Incident: Online Platform Outage in NYC Schools Due to Security Threat

Published Date: 2022-01-14

Postmortem Analysis
Timeline 1. The software failure incident happened last Saturday, as mentioned in the article. 2. The article was published on 2022-01-14. 3. Therefore, the software failure incident occurred on Saturday, January 8, 2022. [123708]
System 1. Skedula (IO Classroom) - online platform used in some New York City public schools [123708] 2. PupilPath - counterpart service for students and parents used by some New York City schools [123708]
Responsible Organization 1. Illuminate Education, the operator of the Skedula platform, stated that the disruption was caused by "an attempted security threat" [123708]. 2. The specific nature of the security threat was not disclosed by Illuminate Education, as they mentioned that an investigation was ongoing [123708].
Impacted Organization 1. Teachers in New York City public schools [Article 123708] 2. Students and parents in New York City public schools [Article 123708]
Software Causes 1. The software failure incident was caused by an attempted security threat, leading to the disruption of the online platform used in some New York City public schools [123708].
Non-software Causes 1. The outage was caused by "an attempted security threat" according to a statement by Illuminate Education, the company operating the platform [123708]. 2. The disruption was not due to software issues but rather a security incident that led to the platform being unusable [123708].
Impacts 1. Teachers in some New York City public schools were forced to rely on more traditional methods for recording grades, tracking attendance, and contacting students and parents, causing complications in their work [123708]. 2. Accurate attendance numbers were especially important as officials considered offering students a remote-learning option, which was hindered by the outage [123708]. 3. The outage disrupted the end of the first semester, making it difficult for teachers to review grade books and students' progress in class, impacting students who needed to make up assignments [123708]. 4. Teachers had to spend additional time creating new grade books using alternative software, leading to concerns about the accuracy of grades once the original platform was restored [123708]. 5. Some teachers had to use personal funds meant for classroom supplies to purchase different software due to the outage, affecting their ability to buy essential items like books [123708]. 6. Students at affected schools grew anxious and faced distractions due to the uncertainty caused by the outage [123708].
Preventions 1. Implementing robust cybersecurity measures to prevent security threats like the attempted attack that caused the outage [123708]. 2. Conducting regular security audits and assessments to identify and address vulnerabilities in the system [123708]. 3. Ensuring a comprehensive incident response plan is in place to quickly mitigate and recover from security incidents [123708].
Fixes 1. Illuminate Education needs to restore service as soon as possible and continue testing aspects of their systems to ensure functionality [123708]. 2. Illuminate Education should address the security threat that caused the disruption and implement measures to prevent similar incidents in the future [123708]. 3. Teachers can use alternative systems like Automate the Schools and STARS Classroom to record attendance and final grades while Skedula is out of service [123708].
References 1. Illuminate Education's service interruption notice on the platform [Article 123708] 2. Statement from Illuminate Education's chief operating officer, Scott Virkler [Article 123708] 3. The Daily News [Article 123708] 4. Illuminate Education's website [Article 123708] 5. Department of Education [Article 123708] 6. New York City Special Commissioner of Investigation [Article 123708]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident at Illuminate Education's platform, Skedula, is not the first time such an incident has occurred. Teachers mentioned brief outages in the past, but this current outage has been particularly alarming as it has lasted almost a week [123708]. (b) The incident at Illuminate Education's platform affected not only Skedula but also its counterpart service for students and parents, PupilPath. This indicates that the issue was not isolated to just one organization but impacted multiple schools in New York City that rely on these services [123708].
Phase (Design/Operation) design (a) The software failure incident in the article was related to the design phase. The outage of the online platform used in some New York City public schools, Skedula, was caused by "an attempted security threat" [Article 123708]. This indicates that the failure was due to contributing factors introduced by the system's design or development, leading to a security vulnerability that was exploited. (b) The software failure incident was not related to the operation phase or misuse of the system.
Boundary (Internal/External) within_system (a) within_system: The software failure incident with the Skedula platform was caused by "an attempted security threat" according to a service interruption notice on the platform [123708]. Illuminate Education, the company operating the platform, mentioned that their priority was to restore service as soon as possible and that they were investigating the nature of the security threat [123708]. (b) outside_system: The software failure incident was triggered by an external factor, specifically an attempted security threat, which originated from outside the system [123708].
Nature (Human/Non-human) non-human_actions (a) The software failure incident occurred due to non-human actions, specifically an attempted security threat. Illuminate Education, the company operating the platform, stated that the disruption was caused by "an attempted security threat" [Article 123708].
