Incident: Cyber Attacks Disrupt Miami-Dade County Virtual Learning Platform

Published Date: 2020-09-02

Postmortem Analysis
Timeline 1. The software failure incident of cyber attacks on Miami-Dade County Public Schools occurred on the first three days of the virtual start to the school year, with attacks reported on Monday, Tuesday, and Wednesday [104745]. 2. Published on 2020-09-02, the incident happened in September 2020.
System 1. My School Online (MSO) virtual learning platform run by K12 [Article 104745] 2. Comcast internet service provider network used by Miami-Dade County Public Schools [Article 104745]
Responsible Organization 1. The cyber attackers who initiated the distributed denial of service attacks on Miami-Dade County Public Schools [104745].
Impacted Organization 1. Miami-Dade County Public Schools 2. Students and teachers using the virtual learning platform 3. Comcast (internet provider for the school district) [104745]
Software Causes 1. Distributed denial of service (DDoS) attacks causing a software glitch that blocked access to the district's servers [104745] 2. Malicious, well-orchestrated, complex attempt at derailing and destroying the connection essential for students and teachers [104745] 3. Issues with the My School Online (MSO) virtual learning platform, which went down nationally and had content accessibility issues [104745]
Non-software Causes 1. Cyber attacks targeting the Miami-Dade County Public Schools, including distributed denial of service attacks and other malicious attempts [104745]. 2. Issues with the My School Online (MSO) virtual learning platform run by K12, which went down nationally on Wednesday [104745].
Impacts 1. The software failure incident resulted in the district being hit with 12 separate cyber attacks, some of which were local and some from outside the US, causing disruptions to the virtual learning platform and blocking access to the district's servers [Article 104745]. 2. The attacks led to students and teachers being unable to log into the system and kicked out users who were already logged on, disrupting the connection essential for learning [Article 104745]. 3. The incident caused the virtual learning platform, My School Online (MSO), to go down nationally, leading to issues with content accessibility and prompting a directive for students and teachers in grades 6 through 12 to get off the platform [Article 104745]. 4. Many teachers and students within Miami-Dade County public schools complained about not being able to see their classes on the platform, leading to disruptions in the learning process [Article 104745].
Preventions 1. Implementing robust cybersecurity measures such as firewalls, intrusion detection systems, and regular security audits to prevent cyber attacks [104745]. 2. Conducting thorough testing and quality assurance of the virtual learning platform to identify and fix any software glitches or vulnerabilities before the start of the school year [104745]. 3. Collaborating closely with internet service providers like Comcast to ensure reliable and secure network connectivity for virtual learning platforms [104745].
Fixes 1. Enhancing cybersecurity measures to prevent future cyber attacks targeting the school district's systems [104745]. 2. Conducting a thorough investigation to identify the perpetrators behind the cyber attacks and prosecuting them to the fullest extent of the law [104745]. 3. Collaborating with law enforcement agencies like the FBI and Secret Service to address the security vulnerabilities and ensure the safety of the district's virtual learning platform [104745]. 4. Addressing software glitches that may have contributed to the disruption of access to the district's servers [104745]. 5. Improving the reliability and functionality of the virtual learning platform, such as My School Online, to prevent future technical issues that hinder students and teachers from accessing classes [104745].
References 1. Miami-Dade County Public Schools Superintendent Alberto Carvalho 2. MDCPS Chief Academic Officer Marie Izquierdo 3. School Board member Steve Gallon 4. Comcast (service provider for MDCPS) [104745]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident has happened again at one_organization: - The Miami-Dade County Public Schools district experienced two other distributed denial of service attacks earlier in the week, which were caused by a software glitch blocking access to the district's servers [104745]. - The district faced issues with its virtual learning platform, My School Online (MSO), which went down nationally on Wednesday, causing teachers and students to have difficulty accessing classes [104745]. (b) The software failure incident has happened again at multiple_organization: - The article does not mention any other organizations experiencing similar software failure incidents.
Phase (Design/Operation) design, operation (a) The software failure incident in Miami-Dade County Public Schools was primarily attributed to cyber attacks targeting the district's virtual learning platform, My School Online (MSO), which is run by education tech giant K12. The attacks disrupted the system's functionality and blocked access to the district's servers, leading to issues with content accessibility and the need for students and teachers to switch to alternative platforms like Microsoft Teams [104745]. (b) The operation of the virtual learning platform, MSO, was impacted by the cyber attacks, causing disruptions in accessing classes and content for teachers and students. The attacks led to a directive for students and teachers in grades 6 through 12 to get off the platform due to issues on the content side. This indicates that the failure was exacerbated by the operation and usage of the system during the cyber attacks [104745].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident involving the cyber attacks on Miami-Dade County Public Schools was primarily within the system. The attacks targeted the district's servers, causing disruptions to the virtual learning platform used by students and teachers. Superintendent Carvalho described the attacks as malicious, well-orchestrated, and complex attempts to disrupt the essential connection for students and teachers [104745]. (b) outside_system: The cyber attacks on Miami-Dade County Public Schools also had contributing factors originating from outside the system. Superintendent Carvalho mentioned that some of the attacks were from outside of the US, indicating external sources were involved in the attacks on the district's servers [104745].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Miami-Dade County Public Schools was primarily due to non-human actions, specifically cyber attacks. The district experienced multiple cyber attacks, including distributed denial of service attacks and other malicious attempts aimed at disrupting the virtual learning platform [104745]. These attacks were orchestrated externally and were not a result of human actions within the school district. (b) Human actions also played a role in responding to the software failure incident. Superintendent Alberto Carvalho mentioned the involvement of the FBI and Secret Service in investigating the attacks and subpoenaing the school district's internet provider, Comcast [104745]. Additionally, there were discussions within the district about the readiness of schools for online reopening and the need for policies and practices to mitigate such attacks in the future, indicating a human response to the incident [104745].
