Incident: Cyber-Attack Causes IT Problems at Royal Bank of Scotland

Published Date: 2013-12-06

Postmortem Analysis
Timeline 1. The software failure incident at Royal Bank of Scotland due to a cyber-attack happened on a Thursday night and at lunchtime on Friday [55634]. 2. Published on 2013-12-06 08:00:00+00:00. 3. The incident occurred in December 2013.
System 1. NatWest website 2. RBS online service 3. IT systems of Royal Bank of Scotland [Cited Article: #55634]
Responsible Organization 1. Cyber attackers targeted the Royal Bank of Scotland's systems, causing the software failure incident [55634].
Impacted Organization 1. Customers of Royal Bank of Scotland, NatWest, and other websites operated by the bank were impacted by the software failure incident [55634].
Software Causes 1. Cyber-attack in the form of a distributed denial of service (DDoS) attack [55634]
Non-software Causes 1. The failure incident was caused by a cyber-attack, specifically a distributed denial of service (DDoS) attack, which overwhelmed the bank's servers with useless requests, bringing them to a standstill [55634].
Impacts 1. Customers were unable to access their online accounts on Thursday night and at lunchtime on Friday due to the cyber-attack, causing inconvenience and frustration [55634]. 2. The deliberate surge of traffic, known as a distributed denial of service (DDoS) attack, led to difficulties accessing some customer websites, including NatWest, impacting the bank's online services [55634]. 3. The cyber-attack resulted in a systems meltdown on Monday that lasted for three hours, denying millions of people access to cash and the ability to make payments [55634]. 4. The incident had a knock-on effect on other websites operated by the bank, including RBS, until 12.30pm on Friday, further disrupting services [55634]. 5. The bank had to open 1,000 branches early to assist customers who lost money and handle complaints, indicating a significant operational impact [55634].
Preventions 1. Implementing robust cybersecurity measures to prevent and mitigate cyber-attacks like distributed denial of service (DDoS) attacks [55634]. 2. Regularly conducting security audits and assessments to identify vulnerabilities in the IT systems [55634]. 3. Investing in modernizing and upgrading IT systems to ensure they are resilient and capable of handling surges in internet traffic [55634]. 4. Enhancing employee training and awareness on cybersecurity best practices to prevent social engineering attacks that could lead to system breaches [unknown].
Fixes 1. Enhancing cybersecurity measures to prevent future cyber-attacks like distributed denial of service (DDoS) attacks [55634]. 2. Conducting thorough testing and quality assurance procedures before implementing software upgrades to avoid issues like the botched software upgrade in June 2012 [55634]. 3. Investing in upgrading IT systems to modern standards to improve overall system reliability and performance [55634].
References 1. Royal Bank of Scotland (RBS) [Article 55634] 2. Customers affected by the IT problems [Article 55634] 3. US banks like Citigroup and Bank of America [Article 55634] 4. JP Morgan [Article 55634] 5. City regulators concerned about the security of banks' IT systems [Article 55634] 6. Ulster Bank [Article 55634] 7. Union leaders [Article 55634] 8. Ross McEwan, the bank's new chief executive [Article 55634]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident has happened again at one_organization: The Royal Bank of Scotland (RBS) experienced a cyber-attack that caused IT problems, preventing customers from accessing their bank accounts for the second time in a week. The incident was unrelated to a previous systems meltdown that occurred on Monday [55634]. (b) The software failure incident has happened again at multiple_organization: Other US banks, such as Citigroup and Bank of America, have also been victims of similar denial of service attacks aimed at high-profile institutions to cause disruption. JP Morgan, the biggest US bank, reported being hit by a different type of cyber-attack as well [55634].
Phase (Design/Operation) design (a) The software failure incident at the Royal Bank of Scotland was related to the design phase. The incident was attributed to a cyber-attack, specifically a distributed denial of service (DDoS) attack, which overwhelmed the bank's servers with useless requests, causing difficulties for customers accessing their online accounts [55634]. (b) The software failure incident was not related to the operation phase but rather to a deliberate cyber-attack that targeted the bank's systems, causing disruption in customer access to online accounts [55634].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at the Royal Bank of Scotland was primarily caused by a cyber-attack, specifically a distributed denial of service (DDoS) attack. The bank mentioned that the surge in internet traffic directed at their website caused difficulties for customers accessing their online accounts. This attack overwhelmed the bank's servers, leading to the disruption of services. Additionally, previous software failures at the bank, such as a botched software upgrade in June 2012, indicate internal system issues that have contributed to past incidents [55634]. (b) outside_system: The software failure incident at the Royal Bank of Scotland was triggered by external factors, specifically a deliberate cyber-attack in the form of a DDoS attack. The attack involved thousands of computers under the control of an external attacker overwhelming the bank's servers with useless requests, causing the system to come to a standstill. This external attack was aimed at causing maximum disruption to high-profile institutions like RBS. Additionally, the article mentions concerns from city regulators about the security of banks' IT systems, indicating external scrutiny and potential threats to the system from outside sources [55634].