Join our subscribers
Where Does Liability Reside After the CrowdStrike Outage?
Friday, August 2, 2024
Responsibility for the outage’s repercussions may have to be decided in court. That could set a tone for policies on third-party tech snafus.
Time can also play a role in litigation. In the current policy landscape, says ImmuniWeb CEO Ilia Kolochenko, if an IT support vendor or another service provider, such as an accountant, suffers a data breach due to a third-party incident, there might not be a quick remedy. “It will be a long journey to get compensation from them in the court of law,” he says.
Kolochenko is also an attorney and an adjunct professor of cybersecurity practice and cyber law at Capitol Technology University. He believes third-party suppliers such as CrowdStrike tend to opt to settle amicably, when possible, with their clients. “Obviously nobody wants negative publicity,” Kolochenko says.
Even if there is a quiet resolution on the legal side, the impact of the outage may bring about other changes. “I think a collateral effect of the CrowdStrike debacle will see that most organizations will start performing even more third-party risk management exercises,” he says. However, he also questions the value of such efforts. “It is highly likely they will simply raise the bar even higher,” Kolochenko says.
For example, a company might make demands for its IT and security services that turn away some vendors, he says, that cannot afford to offer the newer, heightened levels of service and protection being asked for. “In the short term, we’ll see significant costs increase of doing business for many companies that will unlikely bring any additional security to the economy in general,” Kolochenko says. “I can only hope that lawmakers will consider adding third-party risk limitation strategies to be incorporated into existing or newly enacted laws.”
He notes that the European Union’s Digital Operational Resilience Act (DORA) goes into effect in January 2025 and includes comprehensive and detailed requirements for third-party risk management, at least for certain technologies. “It’s mostly about cyber security,” Kolochenko says. Read Full Article
CPO Magazine: Defense Contractor Leidos’ Data Leak Exposes Pentagon’s Documents on the Dark Web
