Incident: Foreign Hackers Target U.S. Nuclear Regulatory Commission Systems

Published Date: 2014-08-20

Postmortem Analysis
Timeline 1. The software failure incident at the Nuclear Regulatory Commission due to overseas hackers happened in the past three years [29613]. 2. Published on 2014-08-20 07:00:00+00:00. 3. The incident occurred approximately between August 2011 and August 2014.
System The system that failed in the software failure incident reported in Article 29613 is the Nuclear Regulatory Commission's computer network security system. 1. Nuclear Regulatory Commission's computer network security system [29613]
Responsible Organization 1. Foreign hackers conducted two of the attacks on the Nuclear Regulatory Commission's computers, while a third attack came from an unidentifiable individual [29613]. 2. The attacks involved phishing emails and malware sent by hackers from unnamed foreign countries [29613].
Impacted Organization 1. The Nuclear Regulatory Commission (NRC) [29613]
Software Causes 1. The software causes of the failure incident at the Nuclear Regulatory Commission included: - Successful hacking attempts by foreigners and an unidentifiable individual [29613]. - Phishing emails containing malicious software aimed at NRC employees [29613]. - Compromised personal email account of an NRC employee leading to the distribution of malware through infected PDF attachments [29613].
Non-software Causes 1. Lack of tight security measures within the organization [29613] 2. Employees falling victim to phishing and spearphishing attacks [29613] 3. Insufficient employee training on cybersecurity [29613]
Impacts 1. The impacts of the software failure incident at the Nuclear Regulatory Commission included: - Employees falling victim to a logon-credential harvesting attempt through phishing emails, leading to potential compromise of sensitive information [29613]. - One employee opening an infected PDF attachment, causing their computer to become infected and subsequently replaced [29613]. - Concerns raised about the potential for cyber intrusions into NRC networks, highlighting the need for extra-tight security measures and continuous employee training on computer security [29613].
Preventions 1. Implementing multi-factor authentication for user accounts could have prevented the logon-credential harvesting attempt through phishing emails [29613]. 2. Conducting regular and updated training sessions for employees on cybersecurity awareness, including recognizing and avoiding phishing emails and malicious attachments, could have helped prevent the incidents [29613]. 3. Enhancing email security measures to detect and block spearphishing attempts linked to malicious software could have mitigated the risk of successful attacks [29613]. 4. Strengthening endpoint protection and network firewalls to detect and prevent advanced phishing attacks that traditional security measures may miss could have been beneficial [29613]. 5. Increasing the frequency of updating security training content to address evolving cyber threats and tactics could have improved the organization's resilience against cyber intrusions [29613].
Fixes 1. Enhanced cybersecurity measures such as advanced endpoint protection and network firewalls to detect and prevent advanced phishing attacks [29613]. 2. Continuous and updated training for employees on computer security, including phishing and spear phishing awareness [29613]. 3. Regular monitoring and detection of cyber intrusions through a strong firewall and employee reporting [29613].
References 1. Nextgov website [29613] 2. Office of Inspector General report [29613] 3. NRC spokesman David McIntyre [29613] 4. Tal Klein, vice president of Strategy at Adallom [29613] 5. Deepen Desai, director of security research for Zscaler ThreatLabZ [29613]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: The Nuclear Regulatory Commission (NRC) has been targeted by overseas hackers multiple times in the past three years, with incidents involving phishing emails and malware attacks [29613]. These incidents highlight the ongoing cybersecurity challenges faced by the NRC, indicating a recurring issue within the organization. (b) The software failure incident having happened again at multiple_organization: The articles mention that overseas cyberattacks have been a growing concern, with other organizations like U.S. Investigation Services (USIS) also being targeted in attacks possibly launched by foreign powers [29613]. This indicates that similar incidents of cyber intrusions and data breaches have occurred at multiple organizations, emphasizing the widespread nature of such security threats.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the hacking incidents targeting the Nuclear Regulatory Commission (NRC). The incidents involved sophisticated phishing attacks where hackers sent emails with malicious links or attachments to NRC employees, leading to compromised systems. For example, in one incident, hackers sent emails with a link to a cloud-based Google spreadsheet for logon-credential harvesting, resulting in some employees clicking the link and potentially exposing sensitive information [29613]. (b) The software failure incident related to the operation phase is evident in the actions of NRC employees who fell victim to the phishing attacks. For instance, in one incident, an NRC employee opened an infected PDF attachment sent via personal email, causing their computer to become infected and subsequently replaced [29613]. This highlights the impact of human error or misuse in the operation of the system, leading to system compromise and failure.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at the Nuclear Regulatory Commission (NRC) was primarily due to contributing factors that originated from within the system. The incidents involved hackers successfully infiltrating the NRC's systems through tactics like spearphishing emails containing malicious software, compromised personal email accounts of NRC employees, and logon-credential harvesting attempts [29613]. These internal vulnerabilities within the NRC's systems allowed the hackers to gain unauthorized access and potentially compromise sensitive information. (b) outside_system: Additionally, the software failure incident at the NRC also had contributing factors that originated from outside the system. The attacks were conducted by foreigners, with some incidents traced back to unnamed foreign countries [29613]. The external nature of these attacks highlights the threat posed by overseas hackers targeting organizations like the NRC, emphasizing the importance of robust cybersecurity measures to defend against external threats.