On Friday 19th July 2024, as was being reported by some news agencies, the “Millennium Bug” finally showed up, only 8,967 days behind schedule, or 24 years, 6 months, 19 days, if that suits better! The early news reports were not great. Most of the press agencies weren’t really sure what was causing IT systems all over the world to fail. It was initially reported as a potential cyber attack, then it was being blamed on Microsoft, The Guardian newspaper even reported it as a power outage. Sky News, a major news channel in the UK, was forced off the air as key systems driving their broadcast crumbled from the outage. Flights were cancelled as airport systems were brought down by the failure. Delta Airlines had to cancel over 4,000 flights. The impact was huge, not to say the least.
So, what was the cause? A bug in the cyber security software from the company CrowdStrike led to widespread disruption, resulting in organisations running Microsoft’s Windows operating system on their PCs to fail and display the notorious “Blue Screen of Death”. Approximately 8.5 million PCs were affected by the bug.
It’s no surprise that the fallout has hit CrowdStrike hard. The BBC reported that “Shares in cybersecurity firm CrowdStrike have plunged more than 13% as the company reckons with the aftermath of causing a global IT outage.”
In what might be a rare occurrence, the vast majority of educational establishments around the world found themselves pretty much unaffected by the failures. This is likely due to the fact that CrowdStrike has approximately 29,000 customers worldwide, with more than 500 of those being on the Fortune 1000 list, in addition to the software not being priced favourably for the education market.
So, if you’re a leader in education, you might be thinking, why do I care? We weren’t affected! Well, you need to care. A lot. Regardless of the lack of impact to schools, the incident serves as a stark reminder of the vulnerabilities that can affect even the most robust IT systems.
The global outage was caused by a tiny bug. A 40kb (kilobyte) file. You can equate that to a few lines of text in a document or an email message. For reference, even a digital photo taken on a smartphone is several times larger.
In today’s digital age, IT systems are the backbone of organisational operations. For schools, this encompasses everything from administrative functions and the delivery of teaching and learning, to everything in between. Think health and safety, HR, finance, safeguarding and more. Almost every aspect of school life is entangled in digital systems in some way or another. Think of the panic that ensues in schools when the Internet goes down. An outage of a similar nature to the global outage would leave schools without systems for weeks, possibly even longer.
IT has, for far too long, been an afterthought in schools. A comprehensive understanding of these systems is paramount. Leaders in education must recognise that IT is not merely a support function but a critical component of the school's infrastructure. So, what does understanding and digital resiliency look like? Let’s take a look at some key areas to recognise and consider.
Proactive IT Management
Schools need to adopt a proactive approach to IT management. IT isn’t just about reactive break-fix anymore. This hasn’t been the case for many years, even pre-pandemic. IT operations require teams of IT personnel, not individuals. At the very least, an IT Manager and an IT Technician in a small school is a must. The larger the school, the greater the need for a larger team of multiple personnel.
Gone are the days of IT support availability a few days a week. IT systems are akin to a living, breathing entity that require on-going support and maintenance. This includes regular testing and deployment of updates, patches, and maintenance of all hardware, software and systems.
Training and Development
Ensuring that IT staff are well-trained and stay abreast of the latest developments in industry developments and especially cyber security, can help greatly to ensure that critical systems are in the best possible position of resilience against disaster and threats. The IT industry is one of the fastest evolving industries in the world. Being aware of the ever evolving landscape is vital to ensure organisations continue to run smoothly.
But training doesn’t just lie with the IT staff. Your systems are only as secure as the people using them. You can install the most secure door locking systems in the world. But if someone opens the door to the intruder and lets them into the building, the locks were pointless in that instance. There is a growing misconception in schools and organisations that staff know how to use IT systems because we simply use them in our everyday jobs and lives. Or that they will just “pick up” any changes as they go along. This is a very risky approach to using IT systems and is usually the main cause for incidents such as data breach and malware infections. Regular ongoing IT training is an absolute must.
