Skyguard Car Security Service Complete Outage - Critical Deficiencies in a EuroOne Partner's IT System

The Case from a Professional Perspective: IT Infrastructure and Business Continuity

On December 2, 2023, Saturday evening, a severe service outage began with the Skyguard car security system operated by Autosecurit Ltd. As an IT infrastructure expert, it was immediately clear to me that the problem stemmed from the lack of an adequate business continuity and disaster recovery plan (BCDR), and that the recovery time objective (RTO) and recovery point objective (RPO) were obviously not properly defined or implemented.

The severe outage of Skyguard was not just a simple technical error, but a systemic problem that highlights the critical role of IT infrastructure in modern services. It is particularly concerning that this involves a security service whose primary role is to guarantee safety, and which operates as a EuroOne partner, where there are strict requirements regarding service availability.

The Customer Experience: Loss of Security and Inconveniences

The real impact of the service outage was evident on the customer side. The application suddenly interrupted authentication, which meant that the car could only be used with the traditional PIN keypad. Fortunately, this worked for me as the device was in the car and I had recently replaced its battery.

The situation became critical on Monday when I had to take the car to the service center. Due to the Skyguard system malfunction, I was unable to put the vehicle into service mode despite having the correct PIN code. The service center eventually had to create a bypass for the CAN gateway, resulting in an additional cost of 80,000 HUF + VAT. This was not just a financial loss, but demonstrated how a security system failure can cascade and cause problems with other systems in the car.

In addition to the loss of security, the unavailability of customer service was a serious problem. On Sunday, I attempted to contact them by phone, but all calls were immediately rejected. This is completely unacceptable for a service that performs security functions and 24/7 availability would be expected.

The IT Expert's Diagnosis: Technical Background of the Problem

Based on my IT professional experience, I identified several possible causes behind the collapse of the Skyguard system:

• Complete data center shutdown: This alone does not explain the 40+ hour outage. Even in the case of a power outage, service could be restored within 4 hours with a diesel generator.
• Lack of redundancy: A basic requirement for a security service would be the existence of a geographically separate secondary data center.
• Possibility of a cyber attack: Upon investigation, I noticed that Skyguard's infrastructure is AWS-based. Other AWS customers did not report service outages during this period, so it is more likely that a targeted attack or serious configuration error occurred.
• Telephone system collapse: The automatic rejection of phone calls indicates a VOIP or other network problem, which means that the telephony was not properly redundant.

It is particularly concerning that not only the application, but also the telephone customer service was unavailable. This indicates that there was no proper backup system or procedure in case the primary communication channel fails. A truly professional security service should have multiple, independent communication channels.

RTO and RPO in Practice: The Cornerstones of Modern IT Security

The Skyguard case is an excellent example of why proper definition and implementation of RTO (Recovery Time Objective) and RPO (Recovery Point Objective) is critically important for every service, especially security systems.

The critical role of IT infrastructure in modern business life cannot be emphasized enough. The lack of proper systems, protocols, and security procedures means not only technical problems but real business and security risks. The Skyguard case clearly shows that even a security provider can struggle with serious deficiencies in this area.

Today, every business is built on IT infrastructure. Take, for example, banks and financial service providers that operate with 99.999% availability, meaning less than 5 minutes of annual downtime. Healthcare systems, where an IT outage could endanger lives, often use redundant architectures with multiple data centers. For airports and airlines, a booking system failure can cause hundreds of thousands of dollars in losses per minute and affect thousands of passengers.

Previous Experiences and the Lack of Lessons Learned

It is particularly concerning that this was not the first problem of this kind in Skyguard's history. Already in 2015, more than 8 years ago, I experienced a similar outage when the application and phone availability also did not work.

A memorable incident was when they woke me up at 3 AM to ask if everything was alright with my car because it had triggered an alarm, while there was a server outage. This already indicated a serious deficiency - they were asking me about my car while their own server was not working!

The fact that similar problems arose in both 2015 and 2023 suggests that the company has not learned from previous mistakes and has not adequately developed its IT infrastructure. This is particularly problematic for a provider that operates as a EuroOne partner and would be expected to continuously improve and apply the highest level of security protocols.

Conclusions and Recommendations: Path to a Secure Service

The 40+ hour outage of the Skyguard service and the subsequent problems clearly show that urgent changes are needed in the company's IT infrastructure and business continuity planning.

In my experience, companies are often only willing to take BCDR planning seriously after a severe incident. I remember a previous client who only accepted the previously proposed redundant Hyper-V and Microsoft SQL solutions after a significant system outage.

In the case of Skyguard, the question arises as to how well they comply with industry standards, especially the EuroOne requirements, which are extremely strict for security services. The service provider needs to reevaluate its business continuity plan and make significant investments in its IT infrastructure.

I would recommend the following steps to avoid similar cases:

1. Review the Single Points of Failure during the cyber security assessment
2. Perform and document an appropriate risk analysis
3. Implement a multi-layered, geographically separated redundant infrastructure
4. Define and adhere to clear RTO and RPO targets
5. Hold regular DR exercises to test recovery protocols
6. Develop a multi-level customer communication plan for service outages

A security service, especially a EuroOne partner, should set an example in the areas of reliability, security, and business continuity. The Skyguard case clearly shows that they still have a long way to go in this area.