirements of various organizations.

“This saves time and resources, as there is no need to develop such software from scratch,” Teo explains.

She assured that government agencies are required to undergo a “thorough risk assessment” and “mitigation measures” when integrating such software.

This includes testing software updates in controlled environments before they go live and gradually rolling out software changes to small groups of users before rolling them out broadly.

Related articles

Top image via MDDI and Markus Spiske/Unsplash