Disaster Recovery and Business Continuity Plans
Schools need to have a well-documented and tested disaster recovery and business continuity plan in place. This ensures that, in the event of an IT outage, the school can continue to function with minimal disruption. It’s easy to say that in case of a disaster, we might close the school in an emergency to assess the situation and think of next steps. But, what happens if you get the dreaded phone call the day before a disaster, or worse yet, Ofsted are in the building in the middle of a disaster?
Change Management
If it ain’t broke, don’t fix it! Right? Wrong! A famous quote from William Pollard states that:
“Learning and innovation go hand in hand. The arrogance of success is to think what you did yesterday will be sufficient for tomorrow”.
We all know that change is hard. It’s costly and it requires time and patience to implement. But embracing change is both vital and inevitable. It could be argued that the global IT outage had such an impact on companies worldwide because they have been so reliant on legacy systems. Reliance on particular platforms and systems is something that schools need to urgently consider moving away from.
The CrowdStrike failure affected the Microsoft Windows operating system. Apple’s macOS and Google’s ChromeOS operating systems were wholly unaffected. That’s not to say that we must never use the Windows operating system ever again. But we must build a “platform agnostic” culture. This can be achieved by moving to cloud and web based systems and platforms. Software that can run on any device. Be it a Windows PC, MacBook, Chromebook, iPad or even a smartphone. Schools seriously need to consider moving to systems that can run on any platform.
The CrowdStrike incident underscores the growing importance of moving towards cloud-based and web-based Software as a Service (SaaS) solutions. These platforms offer several advantages:
- Scalability and Flexibility: Cloud-based solutions allow schools to scale their IT resources according to demand, providing greater flexibility and cost efficiency.
- Enhanced Security: Leading cloud service providers invest heavily in security, often offering more robust protection than individual schools can achieve on their own. They provide regular updates and patches, ensuring that the software is up-to-date and secure.
- Reduced Dependency on Local Hardware: Web-based software reduces the dependency on local hardware, which can be prone to failure. This can minimise disruptions caused by hardware issues and ensure that critical applications are accessible from any device with an internet connection.
A Strategic Approach for Senior Leaders
Senior leaders in education must take a strategic approach to IT management. This involves:
- Ongoing Investment in IT Infrastructure: Allocating appropriate resources to maintain and upgrade IT infrastructure is essential. This includes investing in reliable hardware, up-to-date software, and adequate cyber security measures.
- Collaboration and Communication: Fostering a culture of collaboration and open communication between IT staff and other departments. This ensures that IT considerations are integrated into all aspects of school operations and decision-making processes, not an afterthought.
- Regular Risk Assessments and Audits: Conducting regular risk assessments and IT audits to identify potential vulnerabilities and areas for improvement. This proactive approach can help prevent issues before they escalate into significant problems.
- Strategic Partnerships: Collaborating, networking and building strong relationships with technology vendors and service providers to ensure that the school has access to the latest innovations and support. This can also facilitate quicker responses to emerging threats and issues.
In conclusion, the global IT outage caused by the CrowdStrike software bug serves as a critical reminder of the importance of robust IT management in schools. Leaders must take proactive steps to understand and secure their IT systems, embrace cloud-based solutions and support the development of comprehensive disaster recovery and business continuity plans.
By doing so, they can safeguard against disruptions and ensure that school operations and teaching and learning continues uninterrupted. Leaders in education have a pivotal role to play in driving this strategic approach, ensuring that IT is viewed not just as a support function, but as a fundamental pillar of the school's success.
As for the role big tech plays in the direction of travel for the IT industry, whilst Microsoft weren’t entirely to blame for the outage, there is a valid argument that they seriously need to look at reconfiguring the Windows operating system such that 3rd party software can't have an impact at such a low level. Although this is a mammoth task.
It could be argued that Apple and Google have fared slightly better with the development of their operating systems as they have been more recent and less integrated than Microsoft’s Windows. Apple and Google’s marketing teams certainly enjoyed their moment in the face of the impact to Windows PCs. However, all of the big tech companies need to do a lot more to ensure that their platforms are more robust and not susceptible to such failures of a catastrophic nature that impact on people's lives. But that’s an article for another day!