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident at the Nuclear Regulatory Commission was primarily due to overseas hackers conducting cyberattacks on the organization's systems. These attacks included phishing attempts through emails containing malicious links and attachments, leading to the compromise of NRC employees' accounts and systems [29613]. (b) The software failure incident occurring due to human actions: In response to the cyberattacks, NRC spokesman David McIntyre mentioned that the Commission took measures such as cleaning their systems, changing user profiles, and providing mandatory annual training on computer security to employees. Additionally, the incident involving an NRC employee opening an infected PDF attachment highlights the role of human actions in contributing to the software failure incident [29613].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The article does not mention any specific software failure incident related to hardware issues. (b) The software failure incident related to software: - The software failure incident in this case was due to overseas hackers successfully infiltrating the Nuclear Regulatory Commission's computers on multiple occasions. The hackers used tactics like spearphishing emails linked to malicious software and sending malware through infected PDF attachments [29613].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. The incident involved overseas hackers successfully infiltrating the Nuclear Regulatory Commission's computers on multiple occasions. The hackers conducted activities such as logon-credential harvesting attempts through phishing emails, sending malware-infected attachments, and using malicious software linked to cloud-based storage sites to compromise NRC employees' systems [29613]. These actions were intentional and aimed at gaining unauthorized access to sensitive information, indicating a malicious objective behind the software failure incident.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident involving the U.S. Nuclear Regulatory Commission being hacked multiple times by overseas hackers can be attributed to poor decisions made by employees who fell victim to phishing attempts ([29613]). - Employees at the NRC clicked on links in emails that led to cloud-based storage sites containing malware, and one employee even opened an infected PDF attachment, leading to their computer being infected ([29613]). (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident involving the NRC being targeted by overseas hackers also involved accidental decisions made by employees who unknowingly clicked on malicious links or opened infected attachments in emails ([29613]). - These accidental decisions led to the compromise of NRC systems and the potential exposure of sensitive information to foreign entities ([29613]).
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the article as the Nuclear Regulatory Commission (NRC) fell victim to overseas hackers multiple times. The hackers successfully conducted attacks through methods like spearphishing emails linked to malicious software and sending malware-infected attachments to NRC employees [29613]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article.
Duration permanent (a) The software failure incident in the article is more of a permanent nature. The incidents of overseas hackers successfully breaching the Nuclear Regulatory Commission's computers on multiple occasions over the past three years indicate a persistent vulnerability in the system [29613]. The fact that the hackers were able to conduct phishing attacks, compromise employee accounts, and send malware to NRC employees demonstrates a sustained risk to the organization's cybersecurity. The need for continuous training and updating of security measures highlights the ongoing threat posed by such cyber intrusions.
Behaviour omission, value, other (a) crash: The software failure incident in the article does not specifically mention a crash where the system loses state and does not perform any of its intended functions [29613]. (b) omission: The incident involves instances of omission where the system omits to perform its intended functions. For example, in one incident, hackers sent emails to NRC employees in a logon-credential harvesting attempt, leading to some employees clicking on a link and providing their user accounts' information [29613]. (c) timing: The incident does not involve timing-related failures where the system performs its intended functions but too late or too early [29613]. (d) value: The software failure incident includes failures related to the system performing its intended functions incorrectly. For instance, employees were tricked into providing their user account information to hackers, leading to potential compromise of sensitive data [29613]. (e) byzantine: The incident does not exhibit byzantine failures where the system behaves erroneously with inconsistent responses and interactions [29613]. (f) other: The other behavior observed in this software failure incident is related to security vulnerabilities exploited by hackers to gain unauthorized access to the NRC's systems and sensitive information. This behavior involves malicious activities such as phishing, spearphishing, and sending malware-infected attachments to NRC employees [29613].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident reported in the articles [29613]. (b) harm: The articles do not mention any physical harm caused to individuals due to the software failure incident [29613]. (c) basic: There is no information indicating that people's access to food or shelter was impacted by the software failure incident [29613]. (d) property: The software failure incident did impact people's material goods or data. For example, in one incident, hackers broke into the personal email account of an NRC employee and sent malware in the form of an infected PDF attachment to 16 other workers, causing one computer to become infected and subsequently replaced [29613]. (e) delay: The articles do not mention any delays caused by the software failure incident [29613]. (f) non-human: Non-human entities were impacted by the software failure incident, specifically the NRC's sensitive information being targeted by overseas hackers [29613]. (g) no_consequence: The articles do not mention that there were no real observed consequences of the software failure incident [29613]. (h) theoretical_consequence: The articles discuss potential consequences of the software failure incident, such as the possibility of foreign powers using the NRC's sensitive information for surveillance or sabotage, although the attacks were detected and dealt with [29613]. (i) other: There are no other consequences of the software failure incident mentioned in the articles [29613].
Domain information, government (a) The failed system was intended to support the industry of information. The software failure incident involved overseas hackers targeting the Nuclear Regulatory Commission (NRC) in the U.S., attempting to steal sensitive information and compromise the organization's systems [29613]. The NRC is responsible for overseeing the safety of U.S. nuclear reactors, which involves handling a significant amount of critical information related to nuclear facilities and operations.

Sources

Back to List