Dimension (Hardware/Software) software (a) The software failure incident in Miami-Dade County Public Schools was primarily due to cyber attacks, which are external threats targeting the district's systems. These attacks caused disruptions in accessing the district's servers and virtual learning platform, leading to service outages and connectivity issues [104745]. (b) Additionally, the incident involved software glitches that blocked access to the district's servers on Monday and Tuesday before the cyber attacks on Wednesday. The district was using a virtual learning platform called My School Online (MSO) provided by education tech giant K12, which experienced issues and went down nationally on Wednesday [104745].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident in the Miami-Dade County Public Schools was malicious in nature. The district experienced multiple cyber attacks, including distributed denial of service attacks and other malicious attempts aimed at derailing and destroying the connection essential for students and teachers. Superintendent Carvalho described the attacks as well-orchestrated and complex, with the objective of disrupting the virtual learning platform [104745]. The attacks were serious enough to involve the FBI and Secret Service in investigating and prosecuting the perpetrators to the fullest extent of the law. (b) The software failure incident also had non-malicious aspects. The Chief Academic Officer of MDCPS clarified that the district had not been hacked, and no data had been compromised in any of the attacks. Additionally, issues with the virtual learning platform, My School Online (MSO), were acknowledged, with the platform experiencing a shutdown nationally. While there were complaints from teachers and students about not being able to access classes on MSO, the district was working to address these issues and provide alternative solutions such as using Microsoft Teams [104745].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The cyber attacks on Miami-Dade County Public Schools were described as malicious, well-orchestrated, and complex attempts at derailing and destroying the connection essential for students and teachers [104745]. - The attacks were aimed at disrupting the virtual learning platform used by the district, impacting access for students and teachers [104745]. - The attacks led to issues with the My School Online platform, causing disruptions in accessing classes and content nationally [104745]. (b) The intent of the software failure incident related to accidental_decisions: - The district's Chief Academic Officer mentioned issues with the virtual learning platform, which went down nationally, and directed students and teachers to get off the platform due to content issues [104745]. - School Board member Steve Gallon expressed concerns about the readiness of schools reopening online and the failure of the platform, indicating that challenges had been present since the previous week [104745].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Miami-Dade County Public Schools was not attributed to development incompetence. The incident involved cyber attacks targeting the district's virtual learning platform, which led to disruptions in access for students and teachers. The attacks were described as malicious, well-orchestrated, and complex attempts to disrupt the connection essential for learning [104745]. (b) The software failure incident in Miami-Dade County Public Schools was primarily due to accidental factors. The district faced cyber attacks, including distributed denial of service attacks and other malicious attempts, which were not caused by development incompetence but were intentional efforts to disrupt the virtual learning platform [104745].
Duration temporary (a) The software failure incident in the Miami-Dade County Public Schools was temporary. The district experienced cyber attacks that caused disruptions to their virtual learning platform, My School Online (MSO), but the Chief Academic Officer mentioned that the district had not been hacked and no data had been compromised [104745]. (b) The software failure incident was temporary as the disruptions were caused by cyber attacks and a software glitch that blocked access to the district's servers. The attacks were described as malicious, well-orchestrated, and complex attempts at derailing the connection essential for students and teachers, indicating a temporary nature of the failure [104745].
Behaviour crash, omission, other (a) crash: The software failure incident in the Miami-Dade County Public Schools was characterized by a crash. The distributed denial of service attacks caused a software glitch that blocked access to the district's servers, preventing students and teachers from logging into the system and kicking out users who were already logged on [104745]. (b) omission: The incident also involved omission, as the virtual learning platform, My School Online (MSO), experienced issues where content was still accessible during the shutdown, but a directive was issued to students and teachers in grades 6 through 12 to get off the platform due to 'issues on the content side' [104745]. (c) timing: There is no specific mention of a timing-related failure in the articles provided. (d) value: The articles do not mention a failure related to the system performing its intended functions incorrectly. (e) byzantine: The incident did not exhibit behavior indicative of a byzantine failure. (f) other: The incident also involved a 'malicious, well-orchestrated, complex attempt at derailing, destroying the connection which is essential for students and teachers' [104745].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence delay, theoretical_consequence The consequence of the software failure incident reported in the articles was primarily related to delays and disruptions caused by the cyber attacks and software glitches: - The cyber attacks on Miami-Dade County Public Schools resulted in delays and disruptions to the virtual learning platform, affecting students and teachers' ability to access the system and conduct classes [104745]. - The software glitches, including a distributed denial of service attack, blocked access to the district's servers, causing delays and interruptions in the online learning process [104745]. - Students and teachers faced difficulties in logging into the system, accessing classes, and experiencing issues with the virtual learning platform, leading to disruptions in the educational process [104745]. - The attacks prompted discussions about the overall readiness of schools for online reopening and highlighted challenges with the virtual learning platform, indicating a failure in the online learning system [104745]. - The incident also raised concerns about the security and stability of the virtual learning platform, emphasizing the need for improved measures to prevent future disruptions [104745].
Domain knowledge The software failure incident reported in the news articles is related to the education industry. The failed system was intended to support virtual learning for Miami-Dade County Public Schools, which serves 275,000 students and is using virtual learning due to the coronavirus pandemic [Article 104745]. The district was utilizing a virtual learning platform called My School Online (MSO) run by education tech giant K12 for conducting classes [Article 104745]. The incident involved cyber attacks, including distributed denial of service attacks and other malicious attempts, which disrupted the connection essential for students and teachers [Article 104745]. The district faced challenges with the MSO platform, leading to issues such as content not being accessible and directives for students and teachers to switch to other platforms like Microsoft Teams [Article 104745].

Sources

Back to List