Incident: SEC Disclosure Database Hacked Due to Software Glitch.

Published Date: 2017-09-21

Postmortem Analysis
Timeline 1. The software failure incident at the U.S. Securities and Exchange Commission (SEC) happened in 2016 [63189].
System 1. Test filing component of the system [63189]
Responsible Organization 1. Hackers exploited a software glitch in the test filing component of the SEC's system, leading to the software failure incident [Article 63189].
Impacted Organization 1. The Securities and Exchange Commission (SEC) [63189]
Software Causes 1. The software glitch in the test filing component of the system that was exploited by hackers to gain access to non-public information [63189].
Non-software Causes 1. Lack of timely detection and response to the software glitch that allowed hackers to exploit the system [63189]. 2. Deficiencies in the SEC's information systems, such as failure to fully encrypt sensitive information, use of unsupported software, incomplete implementation of intrusion detection systems, and misconfigurations in firewalls [63189].
Impacts 1. Hackers accessed the SEC's corporate disclosure database and potentially illegally profited from insider information stolen, highlighting a breach of sensitive and confidential information [Article 63189]. 2. The software glitch in the test filing component of the system was exploited by hackers to gain unauthorized access to non-public information, raising concerns about the security vulnerabilities within the SEC's systems [Article 63189]. 3. The incident underscored the threat cyber criminals pose to the integrity of financial markets and raised questions about the SEC's ability to protect investors and financial markets [Article 63189]. 4. The breach at the SEC, despite prompt patching of the vulnerability in 2016, was only discovered last month, leading to potential delays in addressing and disclosing the breach [Article 63189]. 5. The breach also highlighted deficiencies in the SEC's information systems, including issues with encryption, unsupported software usage, intrusion detection system implementation, and firewall configuration [Article 63189].
Preventions 1. Regular security audits and penetration testing to identify vulnerabilities in the system [63189]. 2. Implementing a robust intrusion detection system to quickly identify and respond to unauthorized access attempts [63189]. 3. Ensuring timely and thorough patching of software glitches and vulnerabilities to prevent exploitation by hackers [63189]. 4. Proper encryption of sensitive information to protect it from unauthorized access [63189]. 5. Using supported and updated software to avoid vulnerabilities associated with unsupported versions [63189].
Fixes 1. Promptly patching vulnerabilities in the software system to prevent unauthorized access and exploitation [63189]. 2. Implementing robust encryption measures to protect sensitive information stored in the system [63189]. 3. Ensuring the use of supported software to prevent vulnerabilities associated with unsupported software [63189]. 4. Fully implementing an intrusion detection system to detect and respond to unauthorized access attempts [63189]. 5. Configuring firewalls properly to enhance the security posture of the system [63189].
References 1. Securities and Exchange Commission (SEC) [63189] 2. Government Accountability Office [63189]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident has happened again at the Securities and Exchange Commission (SEC). The article mentions that the breach at the SEC is particularly egregious because its new boss, Jay Clayton, has made tackling cybercrime one of the top enforcement issues during his tenure. It also highlights that the SEC did not always fully encrypt sensitive information, used unsupported software, failed to fully implement an intrusion detection system, and made missteps in how it configured its firewalls, among other deficiencies in its information systems [63189]. (b) The article mentions that cyber criminals have targeted financial information hubs before, citing examples such as the Hong Kong stock exchange and the Nasdaq stock exchange in New York being targeted by hackers in 2011. This indicates that similar incidents have happened at other organizations or financial institutions as well [63189].
Phase (Design/Operation) design, unknown (a) The software failure incident at the SEC was attributed to a design flaw in the test filing component of the system. Hackers exploited a software glitch in this component to gain access to non-public information, leading to the breach. The SEC promptly patched the vulnerability after detecting it in 2016, but only discovered last month that the glitch may have been used for illicit trading [63189]. (b) The articles do not provide specific information about the software failure incident being related to operation factors or misuse of the system.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at the SEC was due to a software glitch in the test filing component of the system that hackers exploited to gain access to non-public information [63189]. The SEC promptly patched the vulnerability after detecting it in 2016, but the agency only became aware last month that the glitch may have provided the basis for illicit gain through trading. This indicates that the failure originated from within the system itself. (b) outside_system: The hackers accessed the SEC's corporate disclosure database and may have illegally profited by trading on the insider information stolen. This breach was caused by external cyber criminals exploiting a software glitch in the SEC's system [63189].
Nature (Human/Non-human) non-human_actions (a) The software failure incident at the SEC was primarily due to non-human actions. The hackers exploited a software glitch in the test filing component of the system to gain access to non-public information, indicating that the contributing factors were introduced without human participation [63189].