Dimension (Hardware/Software) software (a) The software failure incident in this case was not attributed to hardware issues but rather to a security threat. The disruption in the online platform used by New York City public schools was caused by "an attempted security threat" according to a statement from Illuminate Education, the company operating the platform [123708]. (b) The software failure incident was directly related to software issues. The disruption in the online platform used by New York City public schools was caused by "an attempted security threat," indicating that the failure originated in the software itself [123708].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case was due to a malicious factor, specifically an attempted security threat. The disruption that caused the outage of the online platform used in New York City public schools was stated to be caused by "an attempted security threat" according to a service interruption notice on the platform [123708]. Illuminate Education, the company operating the platform, mentioned that the disruption was caused by a security threat and that an investigation was ongoing [123708]. (b) There is no information in the articles to suggest that the software failure incident was due to non-malicious factors.
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident related to poor decisions is not explicitly mentioned in the provided article. Therefore, it is unknown whether the failure was due to contributing factors introduced by poor decisions. (b) The intent of the software failure incident related to accidental decisions is not explicitly mentioned in the provided article. Therefore, it is unknown whether the failure was due to contributing factors introduced by mistakes or unintended decisions.
Capability (Incompetence/Accidental) accidental (a) The software failure incident in the article was not explicitly attributed to development incompetence. The outage was caused by "an attempted security threat" according to a statement by Illuminate Education, the company operating the platform [123708]. (b) The software failure incident in the article was due to an accidental security threat. Illuminate Education stated that the disruption was caused by "an attempted security threat," indicating that the incident was not intentional but accidental [123708].
Duration temporary The software failure incident described in the article is temporary. The platform, Skedula, operated by Illuminate Education, has been out of service since last Saturday due to an attempted security threat. The service interruption notice on the platform mentioned that the service remained unusable on Friday, indicating a temporary disruption [123708].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the article can be categorized as a crash as the online platform used in some New York City public schools, Skedula, has been out of service since last Saturday after a "security incident," rendering it unusable for teachers to record grades, track attendance, and contact students and parents [Article 123708]. (b) omission: The software failure incident can also be categorized as an omission as teachers are unable to use the platform to post assignments, track grades, take notes about struggling students, and determine outstanding assignments, causing disruptions in their work and impacting students' ability to access necessary information [Article 123708]. (c) timing: The timing of the software failure incident is crucial as it occurred at a time when final grades are due, the end of the first semester is approaching, and teachers typically review their grade books and students' progress in class. This has added significant challenges for teachers and students, making it difficult to manage tasks effectively [Article 123708]. (d) value: The software failure incident can also be related to a value failure as teachers are concerned that once the platform is working again, the grades it shows might not be accurate, potentially leading to incorrect information being communicated to students and parents [Article 123708]. (e) byzantine: The software failure incident does not exhibit characteristics of a byzantine failure, which involves inconsistent responses and interactions. The incident in the article is more focused on the platform being rendered unusable due to a security threat, impacting the functionality and usability of the system [Article 123708]. (f) other: The other behavior exhibited in this software failure incident is the reliance on alternative systems and tools by teachers to mitigate the impact of the outage. For example, some teachers resorted to using different software like Jupiter Ed and recording attendance and final grades in other systems like Automate the Schools and STARS Classroom to continue their work despite the platform outage [Article 123708].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident caused a disruption in the online platform Skedula, which is used by some New York City public schools for recording grades, tracking attendance, and contacting students and parents [123708]. This outage affected teachers' ability to post assignments, track grades and attendance, take notes about struggling students, and review progress in class. Additionally, students were unable to determine their outstanding assignments, leading to difficulties for both students and teachers. Some teachers had to resort to using alternative software, such as Jupiter Ed, which incurred additional costs and time to set up new grade books [123708]. The outage also raised concerns about the accuracy of grades once the platform was restored [123708].
Domain information, knowledge (a) The software failure incident affected the education industry, specifically impacting New York City public schools by disrupting the online platform used for recording grades, tracking attendance, and communicating with students and parents [Article 123708]. The platform, Skedula, is crucial for teachers to manage their classes efficiently and effectively, highlighting its significance in supporting the production and distribution of information within the education sector.

Sources

Back to List