Securing the Pipelines: DHS Implements Cybersecurity Requirements Following Attack
Cybersecurity
The Colonial Pipeline cyber attack from earlier this year threw commuters across the southeast of the US into a panic -- lines formed and grew outside of gas stations after fears spread that the cyber attack which hit the major pipeline would impact the availability of gas. Though the cyber attack didn't cause a shortage of gas, the public's reaction of panic-buying gas shows how aware we all have become regarding how impactful a cyber attack can be on our real, physical world. The Department of Homeland Security (DHS) and their Transportation Security Administration have released a new directive to force those in charge of operating pipelines such as the Colonial Pipeline to implement security features which are meant to protect the cyber space in which these pipelines exist.
“The lives and livelihoods of the American people depend on our collective ability to protect our Nation’s critical infrastructure from evolving threats,” said Secretary of Homeland Security Alejandro N. Mayorkas. “Through this Security Directive, DHS can better ensure the pipeline sector takes the steps necessary to safeguard their operations from rising cyber threats, and better protect our national and economic security. Public-private partnerships are critical to the security of every community across our country and DHS will continue working closely with our private sector partners to support their operations and increase their cybersecurity resilience.”
The Transportation Security Administration (TSA) was advised by the DHS's Cybersecurity and Infrastructure Security Agency (CISA) on how to handle the cyber incidents occurring in the pipeline industry as well as looming threats that exist against pipelines going forward. The guidance from DHS based on these conversations is that all pipelines designated by the TSA as being critical must implement cybersecurity plans which outline specific prevention, mitigation, and contingency/recovery plans for handling their greatest cyber threat: ransomware. Additionally, all owners and operators of these pipelines must conduct a cybersecurity architecture design review in order to comply with the new security directive.
The guidance on how to protect these pipelines may be seen as addition work for critical pieces of fuel infrastructure in America, but they will be helpful in preventing future cybersecurity attacks on these important pipelines. Additionally, the pipelines that may still fall victim to malicious attack will now know how to handle and recover from such attacks should they be impacted by them in the future. This will hopefully prevent pandemonium like that which we saw in the beginning of the year.
