Businesses still need protection when the lights are off
The outage suffered by Google Cloud this week has raised questions about the resilience of the economy, much of which relies heavily on cloud services.
On Tuesday, London businesses including Halifax and Revolut experienced disruption when Google Cloud services in London went down. In a statement, Google said the outage was caused by a “power event” and that an incident report would follow.
The outage affected businesses across retail, banking, and real estate, as well as courtrooms and the NHS app.
Although the outage didn’t come from a cyber security breach this time, the disruption raises questions about businesses' ability to operate when the cloud falls from the sky, as all but 20% of FTSE 100 companies are dependent on cloud infrastructure.
“We've had so many major technology outages lately that I'm beginning to wonder whether we should start treating them as scheduled events,” said Scott Dawson, CEO at DECTA UK
“But while we might be getting used to hearing about them on the news, I doubt many of the businesses caught up in today’s disruption are finding them any easier to deal with.
“Google says a power failure at its London cloud facility was behind today's outage, affecting everything from banking apps and delivery services to court hearings.
“Yet again, we're seeing just how dependent businesses have become on a relatively small number of technology providers, and how much disruption a failure at one of them can cause.”
Tim Pfaelzer, Senior Vice President & General Manager EMEA, Veeam, agreed, adding that the outage “shows how much of the UK’s daily life now runs on a small number of cloud platforms.
“One power event in a single London data centre zone stopped people paying for shopping, held up a house move, shut café tills and briefly stopped patients booking appointments. Services that look entirely separate often depend on the same underlying infrastructure, and many critical business functions no longer have a true ‘manual mode’ when it fails.”
Building Resilience
This week’s outage has raised several questions across the private and public sectors, as it laid bare the over-reliance on cloud technologies.
Earlier this year, the Cyber Monitoring Centre and Parametrix published a report on UK exposure to cloud infrastructure failure. The study finds that more than 60% of UK companies depend on cloud services for critical functions, a figure that rises to 80% of FTSE 100 companies.
Dame Meg Hillier MP, Chair of the Treasury Committee, has written to the Bank of England and the Financial Conduct Authority requesting a timeline of events on Tuesday, how many banks and customers were disrupted, and a list of lessons learnt from the outage.
According to Dawson, this is an example of the “uncomfortable conversations” departments will have to have after this week.
“Banks and payment providers spend a fortune on keeping their systems running,” said Dawson, “but how many know whether their backup supplier is using the same Google infrastructure as their main one? That's something I'd want an answer to.
“We've known for years that cloud services can fail, and there's really no excuse for waiting until customers are locked out of their accounts to find out whether your contingency plans work.”
Pfaelzer described these outages as “inevitable”, adding, “The key question for every organisation is not just, ‘Can we recover our systems?’ It is, ‘Can we keep running the business while they’re unavailable?’
“That means defining a ‘Minimum Viable Business’, the essential processes, systems and data that must continue during an outage, and understanding which suppliers it depends on. Relying on one region or one provider is a risk to plan for, not assume away.”
“As the FCA has made clear, people need to be able to access their money and make payments. That takes a data resilience strategy with no single point of failure. Keep copies of critical data away from the main environment and be able to restore operations quickly to a known good state, somewhere else if necessary. That plan should be tested before a day like today, not during it.”
“Resilience may not be particularly glamorous, but it's something the industry needs to invest in and properly test,” said Dawson.
“You can have all the latest technology, but it's not much use to a merchant who can't take payments or a customer who can't access their money. Getting everything running again is one thing, but restoring confidence in a service people depend on is quite another.”
