Incident: Chinese Hackers Breach Visma's Network for Corporate Secrets.

Published Date: 2019-02-06

Postmortem Analysis
Timeline 1. The software failure incident at Norwegian software firm Visma, where hackers breached their network, happened in December, as mentioned in the article [81162]. Therefore, the estimated timeline for the software failure incident would be December 2018.
System 1. Visma's network security system [81162]
Responsible Organization 1. Hackers working on behalf of Chinese intelligence breached the network of Norwegian software firm Visma to steal secrets from its clients [81162].
Impacted Organization 1. Clients of Norwegian software firm Visma [81162]
Software Causes 1. The software cause of the failure incident was a breach in the network of Norwegian software firm Visma by hackers working on behalf of Chinese intelligence [81162].
Non-software Causes 1. The breach was attributed to hackers working on behalf of Chinese intelligence, indicating a deliberate cyber attack [81162].
Impacts 1. The software failure incident led to the breach of the network of Norwegian software firm Visma by hackers working on behalf of Chinese intelligence, resulting in the potential theft of secrets from its clients [81162]. 2. The attack was part of a global hacking campaign by China's Ministry of State Security to steal intellectual property and corporate secrets, affecting not only Visma but also other companies like Hewlett Packard Enterprise Co and IBM [81162]. 3. The incident highlighted the dangers organizations face from cyber attacks on their supply chains, as attackers target supply chains to find alternative ways into secure networks [81162]. 4. The attackers, identified as part of a hacking group known as APT 10, intended to infiltrate client systems in search of commercially-sensitive information, indicating a potential threat to Visma's customers [81162].
Preventions 1. Implementing multi-factor authentication to prevent unauthorized access using stolen credentials [81162]. 2. Conducting regular security audits and penetration testing to identify and address vulnerabilities in the network [81162]. 3. Enhancing employee cybersecurity training to raise awareness about phishing attacks and social engineering tactics [81162]. 4. Utilizing advanced threat detection systems to monitor and detect suspicious activities in real-time [81162]. 5. Collaborating with cybersecurity firms and sharing threat intelligence to stay informed about emerging threats and attack techniques [81162].
Fixes 1. Enhancing network security measures to prevent unauthorized access and credential theft, such as implementing multi-factor authentication and regular security audits [81162]. 2. Increasing awareness and vigilance within the organization to detect and respond to potential cyber threats promptly [81162]. 3. Collaborating with cybersecurity firms and government agencies to share threat intelligence and best practices for defending against sophisticated hacking campaigns like Cloudhopper [81162].
References 1. Cybersecurity researchers at Recorded Future [81162] 2. Visma's operations and security manager, Espen Johansen [81162] 3. Paul Chichester, director for operations at Britain's National Cyber Security Centre [81162] 4. Investigators at cybersecurity firm Rapid7 [81162] 5. Priscilla Moriuchi, director of strategic threat development at Recorded Future and a former intelligence officer at the U.S. National Security Agency [81162]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: The article mentions that Visma, the Norwegian software firm, was breached by hackers working on behalf of Chinese intelligence. This incident is part of a global hacking campaign known as Cloudhopper, which targets technology service and software providers to reach their clients. The article also states that other companies like Hewlett Packard Enterprise Co and IBM were victims of the same campaign [81162]. (b) The software failure incident having happened again at multiple_organization: The article mentions that the hacking campaign by China's Ministry of State Security, known as Cloudhopper, has targeted multiple technology service and software providers to reach their clients. While specific companies affected by this campaign were not disclosed, it is indicated that there are many more victims beyond Visma, Hewlett Packard Enterprise Co, and IBM [81162].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the breach of the network of Norwegian software firm Visma by hackers working on behalf of Chinese intelligence. The breach was part of a global hacking campaign by China's Ministry of State Security to steal intellectual property and corporate secrets. The hackers accessed Visma's network by using stolen login credentials, indicating a failure in the design of the system's authentication and access control mechanisms [81162]. (b) The software failure incident related to the operation phase is evident in the potential catastrophic consequences highlighted by Visma's operations and security manager, Espen Johansen. Although he was confident that no client networks were accessed, he acknowledged the severity of the situation if the hackers had been able to harvest information. This indicates a failure in the operation or misuse of the system that could have led to significant data breaches [81162].
Boundary (Internal/External) within_system (a) The software failure incident involving the breach of Norwegian software firm Visma's network by hackers working on behalf of Chinese intelligence can be categorized as a within_system failure. The breach was initiated by the hackers using stolen login credentials to access Visma's network [81162]. This indicates that the failure originated from within the system itself, as the hackers were able to infiltrate the system using internal credentials.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case was primarily due to non-human actions, specifically a cyber attack orchestrated by hackers working on behalf of Chinese intelligence [81162]. The breach of the network of Norwegian software firm Visma was a result of the hackers exploiting vulnerabilities and using stolen login credentials to access the systems. The attack was part of a global hacking campaign known as Cloudhopper, targeting technology service and software providers to reach their clients. The hackers were operating as part of a hacking group known as APT 10, which is behind the Cloudhopper campaign. The incident highlights the dangers organizations face from cyber attacks on their supply chains, emphasizing the role of non-human actions in causing software failures.
