Airport blues: Passengers grounded by Microsoft-CrowdStrike outage

• Main Authors: RAMANATHAN, Kiruthika, BARROS, Rafael J, LIM, Thomas
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2024
• Subjects: Root Cause Analysis; IT Security Management; Cybersecurity; Process Management; Service Delivery; Enterprise Computing; Management Information Systems
• Online Access: https://ink.library.smu.edu.sg/cases_coll_all/504; https://cmp-shop.smu.edu.sg/products/airport-blues-passengers-grounded-by-microsoft-crowdstrike-outage?variant=42392972492842
• Institution: Singapore Management University

On July 19, 2024, CrowdStrike, one of the largest players in the global endpoint detection and response software market, pushed a single configuration file as an update to its Falcon Sensor program. This program is commonly used by Microsoft enterprise computers running on the Windows platform. The file update was meant to enable Falcon to detect if hackers were using novel ways to hack end-user machines, but it caused a logic error that led to computers crashing around the world. Students are asked to put themselves in the shoes of an Information Technology (IT) Support Technician at Singapore’s Changi Airport Group (CAG), who has been sent to assist the ground crew of Kuaifei, an airline operating at the airport. They will need to analyse how the incident was discovered, mitigated, managed, and communicated. This case is intended for use in an enterprise solutions management course in an information systems undergraduate programme. Students should be able to achieve the following learning objectives: apply ITIL (Information Technology Infrastructure Library) incident management frameworks to analyse large-scale IT outages, and understand key ITIL incident management stages; evaluate technical root cause analysis; and design incident response protocols for mission-critical systems.