| Recurring |
one_organization |
(a) The software failure incident has happened again at one_organization:
- In August 2020, security researchers discovered a vulnerability in Pulse Secure VPN that could be used by hackers to take control of an enterprise's entire network [113033].
- This incident indicates a previous software vulnerability within the Pulse Secure VPN service, suggesting a recurring issue within the same organization's product.
(b) The software failure incident has happened again at multiple_organization:
- There is no specific mention in the provided article about similar incidents happening at other organizations or with their products and services. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident in the Pulse Secure VPN service was due to an expired code used to digitally sign and verify software components. This issue arose from a design flaw in the system development process, specifically related to the handling of certificate expiry time versus the timestamp of the code signing [113033].
(b) Users were unable to connect to the Pulse Secure VPN service, impacting their ability to access internal work resources. This failure was a result of the operation of the system, as users were unable to carry out their daily work operations due to the expired code blocking their access [113033]. |
| Boundary (Internal/External) |
within_system |
(a) within_system:
The software failure incident with Pulse Secure VPN was caused by an expired code used to digitally sign and verify software components within the system. This issue led to users being unable to connect to their company's resources via their web browser [113033].
(b) outside_system:
The software failure incident with Pulse Secure VPN was not due to contributing factors that originate from outside the system. |
| Nature (Human/Non-human) |
non-human_actions |
(a) The software failure incident occurring due to non-human actions:
The software failure incident with Pulse Secure VPN was caused by an expired code used to digitally sign and verify software components. This issue led to users worldwide being unable to connect to the VPN service, impacting employees working remotely [113033].
(b) The software failure incident occurring due to human actions:
There is no specific mention in the provided article about the software failure incident being caused by human actions. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident in the article is not attributed to hardware issues. The root cause of the problem was identified as an expired code used to digitally sign and verify software components, which prevented users from connecting to their company's resources via their web browser [113033].
(b) The software failure incident in the article is directly related to software issues. Specifically, the issue stemmed from an expired code used to digitally sign and verify software components, leading to users being unable to access internal work resources through the Pulse Secure VPN service [113033]. |
| Objective (Malicious/Non-malicious) |
non-malicious |
(a) The software failure incident in this case is non-malicious. The issue stemmed from an expired code used to digitally sign and verify software components, which led to users being unable to connect to the Pulse Secure VPN service. This was not an intentional act to harm the system but rather a result of an oversight in managing the certificate expiry time [113033]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The software failure incident related to the Pulse Secure VPN service was primarily due to poor decisions. The issue stemmed from an expired code used to digitally sign and verify software components, which led to users being unable to access internal work resources [113033]. The failure was attributed to the Certificate expiry time being checked instead of the timestamp of the Code signing, causing multiple functionalities/features to fail for end-users [113033]. Additionally, the incident highlighted a vulnerability in the system that could potentially be exploited by hackers, indicating a lack of robust security measures in place [113033]. |
| Capability (Incompetence/Accidental) |
development_incompetence, accidental |
(a) The software failure incident in the Pulse Secure VPN service was due to development incompetence. The issue stemmed from an expired code used to digitally sign and verify software components, which led to users being unable to access internal work resources [113033].
(b) Additionally, the incident can be considered accidental as the Certificate expiry time was checked instead of the timestamp of the Code signing, leading to the failure in code sign verification on the client-side components [113033]. |
| Duration |
temporary |
From the provided articles, the software failure incident related to the Pulse Secure VPN service being unable to connect due to an expired code used to digitally sign and verify software components can be categorized as a temporary failure. This is evident from the fact that the issue stemmed from an expired code causing a certificate error, which was identified as the reason for the connectivity problem. The support bulletin released by Pulse Secure acknowledged that multiple functionalities/features were failing for end-users due to the certificate error, indicating a specific issue with the code sign verification process [113033]. Additionally, the workaround suggested by the firm to use the Pulse Desktop Client directly instead of through a browser for unaffected users further supports the notion that the failure was temporary and could be mitigated by specific actions [113033]. |
| Behaviour |
value |
(a) crash: The software failure incident in the article is not described as a crash where the system loses state and does not perform any of its intended functions [113033].
(b) omission: The software failure incident in the article is not described as an omission where the system omits to perform its intended functions at an instance(s) [113033].
(c) timing: The software failure incident in the article is not described as a timing issue where the system performs its intended functions correctly, but too late or too early [113033].
(d) value: The software failure incident in the article is described as a failure due to the system performing its intended functions incorrectly. Specifically, the issue stems from an expired code used to digitally sign and verify software components, blocking users from connecting to their company's resources via their web browser [113033].
(e) byzantine: The software failure incident in the article is not described as a byzantine failure where the system behaves erroneously with inconsistent responses and interactions [113033].
(f) other: The software failure incident in the article is not described as any other specific behavior beyond the incorrect performance of intended functions due to the expired code issue [113033]. |