Source: https://chemical-facility-security-news.blogspot.com/2018/02/
Timestamp: 2019-10-23 15:51:37
Document Index: 241584179

Matched Legal Cases: ['§3', '§3', '§3', '§3', '§3', '§3', '§3', '§3', '§3']

Chemical Facility Security News: February 2018
Yesterday with both the House and Senate in session, there were 63 bills introduced. Of those, two may be of specific interest to readers of this blog:
HR 5099 To amend the Homeland Security Act of 2002 to establish in the Department of Homeland Security a fusion center technical assistance program. Rep. Estes, Ron [R-KS-4]
HR 5131 To improve the effectiveness of Federal efforts to identify and address homeland security risks to surface transportation, secure against vehicle-based attacks, and conduct a feasibility assessment of introducing new security technologies and measures, and for other purposes. Rep. Watson Coleman, Bonnie [D-NJ-12]
I will be watching HR 5099 to see if it includes specific cybersecurity requirements, particularly for industrial control system security issues.
I will be watching HR 5131 for chemical transportation security issues.
Posted by PJCoyle at 10:02 AM No comments: Links to this post
Labels: Bills Introduced, Fusion Center Support, HR 5099, HR 5131, Surface Transportation Security
With both the House and Senate back in Washington this week there are a relatively small number of hearings being held on both sides of the Capitol. Two Senate hearings may be of specific interest to readers of this blog; DHS authorization markup and an oversight hearing looking at PTC implementation.
On Wednesday the Senate Homeland Security and Governmental Affairs Committee will hold a markup [.PDF download] of HR 2825, the DHS Authorization Act of 2017. The bill was passed in the House by a substantially bipartisan vote in July of last year. It is unusual that the Committee is taking up the bill without introducing a bill of its own, but the Senate has been busy with nominations and other ‘incidental’ business.
On Thursday the Senate Commerce, Science, and Transportation Committee will conduct an oversight hearing on the implementation of positive train control (PTC) technology by passenger railroads. The Committee asked for reports from both the GAO and the DOT Inspector General on the topic and both reports will be presented at this hearing. The witness list includes:
• Susan Fleming, Government Accountability Office;
• Barry J. DeWeese, Department of Transportation OIG;
• David L. Mayer, Metropolitan Transportation Authority; and
Labels: Congressional Hearings, HR 2825, PTC Implementation
Earlier this month Sen Cantwell (D,WA) introduced S 2444, the Energy Cybersecurity Act of 2018. It would require the Department of Energy to address electric grid cybersecurity, resiliency and risk assessment issues.
Section 3(a) would require the Secretary to address energy sector cybersecurity issues. It would require DOE to develop cybersecurity applications and technologies to {§3(a)(1)(A)}:
• Identify and mitigate vulnerabilities; and
• Advance the security of field devices and third-party control systems;
The vulnerabilities that are required to be addressed specifically include {§3(a)(1)(A)(i)}:
• Dependencies on other critical infrastructure; and
• Impacts from weather and fuel supply.
The security advances would specifically include devices and systems such as {§3(a)(1)(A)(ii)}:
• Systems for generation, transmission, distribution, end use, and market functions;
• Specific electric grid elements including advanced metering, demand response, distributed generation, and electricity storage;
• Forensic analysis of infected systems; and
The bill would authorize the expenditure of $65 million per year through 2026 for these efforts.
Cyberresilience Testing
Section 3(b) of the bill would require the Secretary to develop a cyberresilience testing program “to identify vulnerabilities of energy sector supply chain products to known threats” {§3(b)(1)(A)}. The program would include oversight of third party cyber-testing and developing procurement guidelines for energy sector supply chain components. The bill would authorize the expenditure of $15 million per year for this program.
Cyberresilience Operational Support
Section 3(c) of the bill would allow the Secretary to carry out a program to {§3(c)(1)}:
• Enhance and periodically test the emergency response capabilities
of the Department in coordination with other agencies, the National Laboratories, and private industry;
• Expand cooperation of the Department with the intelligence communities for energy sector-related threat collection and analysis;
• Enhance the tools of the Department and ES–ISAC for monitoring the status of the energy sector;
• Expand industry participation in ES–ISAC; and
• Provide technical assistance to small electric utilities for purposes of assessing cyber-maturity level.
