Top cloud providers including Google Cloud, AWS, Rackspace, and Microsoft Azure are used by millions of customers worldwide. According to a recent report by specialist insurance provider Lloyd’s, a failure of one of these services lasting 3-6 days could cost the United States economy an estimated $15 billion.
The report, prepared in collaboration with AIR Worldwide, examined how outages have occurred in the past and what the likelihood would be of an all-region outage to one of the top four cloud providers. Additionally, it explored possible costs associated with downtime.
What Would it Take to Take Down an Entire Cloud Service?
The report proposed numerous possible causes for cloud service outages that could affect one or more of the largest cloud service providers. These vectors include lightning, food, solar flare, power grid interruption, DDoS attack, zero-day exploits, human error, and others.
The report stated, “While not every vector listed could bring down a cloud provider in its entirety, some vectors have led to an all-region downtime event.”
The largest cloud providers break their services into regions, and those regions are typically divided into multiple zones. Each region and zone runs independently of one-another, giving customers the option to spread their resources across multiple systems to avoid a single outage resulting in total interruption.
However, the report indicated that multiple instances of service-wide interruptions have occurred in the past, despite this redundancy.
From the report:
“In February of 2013, Microsoft Azure experience an all-region event when updated HTTPS certificates were not pushed out prior to the expiration of the existing certificates. And in October 2013, Microsoft Azure again experienced an all-region event when an update pushed out to all their data centers exposed an underlying bug.”
The report went on to cite over a half-dozen other cloud incidents from entities including Verizon, Amazon Web Services, Salesforce, and Google Cloud.
Possible Costs of an Outage
One of the findings of the report was that cyber insurance has low take-up rates and coverage limits compared to the projected losses companies would incur during a major cyber incident.
Additionally, it determined that a 3-6 day outage from one of the top three cloud service providers would result in ground-up loss central estimates between $6.9 and $14.7 billion and between $1.5 and $2.8 billion in industry insured losses.
Among the industries that would be affected, the report states that manufacturing would take the brunt of the loss at $8.6B.
The report also found that Fortune 1000 companies would carry 37% of the ground-up losses and 43% of the insured losses arising from the 3-6 days of downtime. Non-Fortune 1000 companies would carry the remaining 63% of the ground-up losses.
The report concluded by stating that corporations are not the only entities that depend on public cloud providers for their IT infrastructure. Hospitals, governments, transportation services, and other civic entities would be affected by such an outage.
