| Recurring |
multiple_organization |
(a) The software failure incident related to the cyber attack on the ACME chemical company in Idaho Falls was part of a training exercise conducted by the Department of Homeland Security. The incident involved hackers infiltrating the company's computer network through a phishing attack, leading to a breach in the system and causing disruptions in operations [7840].
(b) The article mentions that the Department of Homeland Security conducts these training exercises about once a month for various industries, including representatives from the energy, oil and gas, and transportation sectors. This indicates that similar incidents or exercises may have occurred at multiple organizations in different sectors to raise awareness about dealing with cyber attacks [7840]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident in the article can be attributed to the design phase. The incident occurred when hackers infiltrated the chemical company's computer network by exploiting a vulnerability in the system's design. The breach was initiated through a phishing attack that tricked the CEO into clicking on a malicious link, which then allowed the hacker to access the system and obtain sensitive information [7840].
(b) Additionally, the software failure incident can also be linked to the operation phase. The CEO's action of clicking on the email link, which led to the breach, can be considered an operational error or misuse of the system. This action contributed to the success of the hacker in penetrating the network and causing the software failure incident [7840]. |
| Boundary (Internal/External) |
within_system |
(a) within_system: The software failure incident described in the article is within the system. The failure occurred due to a cyber attack where hackers infiltrated the chemical company's computer network by penetrating the firewall through a phishing attack [7840]. The incident involved the malicious software opening a tunnel for the hacker to access the computer system and find the CEO's password, leading to the breach and subsequent spillage of chemicals [7840]. The failure was a result of vulnerabilities within the system that allowed the hackers to gain unauthorized access and disrupt operations. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in the article was primarily due to non-human actions, specifically a cyber attack by hackers infiltrating the chemical company's computer network [7840]. The hackers used a phishing attack to penetrate the company's firewall and gain access to the system, leading to the breach and subsequent spillage of chemicals [7840].
(b) Human actions also played a role in the software failure incident as the CEO of the company clicked on a malicious link in an email, which allowed the hackers to enter the network [7840]. The CEO's decision to click on the link was a contributing factor introduced by human actions that facilitated the cyber attack. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident reported in the article was not due to hardware issues but rather due to a cyber attack by hackers infiltrating the chemical company's computer network [7840]. The incident involved the hackers penetrating the company's firewall through a phishing attack, exploiting vulnerabilities in the software systems rather than hardware components.
(b) The software failure incident was primarily caused by contributing factors originating in software, specifically through the exploitation of vulnerabilities in the company's computer network by the hackers [7840]. The malicious software used by the hackers opened a tunnel into the computer system, allowing them to access sensitive information and disrupt operations. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident described in the article is malicious in nature. It involved hackers infiltrating the chemical company's computer network with the intent to disrupt operations and steal sensitive information. The hackers used phishing attacks to gain access to the system and cause disruptions, indicating a deliberate attempt to harm the company ([7840]). |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The software failure incident in the article was primarily due to poor decisions made by the CEO of the ACME chemical company. The CEO clicked on a malicious link in an email that led to a hacker gaining access to the company's computer network. This poor decision allowed the hacker to penetrate the firewall and compromise the system, resulting in a breach and the spillage of chemicals [7840]. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The software failure incident in the article was not due to development incompetence but rather a deliberate cyber attack by hackers who infiltrated the chemical company's computer network [7840].
(b) The software failure incident was accidental in the sense that the CEO of the fictitious ACME chemical company clicked on a malicious link in an email, unknowingly allowing the hacker to penetrate the system and find the CEO's password, leading to the breach [7840]. |
| Duration |
temporary |
(a) The software failure incident described in the article was temporary. It was part of a cyber attack exercise conducted by the Department of Homeland Security to train industries on dealing with intrusions into their computer networks. The exercise, which usually lasts 12 hours, was compressed into two hours for a demonstration for reporters attending a media event [7840]. |
| Behaviour |
crash, other |
(a) crash: The software failure incident described in the article can be categorized as a crash. The incident involved hackers infiltrating a chemical company's computer network, causing the system to lose control and the firm's experts running around trying to regain control [7840].
(b) omission: The software failure incident does not specifically mention a failure due to the system omitting to perform its intended functions at an instance(s).
(c) timing: The software failure incident does not specifically mention a failure due to the system performing its intended functions correctly, but too late or too early.
(d) value: The software failure incident does not specifically mention a failure due to the system performing its intended functions incorrectly.
(e) byzantine: The software failure incident does not specifically mention a failure due to the system behaving erroneously with inconsistent responses and interactions.
(f) other: The software failure incident involved a cyber attack scenario of industrial espionage where the system was compromised through a phishing attack, leading to a breach that caused chemicals to spill out of vats into a metal basin [7840]. |