Incident: Security Certificate Issue Causes Bing HTTPS Warnings.

Published Date: 2013-04-19

Postmortem Analysis
Timeline 1. The software failure incident with the security certificate problem triggering warnings not to use Bing over a secure Web connection happened on the day the article was published, which was April 19, 2013 [18164].
System The system that failed in the software failure incident reported in Article 18164 was: 1. Security certificate system provided by Akamai [18164].
Responsible Organization 1. Akamai network service provider [18164]
Impacted Organization 1. Users accessing Bing over a secure Web connection were impacted by the software failure incident [18164].
Software Causes 1. The software cause of the failure incident was a security certificate problem triggered by an issue with the network service provider Akamai, which Microsoft used for the certificate service [18164].
Non-software Causes 1. Network service provider issue with Akamai [18164]
Impacts 1. Users visiting Bing over a secure Web connection were triggered with prominent error messages and warnings, advising them not to proceed, potentially causing disruption in accessing the website [18164].
Preventions 1. Ensuring proper monitoring and maintenance of security certificates to prevent expiration or invalidity [18164]. 2. Implementing redundancy or backup systems for certificate services to mitigate the impact of failures from third-party providers like Akamai [18164].
Fixes 1. Updating and ensuring the validity of the security certificate for bing.com [18164].
References 1. Microsoft spokesperson William Zollicoffer - [18164]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to the security certificate problem triggering warnings not to use Bing over a secure Web connection was specifically attributed to an issue with the network service provider Akamai. Microsoft mentioned that they were working with Akamai to resolve the problem, indicating that the incident was within the same organization's services [18164].
Phase (Design/Operation) design (a) The software failure incident in the article is related to the design phase. The issue with the security certificate triggering warnings not to use Bing over a secure Web connection was attributed to an issue with the network service provider Akamai, which Microsoft used for the certificate service. This indicates that the failure was due to contributing factors introduced by the system development or procedures to operate the system [18164]. (b) The article does not provide information indicating that the software failure incident was related to the operation phase or misuse of the system.
Boundary (Internal/External) within_system (a) within_system: The software failure incident mentioned in the article was related to a security certificate problem that triggered warnings not to use Bing over a secure Web connection. The issue with the security certificate, which led to browsers displaying error messages and warnings, was within the system's control and related to the setup of encrypted communications between Web browsers and servers [18164]. (b) outside_system: The software failure incident was attributed to an issue with the network service provider Akamai. Microsoft mentioned that the problem stemmed from Akamai, which was responsible for the certificate service. This indicates that the contributing factor leading to the failure originated from outside the system, specifically from the network service provider [18164].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case was not directly caused by human actions but rather by a security certificate problem triggered by an issue with the network service provider Akamai. The error messages and warnings displayed by browsers when visiting Bing over a secure connection were a result of this non-human factor [18164]. (b) Human actions were not directly implicated in causing the software failure incident reported in the article.
Dimension (Hardware/Software) software (a) The software failure incident reported in the article was not due to hardware issues but rather a security certificate problem related to the network service provider Akamai. The issue with the security certificate triggered warnings not to use Bing over a secure Web connection, indicating that the problem originated from the software side rather than hardware side [18164].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in the article is non-malicious. It was caused by a security certificate problem triggered by an issue with the network service provider Akamai. The error messages and warnings displayed by browsers were a result of an invalid and out-of-date security certificate for bing.com, leading to concerns about potential security risks. The incident was not a deliberate attack but rather a technical issue with the certificate service provided by Akamai, as acknowledged by Microsoft spokesperson William Zollicoffer [18164].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident described in the article was not due to poor decisions but rather a security certificate problem triggered by an issue with the network service provider Akamai [18164]. The incident was not a result of poor decisions but rather an external factor causing warnings not to use Bing over a secure Web connection.
Capability (Incompetence/Accidental) accidental (a) The software failure incident in this case was not attributed to development incompetence. The issue with the security certificate triggering warnings not to use Bing over a secure Web connection was specifically mentioned to be due to an issue with the network service provider Akamai, which Microsoft used for the certificate service. Microsoft acknowledged the problem and stated they were working with Akamai to resolve it, indicating that the failure was not due to development incompetence [18164]. (b) The software failure incident was accidental in nature. The article describes how a security certificate problem triggered warnings not to use Bing over a secure Web connection. Browsers displayed error messages and warnings due to an issue with the network service provider Akamai, which Microsoft used for the certificate service. The warnings were not intentional but a result of the invalid security certificate, indicating an accidental failure [18164].
Duration temporary From the provided article [18164], the software failure incident related to the security certificate problem triggering warnings not to use Bing over a secure Web connection was temporary. This is evident from the statement made by Microsoft spokesman William Zollicoffer, who mentioned, "We're working with Akamai on that. It should be fixed soon." This indicates that the issue was being actively addressed and was expected to be resolved in the near future, implying a temporary nature of the software failure incident.
Behaviour value, other (a) crash: The software failure incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The issue was related to a security certificate problem triggering warnings not to use Bing over a secure Web connection, indicating that the system was still functioning but with a security concern [18164]. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). The warnings displayed by browsers were due to an invalid security certificate issue, not the system omitting its functions [18164]. (c) timing: The failure is not related to the system performing its intended functions correctly but too late or too early. The issue with the security certificate causing warnings on Bing over a secure Web connection does not involve timing-related failures [18164]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. The problem stemmed from an issue with the security certificate service provided by Akamai, leading to warnings about an invalid security certificate when accessing Bing over a secure connection [18164]. (e) byzantine: The incident does not exhibit a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. The issue described in the article is more focused on a specific security certificate problem causing warnings, rather than inconsistent responses or interactions [18164]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability due to an issue with the security certificate service provided by Akamai, leading to warnings and error messages when trying to access Bing over a secure connection [18164].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence The consequence of the software failure incident described in the article [18164] is related to the theoretical_consequence category. The article mentions that the security certificate problem triggered warnings not to use Bing over a secure Web connection, which could potentially lead to users being exposed to fake and harmful versions of the website. While there is no direct mention of actual harm or loss resulting from this incident, the warnings issued by browsers like Chrome and Firefox highlight the potential risks associated with visiting the site under such circumstances.
Domain information The software failure incident reported in Article 18164 was related to the industry of information. The incident involved a security certificate problem that triggered warnings not to use Bing over a secure Web connection, affecting the production and distribution of information online [18164].

Sources

Back to List