| Recurring |
one_organization, multiple_organization |
(a) The software failure incident has happened again at Sony Pictures Entertainment. The FBI warning issued to businesses following the cyberattack on Sony described the malicious software used in the attack, indicating a similar incident within the same organization [32272].
(b) The software failure incident has also happened at other organizations in the past. The FBI report mentioned previous destructive cyber attacks in Asia and the Middle East, including one against oil producer Saudi Aramco, which knocked out some 30,000 computers. These attacks are believed to have been launched by hackers working on behalf of the governments of North Korea and Iran, indicating similar incidents at multiple organizations [32272]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be seen in the article where it mentions that hackers used malicious software to launch a destructive cyberattack on Sony Pictures Entertainment. The malware described in the FBI warning overrides all data on hard drives of computers, including the master boot record, making it extremely difficult and costly to recover the data using standard forensic methods [Article 32272].
(b) The software failure incident related to the operation phase is evident in the article where it discusses how the cyberattack on Sony Pictures Entertainment brought corporate email down for a week and crippled other systems as the company was preparing to release several highly anticipated films during the crucial holiday film season. This disruption in operations was a result of the cyberattack on the company's systems [Article 32272]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident described in the articles was primarily due to a destructive cyberattack using malicious software that overrode all data on hard drives of computers, including the master boot record, preventing them from booting up. This attack was a coordinated cyberattack with destructive payloads against a corporation in the U.S., specifically targeting Sony Pictures Entertainment [32272]. The attack originated from within the system, as hackers used malware to directly target and compromise the company's internal systems and data.
(b) outside_system: The external contributing factors to the software failure incident included the involvement of hackers who launched the cyberattack from outside the system. The attack was believed to be carried out by hackers working on behalf of governments, such as North Korea and Iran, as part of highly destructive attacks in South Korea and the Middle East. The attack on Sony Pictures Entertainment was seen as a possible retaliation for the company's involvement in the film "The Interview," which depicted the assassination of North Korean leader Kim Jong Un [32272]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in this case was primarily due to non-human actions, specifically a destructive cyberattack using malicious software that overrode all data on hard drives of computers, including the master boot record, making it extremely difficult and costly to recover the data [32272].
(b) Human actions also played a role in this software failure incident as the attack was believed to have been launched by hackers, potentially working on behalf of North Korea, as a form of retribution against Sony Pictures Entertainment for its involvement in the film "The Interview" [32272]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident described in the articles is related to hardware as the malicious software used in the cyberattack overrides all data on hard drives of computers, including the master boot record, which prevents them from booting up [32272].
(b) The software failure incident is also related to software as the attack involved the use of malicious software to launch a destructive cyberattack on Sony Pictures Entertainment, which affected the company's systems and brought down corporate email for a week [32272]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident described in the articles is malicious in nature. The incident involved a destructive cyberattack on Sony Pictures Entertainment, where hackers used malicious software to launch the attack with the intent to harm the company's systems [32272]. The malware used in the attack overrode all data on hard drives of computers, including the master boot record, making it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods [32272]. The attack was described as a watershed event in cybersecurity, representing a coordinated cyberattack with destructive payloads against a corporation in the U.S. [32272].
(b) There is no information in the articles to suggest that the software failure incident was non-malicious. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) poor_decisions: The software failure incident related to the cyberattack on Sony Pictures Entertainment was likely due to poor decisions made by the hackers who launched the attack. The attack involved the use of malicious software that overrode all data on hard drives of computers, including the master boot record, making it extremely difficult and costly to recover the data using standard forensic methods [32272].
(b) accidental_decisions: The software failure incident does not provide clear evidence of failure due to accidental decisions or unintended mistakes. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The software failure incident reported in the articles is not attributed to development incompetence. The incident was primarily a result of a destructive cyberattack using malicious software that overrode all data on hard drives of computers, including the master boot record, making it extremely difficult and costly to recover the data [32272].
(b) The software failure incident was accidental in the sense that it was not caused by incompetence during development but rather by a deliberate cyberattack using malware that was launched against Sony Pictures Entertainment, resulting in significant damage to the company's systems and operations [32272]. |
| Duration |
temporary |
The software failure incident described in the articles is temporary. The incident involved a destructive cyberattack on Sony Pictures Entertainment, where the malicious software used by hackers overrode all data on hard drives of computers, including the master boot record, preventing them from booting up. This incident caused significant disruption to Sony's operations, including bringing corporate email down for a week and crippling other systems [32272]. The incident was not a permanent failure as it was caused by specific circumstances, such as the cyberattack, rather than being a result of inherent flaws in the software itself. |
| Behaviour |
crash, other |
(a) crash: The software failure incident described in the articles can be categorized as a crash. The malicious software used in the cyberattack against Sony Pictures Entertainment caused the computers' hard drives to be overridden, including the master boot record, which prevented them from booting up. This resulted in the system losing its state and not being able to perform its intended functions [32272].
(b) omission: There is no specific mention of the software failure incident being due to the system omitting to perform its intended functions at an instance(s) in the articles.
(c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early in the articles.
(d) value: The software failure incident is not described as the system performing its intended functions incorrectly in the articles.
(e) byzantine: The software failure incident is not related to the system behaving erroneously with inconsistent responses and interactions in the articles.
(f) other: The behavior of the software failure incident can be categorized as a destructive cyberattack where the malicious software overrides data on hard drives, making it extremely difficult or impossible to recover the data using standard forensic methods. This behavior goes beyond a typical crash or malfunction, as it involves intentional and destructive actions by the attackers [32272]. |