Recently the U.S. Coast Guard published a Marine Safety
Information Bulletin (attached) regarding an incident involving a ransomware
intrusion that occurred at a Maritime Transportation Security Act (MTSA)
regulated facility. The virus, identified as “Ryuk” ransomware, may have
entered the network of the MTSA facility via an email phishing campaign. The
ransomware was able to gain access to significant Information Technology (IT)
network files and encrypt them, preventing the facility’s access to the
critical files. The virus was also able to encrypt files critical to process
operations and then infiltrated the industrial control systems that monitor and
control cargo transfers. The entire corporate IT network was impacted,
disrupting camera and physical access control systems, and loss of critical
process control monitoring systems. These combined effects required the company
to shut down the primary operations of the facility for over 30 hours while the
cyber response was conducted.
The U.S. Coast Guard states that at a minimum, the following
measures may have prevented or limited the breach and decreased the time for
- Intrusion Detection and Intrusion Prevention Systems to monitor
real-time network traffic
- Industry standard and up to date virus detection software
- Centralized and monitored host and server logging
- Network segmentation to prevent IT systems from accessing the
Operational Technology (OT) environment
- Up-to-date IT/OT network diagrams
- Consistent backups of all critical files and software
Coast Guard also recommends that facilities utilize the National Institute of
Standards and Technology (NIST) Cybersecurity Framework and NIST Special
Publication 800-82 when implementing a Cyber Risk Management Program.
Contact Greenwood Security Services to have us conduct an assessment of your cyber systems. We can also assist you with developing and implementing the recommended NIST standards.
Greenwood Security Services
An AMSYS Company
8300 Bissonnet Street, Suite 570
Houston, TX 77074
On July 9, 2019, the DHS Cybersecurity and Infrastructure Security Agency (CISA) published a notice in the Federal Register that announced the implementation of the Personnel Surety Program for all cover CFATS facilities, including Tier 3 and 4 facilities. Regulated CFATS facilities that have an approved SSP/ASP, will be notified by the Agency in a phased manner of the need to update their security plans with measures to comply with RBPS 12(iv).
To read more about the PSP requirements, click here and here.
To download a copy of the notice, click here.
Contact us if you need help revising your SSP/ASP and
implementing your Personnel Surety Program.
MPS-ISAO Warning Report, “Malicious Port Security Grant-Themed Email“. The MPS-ISAO received an email sample from a U.S. Port customer this morning, and have confirmed that it is malicious. The distribution list for this port security grant-themed email was over 500. Please click here to see the report for email indicators.
Thanks Lester Millet for the report.
Lester J. Millet III, LEM
Safety Agency Risk Manager / FSO Workgroup Chairman
Port of South Louisiana
DHS Issues 60 Day ICR Notice for CSAT
From Chemical Facility Security News
Yesterday the DHS Cybersecurity and Infrastructure Security Agency, the agency that oversees the CFATS program, published a 60-day Information Collection Request (ICR) notice for revisions to the Chemical Security Assessment Tool (CSAT). The notice is intended to revise collection and burden estimates for data collection using CSAT 2.0.
Also included in yesterday’s ICR notice is a detailed review of the risk identification tool, Identification of Additional Facilities and Assets at Risk, that DHS is using to collect data during compliance inspections. At facilities that ship and receive COIs, the facilities are requested to voluntarily provide information on:
- Shipping and/or receiving procedures
- Invoices and receipts
- Company names and locations that COI is shipped and/or received from
Facilities that are identified has having SCADA, DCS, PCS, or ICS systems are requested to voluntarily provide information on:
- Details on the system(s) that controls, monitors, and/or manages small to large production systems as well as how the system(s) operates.
- If it is standalone or connected to other systems or networks and document the specific brand and name of the system(s)
Thanks to PJ Coyle for the information on this ICR. To read a more detailed review of the ICR, click here. While there, subscribe the PJ’s blog.
If you transport certain hazardous material, you probably need to implement a security plan. Many oil and gas operators are already familiar with the U.S. Coast Guard Maritime Transportation Security Act (MTSA) and DHS Chemical Facility Anti-Terrorism Standards (CFATS), but many are not familiar with the U.S. Department of Transportation’s (DOT) Pipeline and Hazardous Materials Safety Administration (PHMSA) HAZMAT Site Security Plan requirements (49 CFR Part 172.800). The rule took effect in September 2003 and requires companies that transport hazardous material to establish a written security plan. The regulation also requires specific security training requirements for HAZMAT drivers and HAZMAT employees.
