| Recurring |
one_organization |
(a) The software failure incident having happened again at one_organization:
- Microsoft faced a major setback when a major flaw in its flagship Azure Cosmos DB database service was revealed, leaving its customers' information vulnerable to hackers [118075].
- The disclosure of this vulnerability comes after months of bad security news for Microsoft, including being breached by suspected Russian government hackers and other security issues [117741].
(b) The software failure incident having happened again at multiple_organization:
- The article does not provide specific information about similar incidents happening at other organizations or with their products and services. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident in the articles can be attributed to the design phase. The incident was caused by a major flaw in Microsoft's flagship Azure Cosmos DB database service, which allowed hackers to access keys controlling access to databases held by thousands of companies [118075, 117741]. This flaw was discovered by a research team at the security company Wiz, indicating a design vulnerability in the system.
(b) The software failure incident can also be linked to the operation phase. Microsoft had to email its customers to create new access keys because the company could not change the keys by itself, indicating an operational response to mitigate the vulnerability [118075, 117741]. Additionally, the incident highlighted the importance of operational procedures in responding to and resolving security vulnerabilities in cloud services. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident related to the Microsoft Azure Cosmos DB database service vulnerability was primarily due to a flaw in the visualization tool called Jupyter Notebook, which was enabled by default in Cosmos beginning in February [118075, 117741]. This flaw allowed hackers to access keys that control access to databases held by thousands of companies, leading to potential data exposure and manipulation within the system.
(b) outside_system: The software failure incident was also influenced by external factors such as the actions of the security company Wiz, which discovered the vulnerability and reported it to Microsoft [118075, 117741]. Additionally, the incident was part of a broader trend of bad security news for Microsoft, including previous breaches by suspected Russian government hackers and other security flaws in Microsoft products [118075, 117741]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in the articles was primarily due to non-human actions. The incident was caused by a major flaw in Microsoft's flagship Azure Cosmos DB database service, which allowed hackers to access keys controlling access to databases held by thousands of companies [118075, 117741]. This vulnerability was discovered by a research team at the security company Wiz, and Microsoft had to notify customers to create new access keys to mitigate the risk [118075, 117741].
(b) Human actions were also involved in addressing the software failure incident. Microsoft agreed to pay Wiz $40,000 for finding and reporting the flaw [118075, 117741]. Additionally, the Wiz team found the problem and notified Microsoft, leading to the immediate fix of the issue to keep customers safe [117741]. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident reported in the news articles is primarily due to contributing factors that originate in software. The incident involved a major flaw in Microsoft's flagship Azure Cosmos DB database service, which allowed hackers to potentially read, change, or delete data saved in the cloud [118075, 117741]. The vulnerability was discovered by a research team at the security company Wiz, who found that they were able to access keys that control access to databases held by thousands of companies [118075, 117741]. The flaw was in a visualization tool called Jupyter Notebook, which was enabled by default in Cosmos beginning in February [118075, 117741].
(b) There is no specific mention in the articles of the software failure incident being caused by contributing factors originating in hardware. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident in the articles is classified as malicious. The incident involved a major flaw in Microsoft's flagship Azure Cosmos DB database service that could allow hackers to read, change, or delete data saved in the cloud. The flaw was discovered by a research team at the security company Wiz, who were able to access keys that control access to databases held by thousands of companies [118075, 117741]. The vulnerability was described as the worst cloud vulnerability imaginable, and the team was able to access any customer database they wanted [118075]. The flaw, named ChaosDB, was found in a visualization tool called Jupyter Notebook, which was enabled by default in Cosmos beginning in February [118075]. Microsoft had to email customers to create new access keys as they could not change them by themselves [118075]. The incident highlights the serious impact of malicious software vulnerabilities on cloud services and the potential risks posed to customer data and security. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The software failure incident related to the Microsoft Azure Cosmos DB database vulnerability can be attributed to poor decisions. The incident was caused by a major flaw in the flagship Azure Cosmos DB database service, which allowed hackers to potentially access, modify, or delete data stored in the cloud. This vulnerability was discovered by a research team at the security company Wiz, who were able to access keys controlling access to databases of thousands of companies [118075, 117741]. Microsoft's decision to enable a visualization tool called Jupyter Notebook by default in Cosmos DB, which ultimately led to the exposure of access keys, can be considered a poor decision contributing to the software failure incident. |
| Capability (Incompetence/Accidental) |
development_incompetence |
(a) The software failure incident related to development incompetence is evident in the articles. The incident involving a major flaw in Microsoft's Azure Cosmos DB database service was discovered by a research team at the security company Wiz. The flaw allowed hackers to access keys controlling access to databases held by thousands of companies, including Fortune 500 firms like Coca-Cola and Exxon-Mobil [118075, 117741]. This flaw was found in a visualization tool called Jupyter Notebook, which had been enabled by default in Cosmos beginning in February, indicating a potential oversight in the development process that led to the vulnerability.
(b) The software failure incident related to accidental factors is also apparent in the articles. Microsoft acknowledged the vulnerability in its Azure Cosmos DB database and took immediate action to fix the issue to protect its customers. The company thanked the security researchers for their work under coordinated vulnerability disclosure, indicating that the discovery of the flaw was not intentional but rather accidental [118075, 117741]. |
| Duration |
temporary |
(a) The software failure incident in this case was temporary. The vulnerability in Microsoft's Azure Cosmos DB database service was discovered by a research team at the security company Wiz, who then reported it to Microsoft. Microsoft immediately took action to fix the issue and informed customers to create new access keys to protect their data [118075, 117741]. |
| Behaviour |
value, other |
(a) crash: The software failure incident in the articles does not involve a crash where the system loses state and does not perform any of its intended functions [118075, 117741].
(b) omission: The incident does not involve a failure due to the system omitting to perform its intended functions at an instance(s) [118075, 117741].
(c) timing: The incident does not involve a failure due to the system performing its intended functions correctly, but too late or too early [118075, 117741].
(d) value: The software failure incident is related to a major flaw in Microsoft's Azure Cosmos DB database service that could allow hackers to read, change, or delete data saved in the cloud, indicating a failure due to the system performing its intended functions incorrectly [118075, 117741].
(e) byzantine: The incident does not involve a failure due to the system behaving erroneously with inconsistent responses and interactions [118075, 117741].
(f) other: The software failure incident involves a vulnerability in Microsoft's Azure Cosmos DB database service that allowed unauthorized access to keys controlling access to databases, potentially compromising the security and integrity of customer data [118075, 117741]. |