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The Royal Bank of Scotland experienced IT problems due to a cyber-attack, specifically a distributed denial of service (DDoS) attack, which overwhelmed the bank's servers with useless requests, causing difficulties for customers accessing their online accounts [55634]. - The bank mentioned that the surge in internet traffic directed at the NatWest website was deliberate and not a result of internal system issues [55634]. (b) The software failure incident occurring due to human actions: - The bank's new chief executive, Ross McEwan, attributed the problems to decades of under-investment in IT, indicating a potential human factor in the failure [55634]. - Union leaders blamed cost-cutting for the IT problems experienced by the bank, suggesting that human actions related to financial decisions may have contributed to the software failure incident [55634].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The article mentions a botched software upgrade in June 2012 that left RBS with a £175m bill for compensation for up to 13 million customers. This incident was attributed to a hardware-related issue, as it resulted from a software upgrade gone wrong, indicating contributing factors originating in hardware [55634]. (b) The software failure incident occurring due to software: - The main software failure incident reported in the article is attributed to a cyber-attack, specifically a distributed denial of service (DDoS) attack, which overwhelmed the bank's systems and prevented customers from accessing their accounts. This incident is clearly linked to software-related factors, as it involved deliberate targeting of the bank's online services through internet traffic manipulation [55634].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 55634 was malicious in nature. The Royal Bank of Scotland attributed the IT problems that prevented customers from accessing their bank accounts to a cyber-attack, specifically a distributed denial of service (DDoS) attack. The bank stated that there was a deliberate surge of internet traffic directed at their website, causing difficulties for customers to access their online accounts. Additionally, the article mentions that other high-profile institutions like US banks had been victims of similar attacks aimed at causing maximum disruption [55634].
Intent (Poor/Accidental Decisions) unknown (a) The software failure incident at the Royal Bank of Scotland was primarily attributed to a cyber-attack, specifically a distributed denial of service (DDoS) attack. The bank mentioned that the surge in internet traffic directed at their website was deliberate, indicating an external attack aimed at disrupting their services [55634]. (b) The incident does not indicate any contributing factors introduced by accidental decisions or mistakes. The focus is on the deliberate nature of the cyber-attack and the subsequent actions taken to restore the affected websites and services.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident at the Royal Bank of Scotland was not directly attributed to development incompetence. However, it mentioned a botched software upgrade in June 2012 that left RBS with a £175m bill for compensation for up to 13 million customers, indicating a failure related to software development [55634]. (b) The software failure incident at the Royal Bank of Scotland was primarily attributed to a cyber-attack, specifically a distributed denial of service (DDoS) attack, which overwhelmed the bank's servers with useless requests, causing difficulties for customers accessing their online accounts. This incident was not accidental but rather a deliberate attack on the bank's systems [55634].
Duration temporary The software failure incident reported in Article 55634 was temporary. The incident involved a cyber-attack in the form of a distributed denial of service (DDoS) attack that caused difficulties for customers accessing the NatWest website. The bank took appropriate action to restore the affected websites, and the problem was largely fixed in just over half an hour [55634].
Behaviour other (a) crash: The software failure incident mentioned in the article is not specifically described as a crash where the system loses state and does not perform any of its intended functions [55634]. (b) omission: The incident does not directly mention the failure as an omission where the system omits to perform its intended functions at an instance(s) [55634]. (c) timing: The incident does not indicate that the failure was due to the system performing its intended functions correctly but too late or too early [55634]. (d) value: The failure is not attributed to the system performing its intended functions incorrectly [55634]. (e) byzantine: The incident does not suggest that the failure was due to the system behaving erroneously with inconsistent responses and interactions [55634]. (f) other: The behavior of the software failure incident in the article is attributed to a cyber-attack, specifically a distributed denial of service (DDoS) attack, which overwhelmed the bank's servers with useless requests, causing difficulties in accessing customer websites [55634].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at the Royal Bank of Scotland resulted in customers being denied access to their bank accounts due to a cyber-attack. This prevented customers from accessing their online accounts, leading to disruptions in their financial transactions. The incident caused inconvenience to customers and raised concerns about the security of banks' IT systems [55634].
Domain finance The failed system in the reported incident was related to the finance industry. The Royal Bank of Scotland (RBS) experienced IT problems due to a cyber-attack that affected customers' access to their bank accounts [Article 55634]. The incident involved a distributed denial of service (DDoS) attack on the NatWest website, which is a financial service offered by RBS. Additionally, the article mentions that other US banks like Citigroup and Bank of America have been victims of similar attacks, indicating that financial institutions are often targeted for such cyber-attacks. Therefore, the industry that the failed system was intended to support is the finance industry [Article 55634].

Sources

Back to List