Systemic Failure Archive and Research

Digital & Cyber Infrastructure Dependencies (2020s)

3 min read

Summary

Across the 2020s a recurring class of systemic failure has come from the concentration of the digital infrastructure that the rest of society runs on. A handful of security vendors, cloud platforms, content-delivery networks and software libraries sit beneath a vast range of services, so a fault or a compromise in one propagates far beyond it. The clearest single instance is the CrowdStrike outage of 19 July 2024, when a faulty update to one security product crashed millions of computers worldwide in what is regarded as the largest IT outage in history.

Systemic Features

  • Concentration and single points of failure. When one vendor’s software protects the majority of large enterprises, or one cloud region hosts a large share of services, that vendor becomes a shared dependency whose failure is everyone’s failure at once — a monoculture with a common mode of failure.
  • Automated, near-instant global distribution. Modern software pushes updates automatically to every customer, so a defective change reaches the whole install base within minutes, before anyone can catch it — removing the staged rollout that would otherwise contain a fault.
  • Deep integration amplifies blast radius. Security agents and infrastructure software often run deep in the operating system or network, so when they fail they take the host down with them rather than failing gracefully.
  • Slow, manual recovery. A fault distributed in seconds can take days or weeks to undo when each affected machine must be fixed by hand — the recovery is not symmetric with the failure.
  • Tight coupling to the physical world. Because airlines, hospitals, banks and emergency services now depend on these systems, a digital fault becomes cancelled flights, postponed surgery and unreachable emergency lines.

Notable Incidents

  • CrowdStrike outage (July 2024) — a faulty Falcon Sensor update crashed roughly 8.5 million Windows machines, grounding flights, disrupting hospitals, banks, payment systems and emergency services worldwide; global losses were estimated in the billions. Not a cyberattack, but a self-inflicted software error whose reach came from CrowdStrike’s presence across critical systems.
  • SolarWinds supply-chain compromise (2020) — attackers inserted malicious code into a widely used network-management tool, reaching thousands of organisations including government agencies through a single trusted vendor.
  • Log4Shell (2021) — a critical vulnerability in a ubiquitous open-source Java logging library exposed a large fraction of the world’s software at once.
  • Colonial Pipeline ransomware (2021) — a ransomware attack on a single operator shut a major US fuel pipeline, causing regional shortages and panic buying.
  • Fastly and Facebook outages (2021) — a content-delivery-network fault and a configuration error each took large swathes of the internet offline for hours, illustrating how concentrated internet infrastructure has become.

Cascading Systems Affected

  • Aviation, transport and logistics
  • Healthcare and emergency services
  • Banking, payments and financial markets
  • Government services and communications
  • Commerce, media and supply-chain coordination

Sources

Graph View

Backlinks