Dimension (Hardware/Software) software (a) The software failure incident in the SEC breach was not due to hardware issues but rather due to a software glitch in the test filing component of the system. The hackers exploited this software glitch to gain access to non-public information [63189]. (b) The software failure incident was specifically attributed to a software glitch in the SEC's system, which allowed the hackers to access sensitive and confidential information. The SEC promptly patched the vulnerability in the software after detecting it in 2016, but the discovery that the glitch may have been used for illicit trading was only made last month [63189].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at the SEC was malicious in nature. Hackers accessed the SEC's corporate disclosure database by exploiting a software glitch in the test filing component of the system. They may have illegally profited by trading on the insider information stolen, indicating malicious intent to harm the system and potentially manipulate U.S. equity markets [63189].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident at the SEC was partly due to poor decisions. The Government Accountability Office found deficiencies in the SEC's information systems, such as not fully encrypting sensitive information, using unsupported software, failing to fully implement an intrusion detection system, and misconfiguring firewalls [63189]. These poor decisions contributed to the vulnerability that hackers exploited to gain access to non-public information for potential illicit trading.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident reported in the article was due to a software glitch in the test filing component of the SEC's system, which was exploited by hackers to gain access to non-public information. This indicates a failure due to development incompetence, as the glitch in the software allowed unauthorized access to sensitive data [63189]. (b) The article does not provide information indicating that the software failure incident was accidental.
Duration temporary (a) The software failure incident in the SEC database breach was not permanent as the hackers exploited a software glitch in the test filing component of the system to gain access to non-public information. The SEC promptly patched the vulnerability after detecting it in 2016, indicating that the failure was not due to contributing factors introduced by all circumstances [63189]. (b) The software failure incident in the SEC database breach was temporary as the hackers exploited a software glitch in the test filing component of the system to gain access to non-public information. The breach was not a permanent failure as the SEC promptly patched the vulnerability after detecting it in 2016, indicating that the failure was due to contributing factors introduced by certain circumstances but not all [63189].
Behaviour crash, value, other (a) crash: The software failure incident in the SEC database hack can be associated with a crash behavior. The hackers exploited a software glitch in the test filing component of the system, which led to unauthorized access to non-public information. This unauthorized access can be seen as a system losing state and not performing its intended functions properly [63189]. (b) omission: The incident does not directly point to a failure due to omission where the system omitted to perform its intended functions at an instance(s). Instead, the focus is on the unauthorized access and potential illicit trading due to a software glitch [63189]. (c) timing: The timing of the software failure incident is not specifically highlighted as a factor in the articles. The emphasis is more on the discovery of the hack and the potential illicit trading activities that may have occurred due to the software glitch [63189]. (d) value: The software failure incident can be linked to a failure due to the system performing its intended functions incorrectly. The hackers gained access to non-public information through the software glitch, which could have been used for insider trading or manipulating U.S. equity markets, indicating an incorrect performance of the system [63189]. (e) byzantine: The articles do not mention any behavior of the software failure incident related to a byzantine failure, which involves the system behaving erroneously with inconsistent responses and interactions [63189]. (f) other: The software failure incident can also be categorized under the "other" behavior as it involves a security breach due to a software glitch that allowed unauthorized access to sensitive information, potentially leading to illicit trading activities. The incident raises concerns about the integrity of financial markets and the security measures in place at the SEC [63189].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at the U.S. Securities and Exchange Commission (SEC) involved hackers accessing the corporate disclosure database and potentially profiting from insider information stolen. The hackers exploited a software glitch in the test filing component of the system to gain access to non-public information, which could have been used for insider trading or manipulating U.S. equity markets. The breach raised concerns about the integrity of financial markets and highlighted the threat cyber criminals pose. Additionally, the incident at the SEC came shortly after the Equifax data breach, where hackers stole data on millions of customers, emphasizing the impact on people's data and financial information [63189].
Domain finance (a) The failed system was related to the finance industry. The software glitch in the SEC's system allowed hackers to access non-public information that could be used for insider trading or manipulating U.S. equity markets [63189]. The SEC is a key institution tasked with protecting investors and financial markets, indicating the industry it supports is finance.

Sources

Back to List