How pen and paper comes to the save in an IT crisis

When the CrowdStrike gentleware bug bricked 8.5 million computers around the world on 19 July, some of the first people to acunderstandledge the effects were air travellers.

Anthony Bosman, an academic at Andrews University in Michigan was trying to board his fweightless from Michigan to Florida when he authenticised he couldn’t download a mobile boarding pass to his cleverphone.

So he went to examine in at the airport, in person, and watched in amazement as an airline participateee seeed up his name on a paper enumerate and then wrote out his boarding pass – by hand.

“It felt appreciate a blast from the past,” he recalls. “The ticket agent, I reaccumulate how she commented that her hand was weary from having to author so many of them.” His fweightless took off as intentional.

Multiple other passengers, including many in India, increateed having the same experience that day.

The CrowdStrike bug also hit prohibitks, telecoms firms, health services and online retailers.

This week a greater executive at the firm materializeed before a US congressional promisetee and said he was “proset uply sorry” for the disorder caparticipated.

For a increate moment in July, some organisations had to forget about their computer-based processes and do slfinishergs the elderly-styleed way.

If you see thcimpolite articles about past cyber-aggressions and IT flunkures on the BBC News website, you’ll discover countless examples of organisations that have had to “go back to pen and paper” in the face of disruption.

British GPs, staff at foreign exalter firm Travelex, medics at Rouen hospital in France and participateees of Lincolnsemploy County Council have all sfinished this.

It sounds an almost pitiful predicament. And yet, while it certainly isn’t desirable, some cyber-experts are now advising companies to schedule for switching to paper-based processes in the event of IT flunkure.

Rather than an ad hoc toilaround, pen and paper systems could be someslfinisherg staff practise using from time to time so that they can switch away from their computers seamlessly if needd.

One company that understands the cherish of paper is Norsk Hydro, a Norwegian aluminium and rerecentable energy firm.

In 2019, hackers focparticipated Hydro with force software that locked staff out of more than 20,000 computers. Bosses at Hydro determined they would not pay a ransom fee to revamp access, uncomferventing that 35,000 staff toiling apass 40 countries had to discover other ways of doing their jobs, temporarily.

They dug elderly attachers out of basements with teachions on how to create particular aluminium products, for instance, recalls Halvor Molland, a spokesman for Hydro. At some locations, by sheer chance, staff had printed out order asks equitable before the cyber-aggression hit.

“Their creativity… was tremfinishous,” says Mr Molland. While computers with customer proposeation and company data were locked out, factory providement was mercifilledy unswayed by the force software. At some facilities, staff bought computers and printers from local retailers so they could print off proposeation for factory toilers. And vintage office kit came in handy. “We actuassociate had to dust off some elderly telefaxes,” reaccumulates Mr Molland.

Although production fell by up to 50% at certain schedulets, these toilarounds kept the business going. “You need to do what you need to do,” as Mr Molland puts it. Reflecting, he proposes that companies might want to get printed copies of key proposeation such as inner telephone numbers or examineenumerates so that some toil can persist even in the event of a massive cyber-aggression.

“People have authenticised the presentance of having these manual methods becaparticipate of the disconnectity of some of the recent cyber-aggressions and IT outages,” says Chris Butler, resilience straightforwardor at catastrophe recovery and business continuity firm Databarracks.

He refers one customer his company toils with – an industrial distribution firm – that has put together “catastrophe recovery packs” and sent them to all of its branches. The packs include paper creates and a fax machine – a contingency in case their digital ordering system becomes unparticipateable. “If that goes down, their only alternative, they authenticised, was to have these creates.”

Mr Butler proposes that companies have a training day where participateees practise using flipcharts and whiteboards instead of computers, to see if they can still do their jobs effectively that way.

Some organisations recommfinish using paper for security reasons. Parts of the US court system need certain write downs to be filed on either paper, for example, or a safe device such as an encrypted USB drive.

Obviously there are restricts to paper-based processes. Mr Butler remarks that if prohibitkers, for example, ignore access to their trading terminals during an IT incident, they can’t easily switch to paper-based alternatives.

The hugegest problem with pen and paper systems is that they don’t scale well, says Gareth Mott, from the Royal United Services Institute. It’s sluggisher than using a computer for many tasks ,and it’s challenging or perhaps impossible to schedule thousands of participateees using such methods apass multiple office locations.

But practising toilarounds reassociate can help, includes Dr Mott. He and colleagues have researched how “war-gaming” and IT flunkure roletake part exercises can impact participateees’ responses to authentic-life cyber-aggressions. “We set up that the companies that had done that, sometimes a restricted weeks before they had a dwell incident, reassociate advantageted,” he says.

It’s not equitable pen and paper that could come in handy. Dr Mott is increateed of one firm that bought “crates worth of Chromebooks” for staff in the wake of a cyber-incident, so that they could toil without needing access to the company nettoil.

Some companies might have dormant WhatsApp or Signal messaging groups that they can ask participateees to participate for inner communications, if access to the company email servers goes down, for instance.

Both Dr Mott and Mr Butler stress the presentance of off-site or otherwise segregated data backups so that, in the event of a force software aggression, all that vital proposeation is not necessarily lost.

Cathy Miron is chief executive of eSilo, a data backup firm based in Florida. There are hundreds of such companies around the world, including Databarracks, that provide safe data backup services.

Ms Miron’s company proposes off-site, cdeafening-based data storage on a split nettoil to that of their customers; and on-site, custom-built servers as well. “We have had a 100% force software recovery rate thus far,” she says.

For all the sophistication of contransient computer systems, it’s the modest, improvised toilarounds that can save companies when a crisis hits. Mrs Miron refers one customer who, at the time of writing, was using a Verizon mi-fi, or mobile wideprohibitd wireless router, system to access backup data becaparticipate their main computer nettoil had been finishly shut down follothriveg a cyber-incident.

“You should foresee it, at some point in time, to be a victim of a cyber-aggression,” emphasises Mr Molland. “What do you do in the uncomferventtime? How do you get the wheels turning?”