Security Plan Requirements
The security plan must include an assessment of the transportation security risk for HAZMAT shipments, including site-specific and location-specific risks associated with the facilities at which the materials are prepared for transport, stored, or unloaded incident to movement, and appropriate measures to address the assessed risks. At a minimum, the security plan must include the following elements:
- Personnel security;
- Unauthorized access;
- En route security;
- Identification by job title the senior management official responsible for the development and implementation of the security plan;
- Security duties for each position or department responsible for implementing the plan; and
- A plan for training HAZMAT employees.
The regulation requires the company/facility to ensure that each of its hazmat employees receive security awareness training as well as in-depth security training.
For more information of the DOT regulation, click here.
According to The Hill, Senators have struck a last-minute deal to extend the Chemical Facility Anti-Terrorism (CFATS) program. This program regulates how manufacturers must guard against potential terror attacks.
Congress will now vote on the bill to reauthorize the CFATS program for 15 months. The CFATS program was set to officially expire at the end of Thursday, January 17, 2019.
To read more about CFATS, click here.
To read The Hill, article click here.
To read more on the bill, click here.
Since 2013 there has been 159 homegrown jihadist cases in 30 states. Recent examples of homegrown terror-related incidents cited in the report include the case of a 28-year-old Ohio resident, Laith Alebbini, who was arrested Sept. 5 and charged with attempting to provide material support to ISIS. Also on Sept. 5, 26-year-old Alexander Ciccolo of Adams, Mass., was sentenced to 20 years in prison for the same crime. According to the snapshot, Ciccolo “planned to use pressure cooker explosives and firearms to target places where large numbers of people congregated, such as college cafeterias.” Ciccolo is the son of a Boston police captain.
To read more, click here.
There are still circumstances which may require your facility to resubmit a Top-Screen today, even if you have already resubmitted using CSAT 2.0. For example, a facility must report material modifications to its chemical holdings or facility operations, as these changes may alter a facility’s tier. Material modifications may include:
- The addition or removal of COI at the STQ and concentration
- Changes to quantity, location, or packaging of a COI as previously reported on a Top-Screen
Facilities are encouraged to report the highest expected quantity and concentration of COI they anticipate possessing over the lifecycle of their operations. By taking this approach, facilities can maintain a more efficient reporting process as they will not need to resubmit a Top-Screen when the quantity or concentration of a COI is reduced through normal operations.
Additionally, CFATS-covered facilities are required to update their Top-Screens on a regular basis, as determined by their tier:
- A Tier 1 or Tier 2 facility must update its Top-Screen two years after its SSP is approved
- A Tier 3 or Tier 4 facility must update its Top-Screen three years after its SSP is approved
Let us know if we can help you prepare and submit your CFATS Top Screen and prepare your facility for a Compliance Inspection.
To read about what to expect from a CFATS CI, click here.
The Department of Homeland Security’s Office of Inspector General performed a review of the USCG oversight of the TWIC program and found that the USCG “does not have a full understanding of the extent to which the TWIC program address security risks in the maritime environment”.
- DHS did not complete the mandated TWIC Program assessment
- USCG needs to clarify TWIC Reader requirements for industry
- USCG needs to improve TWIC card verification process
- USCG completed 33,800 TWIC verifications, but only used electronic TWIC readers to verify just 2,425 cards, or 1 in 15 cards
- USCG needs to strengthen oversight guidance on TWIC program
The report also lists four recommendation for DHS and the USCG:
- DHS Under Secretary of Science and Technology complete the TWIC program assessment required by Public Law 114-278 to evaluate the security value of the TWIC program.
- The USCG’s Assistant Commandant for Prevention Policy take action to more clearly define the applicable facilities that have certain dangerous cargo in bulk and which must implement the use of electronic TWIC readers as an access control measure.
- The USCG’s Assistant Commandant for Prevention Policy improve the Coast Guard’s use of electronic TWIC card readers during annual inspections at regulated facilities by procuring new TWIC card readers.
- The USCG’s Assistant Commandant for Prevention Policy revise and strengthen the Coast Guard TWIC Verification and Enforcement Guide.
DHS concurred with all four of the recommendations and stated that the Homeland Security Operational Analysis Center is currently conducting an assessment of the TWIC program. The estimated completion date for the DHS assessment is March 30, 2020.
To download a copy of the full report, click here.
Last week the DHS Infrastructure Security Compliance Division posted a link to a new version of the Chemical Security Assessment Tool (CSAT) 2.0 Portal User Manual.
Read more here.
Click here to download the CSAT 2.0 User Manual.