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The software failure incident reported in the article is not attributed to hardware issues but rather to a cyber attack orchestrated by hackers working on behalf of Chinese intelligence [81162]. (b) The software failure incident related to software: - The software failure incident reported in the article is due to a cyber attack on the network of Norwegian software firm Visma by hackers associated with China's Ministry of State Security [81162].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. Hackers working on behalf of Chinese intelligence breached the network of Norwegian software firm Visma to steal secrets from its clients. The attack was part of a global hacking campaign by China's Ministry of State Security to steal intellectual property and corporate secrets [81162]. The attackers accessed Visma's network using stolen login credentials and were operating as part of a hacking group known as APT 10, which is behind the Cloudhopper campaign [81162]. The incident was described as potentially catastrophic, and the hackers' activity inside Visma's network suggested they intended to infiltrate client systems in search of commercially-sensitive information [81162].
Intent (Poor/Accidental Decisions) poor_decisions [a] The intent of the software failure incident in the reported articles is related to poor_decisions. The incident involved hackers working on behalf of Chinese intelligence breaching the network of Norwegian software firm Visma to steal secrets from its clients. This attack was part of a global hacking campaign by China's Ministry of State Security to steal intellectual property and corporate secrets, targeting technology service and software providers to reach their clients [81162]. The attackers accessed Visma's network using stolen login credentials and were operating as part of a hacking group known as APT 10, which is behind the Cloudhopper campaign [81162]. The hackers' activity inside Visma's network suggested they intended to infiltrate client systems in search of commercially-sensitive information [81162].
Capability (Incompetence/Accidental) unknown (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article. Therefore, it is unknown whether the failure was due to contributing factors introduced due to lack of professional competence by humans or the development organization. (b) The software failure incident related to accidental factors is also not explicitly mentioned in the article. Therefore, it is unknown whether the failure was due to contributing factors introduced accidentally.
Duration temporary The software failure incident reported in the articles is more aligned with a temporary failure rather than a permanent one. This incident was a result of a targeted cyber attack by hackers working on behalf of Chinese intelligence, specifically breaching the network of Norwegian software firm Visma to steal secrets from its clients [81162]. The attack was detected shortly after the hackers accessed Visma's systems, and the company's operations and security manager expressed confidence that no client networks were accessed [81162]. Additionally, cybersecurity experts mentioned that the attackers intended to infiltrate client systems in search of commercially-sensitive information, indicating a temporary breach rather than a permanent failure [81162].
Behaviour other (a) crash: The software failure incident in the article is not described as a crash where the system loses state and does not perform any of its intended functions [81162]. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s) [81162]. (c) timing: The failure is not related to the system performing its intended functions correctly but too late or too early [81162]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly [81162]. (e) byzantine: The incident does not describe the system behaving erroneously with inconsistent responses and interactions [81162]. (f) other: The behavior of the software failure incident in the article is related to a cybersecurity breach where hackers working on behalf of Chinese intelligence breached the network of Norwegian software firm Visma to steal secrets from its clients. This breach is part of a global hacking campaign by China's Ministry of State Security to steal intellectual property and corporate secrets [81162].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence The consequence of the software failure incident discussed in the articles is primarily related to potential harm and property impact: - Harm: The software failure incident, which was a result of a hacking attack by Chinese intelligence, had the potential to cause harm to the clients of the Norwegian software firm Visma. The hackers accessed Visma's systems, but the company's operations and security manager stated that he was confident no client networks were accessed. However, he mentioned that if the attack had been successful, it could have been catastrophic, especially considering that some clients of Visma are very interesting for nation states [81162]. - Property: The software failure incident resulted in a breach of the network of the software firm Visma, with the intention of stealing secrets from its clients. This breach could have led to the theft of intellectual property and corporate secrets, impacting the clients' data and potentially causing financial losses or damage to their proprietary information [81162].
Domain information (a) The failed system was intended to support the information industry. The software firm Visma, which was breached by hackers, provides business software products to more than 900,000 companies across Scandinavia and parts of Europe, indicating its involvement in the production and distribution of information [Article 81162].

Sources

Back to List