The bill would authorize the expenditure of $10 million per year for these activities.
Energy Sector Infrastructure Risk
Section 3(d) of the bill would require the Secretary to “develop an advanced energy security program to secure energy networks, including electric, natural gas, and oil exploration, transmission, and delivery” {§3(d)(1)}. The goal of the program would be “to increase the functional preservation of the electric grid operations or natural gas and oil operations in the face of natural and human-made threats and hazards, including electric magnetic pulse and geomagnetic disturbances” {§3(d)(2)}.
To support this effort the Secretary would be allowed to {§3(d)(3)}:
• Develop capabilities to identify vulnerabilities and critical components that pose major risks to grid security if destroyed or impaired;
• Provide modeling at the national level to predict impacts from natural or human-made events;
• Develop a maturity model for physical security and cybersecurity;
• Conduct exercises and assessments to identify and mitigate vulnerabilities to the electric grid, including providing mitigation recommendations;
• Conduct research hardening solutions for critical components of the electric grid;
• Conduct research mitigation and recovery solutions for critical components of the electric grid; and
• Provide technical assistance to States and other entities for standards and risk analysis.
The bill would authorize the expenditure of $10 million per year to support these activities.
Cantwell is the Ranking Member on the Senate Energy and Natural Resources Committee to which this bill was assigned for consideration. This would seem to indicate that she could have the necessary influence to see this bill considered by that Committee. The lack of a Republican co-sponsor, however, may indicate the lack of bipartisan support necessary to see the bill moved out of Committee.
The big stumbling block to moving this bill forward is the inclusion of funding authorization for the programs described in the bill. While the amounts authorized are small on the federal money scale, under Senate rules they would still have to come out of existing funding. If Cantwell can identify funding sources for this bill, it would make moving the bill forward much easier.
Section 2 of the bill does provide definitions of some of the organization terms used in the bill, but it does not address any of the technical definitions of terms like ‘cybersecurity’ or ‘cyberresilience’. I suspect that this was done to provide the Secretary with the widest possible latitude in exercising authority under this legislation. Unfortunately, I think that this actually have the opposite effect; actually limiting what actions are taken.
As I am with most pieces of cybersecurity legislation that I review, I am disappointed that Cantwell (and her Committee Staff who actually crafted this bill) fails to address the role of independent security researchers in discovering vulnerabilities in software and devices. Section 3(b) of this bill would have been an excellent place to address this issue.
Instead of establishing a “cybertesting (sic) and mitigation program to identify vulnerabilities of energy sector supply chain products” the bill should have established an office in the DOE responsible for the identification and coordination of cyber-vulnerability mitigation in devices and applications used in the energy sector. While this is very similar to what ICS-CERT is currently doing on a voluntary basis for a much wider range of devices, a DOE-CERT would be given the specific responsibility to push vulnerability communications down to covered user-entities. Positive vendor responses to vulnerability identification could be ensured by DOE-CERT requiring covered user-entities to take specific compensatory measures when vendors cannot or will not mitigate vulnerabilities. A DOE-CERT could also provide support to the independent researcher community buy managing a DOE bug bounty program.
Finally, I would have liked to have seen this bill specifically address supporting {in §3(c)} National Guard cyber units in preparing for emergency response for cyber related grid emergencies. This would be particularly appropriate for grid emergencies that cross State boundaries. A DOE resiliency office could serve a coordinating office for multi-state planning and execution of responses to grid emergencies. This non-military coordination would provide political and legal cover for posse comitatus concerns.
Labels: Energy Cybersecurity, S 2444
Yesterday, with both the House and Senate back in town after the long week off for President’s day, there were 21 bills introduced. Of those, two may be of specific interest to readers of this blog:
HR 5089 To improve threat information sharing, integrated operations, and law enforcement training for transportation security, and for other purposes. Rep. Barragan, Nanette Diaz [D-CA-44]
HR 5094 To direct the Secretary of Homeland Security to improve suspicious activity reporting to prevent acts of terrorism, and for other purposes. Rep. King, Peter T. [R-NY-2]
I will be watching HR 5089 for its potential effects on chemical transportation security.
While I suspect that HR 5094 will be very generic in scope, I will be watching it for potential impacts on chemical facility security and (a real remote possibility) cybersecurity.
Posted by PJCoyle at 6:03 AM No comments: Links to this post
Labels: Bills Introduced, HR 5089, HR 5094, Information Sharing, Suspicious Activity Reporting
Posted by PJCoyle at 8:43 AM No comments: Links to this post
Back in December the DHS Infrastructure Security Compliance Division (ISCD) published a 60-day information collection request revision notice for proposed changes to the personnel surety program (PSP) for the Chemical Facility Anti-Terrorism Standards (CFATS) program. Comments on the proposed extension of the anti-terrorist screening requirement to Tier III and Tier IV facilities were solicited. The first comments were received this week.
Comments were received from (links are .PDF downloads):
• The Chlorine Institute;
• The Fertilizer Institute; and
• The International Liquid Terminals Association
Rather than the general opposition to the PSP process that marked many industry comments on earlier iterations of the PSP ICR process, these three comments raised some interesting questions (and generally provided potential solutions) arising from the expansion of the PSP terrorist vetting program.
Some detailed questions were raised about the assumptions that were made by ISCD for calculating the average burden estimate. It would seem that ISCD has a better basis for making these estimates now that they have worked closely with Tier I and Tier II facilities in implementing the PSP submissions, but legitimate questions have been raised about differences between the types of facility included in the two different risk categories of facilities.
There close of the comment period is Monday, so there is a decent chance that there will be more comments posted to the www.Regulations.gov web site for this ICR. ISCD will take some amount of time to review the comments and address them as they determine appropriate. ISCD will then publish a 30-day ICR notice before sending the ICR to OMB for approval. It could still be six months to a year or more before OMB approves the expansion of the PSP terrorist screening process. And we have to remember that Congress will have a chance to weigh in on the process (again) when they (hopefully) reauthorize the CFATS program later this year.
Labels: CFATS PSP, Chemical Facility Security, ICR
Posted by PJCoyle at 8:50 AM No comments: Links to this post
Posted by PJCoyle at 9:34 AM No comments: Links to this post
Today the DHS ICS-CERT published the second update of their Meltdown Alert for this week. The update provides new information on the alert that was originally published on January 11th, 2018 and updated on January 16th, 2018, January 17th, 2018, January 30th, 2018, and on February 20th, 2018.
The update provides links to three new vendor documents. They are:
• Beckman Coulter;
• Siemens (actually this link is good, but the one in the update does not work);
• Stryker (this is a direct link, the one in the update is a link to a link)
Both the Beckman and Stryker links take you to documents that were dated in January, so they are very preliminary notifications with little information. The Siemens document is dated today, and it provides some level of actionable detail for a number of industrial products.
NOTE: Siemens also released two other new security notifications this morning as well as updating six previously issued notifications. We may see these tomorrow on ICS-CERT, but more likely it will be next week.
Posted by PJCoyle at 6:24 PM No comments: Links to this post
Labels: Beckman, Control System Security, ICS-CERT Update, Meltdown, Siemens, Stryker
Yesterday, with the House and Senate meeting in pro forma session (most congresscritters back in their districts), there were 9 bills introduced. Of those one may be of specific interest to readers of this blog:
HR 5074 To authorize cyber incident response teams at the Department of Homeland Security, and for other purposes. Rep. McCaul, Michael T. [R-TX-10]
As usual with cybersecurity bills, I will be watching definitions closely to see if the provisions specifically apply to industrial control systems.
Posted by PJCoyle at 7:22 AM No comments: Links to this post
Labels: Bills Introduced, DHS Cyber Response Teams, HR 5074
Posted by PJCoyle at 10:58 PM No comments: Links to this post